Detecting Infrastructure Drift
FreeIdentify discrepancies between your infrastructure and IaC definitions.
Free · Opens the source repo
What Detecting Infrastructure Drift does
Detecting Infrastructure Drift is a skill designed for DevOps engineers and cloud architects who need to ensure that their cloud infrastructure remains consistent with their Infrastructure as Code (IaC) definitions. This skill leverages tools like Terraform, AWS CloudFormation, and Pulumi to identify any drift from the desired state. By executing drift detection commands, users can analyze modified, added, or deleted resources, generating detailed reports that highlight discrepancies and suggest remediation steps. This is crucial for maintaining compliance and operational integrity in cloud environments.
The skill requires an up-to-date project directory containing IaC configuration files, along with the necessary cloud provider CLI tools installed and authenticated. Once set up, users can initiate drift detection by running specific commands tailored to their IaC tool. The skill parses the output to categorize resources based on their drift status, allowing users to quickly identify whether changes were intentional or accidental. This functionality is particularly valuable in environments where multiple teams may interact with the infrastructure, leading to potential configuration errors or unauthorized changes.
Additionally, the skill provides structured drift reports that detail the affected resources, attribute differences, and severity classifications. Users are guided through remediation options, whether that involves applying the desired state, importing changes, or updating the IaC definitions to match the current state. For ongoing compliance, the skill can be configured to run drift detection on a regular schedule, integrating seamlessly with CI/CD pipelines to ensure continuous monitoring and alerting on any drift detected.
In summary, Detecting Infrastructure Drift is an essential tool for teams relying on IaC to manage cloud resources. It not only helps in identifying discrepancies but also provides actionable insights to maintain alignment between the actual infrastructure and the defined desired state.
When to use it
Use this skill when you need to verify that your cloud infrastructure matches your IaC configurations, especially after changes have been made.
When not to use it
This skill may not be suitable for environments without IaC practices or where manual infrastructure management is preferred.
What you can build with it
Daily Drift Checks
Set up a daily CI/CD pipeline that runs drift detection and alerts the team if any discrepancies are found.
Remediation Reporting
Generate detailed drift reports after detecting changes, outlining affected resources and recommended remediation steps.
Manual Change Investigation
Use the skill to identify unauthorized changes made to the infrastructure and implement guardrails to prevent future occurrences.
How to install Detecting Infrastructure Drift
View source1. Install with the skills CLI
npx skills add jeremylongshore/claude-code-plugins-plus-skills/detecting-infrastructure-drift --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by jeremylongshoreDetecting Infrastructure Drift
Current State
!ls *.tf Dockerfile docker-compose.yml 2>/dev/null || echo 'No IaC files found'
!terraform version 2>/dev/null || echo 'Terraform not installed'
Overview
Detect discrepancies between actual cloud infrastructure state and the desired state defined in IaC (Terraform, CloudFormation, Pulumi). Run drift detection commands, analyze modified/added/deleted resources, generate drift reports with affected resources, and provide remediation steps to bring infrastructure back into compliance.
Prerequisites
- IaC configuration files up to date in the project directory
- Cloud provider CLI installed and authenticated with read access to all managed resources
- IaC tool installed: Terraform 1.0+, AWS CLI (for CloudFormation drift), or Pulumi
- Remote state storage accessible and current (S3 backend, Terraform Cloud, Pulumi Cloud)
- Read-only IAM permissions for all resource types managed by IaC
Instructions
- Identify the IaC tool in use by scanning for
.tffiles,template.yaml, orPulumi.yaml - Initialize the IaC tool if needed:
terraform initto download providers and configure backend - Run drift detection:
terraform plan -detailed-exitcode(exit code 2 = drift detected),aws cloudformation detect-stack-drift, orpulumi preview - Parse the output to identify resources with drift: added (exists in cloud but not in IaC), modified (attributes changed), or deleted (in IaC but missing from cloud)
- For each drifted resource, determine if the drift is intentional (manual hotfix) or unintentional (configuration error, unauthorized change)
- Generate a structured drift report with resource identifiers, attribute differences, and severity classification
- Provide remediation options per resource:
terraform applyto enforce desired state,terraform importto adopt changes, or update IaC to match reality - Schedule recurring drift detection: configure a cron job or CI pipeline to run daily and alert on drift
- Investigate the root cause: determine who made the manual change and implement guardrails (SCPs, IAM restrictions) to prevent recurrence
Output
- Drift detection report with resource-level detail: resource type, ID, drifted attributes, expected vs. actual values
- Remediation commands:
terraform apply,terraform import, or IaC code updates - CI/CD pipeline step for automated drift detection on a schedule
- Alert configuration for drift detection results (Slack, email, PagerDuty)
- Prevention recommendations: IAM policy restrictions, SCP guardrails, automated enforcement
Error Handling
| Error | Cause | Solution |
|---|---|---|
Error acquiring state lock | Another Terraform process is running or stale lock | Wait for the other process; use terraform force-unlock <ID> if the lock is stale |
Unable to authenticate to cloud provider | Expired or missing credentials | Refresh with aws configure, gcloud auth login, or az login |
No state file found | Backend not initialized or state file deleted | Run terraform init to configure the backend; restore state from backup if deleted |
Access denied reading resource | IAM policy missing read permissions for some resource types | Grant read-only access for all resource types managed by IaC (ReadOnlyAccess or specific policies) |
State file version mismatch | Terraform version newer than state format | Upgrade Terraform to match the state version or use terraform state replace-provider |
Examples
- "Run drift detection against all Terraform-managed infrastructure and generate a report of resources that have changed since last apply."
- "Set up a daily GitHub Actions workflow that runs
terraform planand posts drift results to Slack if any resources are out of sync." - "Detect CloudFormation stack drift for the production VPC stack and provide remediation steps for any MODIFIED resources."
Resources
- Terraform drift detection: https://developer.hashicorp.com/terraform/tutorials/state/resource-drift
- CloudFormation drift detection: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html
- Pulumi drift detection:
- Preventing drift: https://developer.hashicorp.com/terraform/tutorials/state/refresh
Frequently asked questions about Detecting Infrastructure Drift
Similar skills
Turborepo
Optimized build system for JavaScript/TypeScript monorepos.
Azure Pipelines Validation
Streamline your Azure DevOps pipeline changes locally.
Azure Developer CLI
Streamline your Azure project workflows with best practices.
Azure Container Registry CLI
Manage Azure Container Registry resources with ease.
Aspire
Build and orchestrate polyglot distributed applications seamlessly.
Vercel CLI
Manage and deploy Vercel projects from the command line.