Fix: Terraform Drift Detected / State Mismatch

!Symptoms

• terraform plan shows unexpected changes to resources you did not modify
• Resources were changed outside of Terraform (manual console changes)
• terraform apply wants to destroy and recreate resources
• State file shows different values than actual cloud resources

?Root Causes

• Someone made manual changes in the cloud console
• Another tool or script modified resources Terraform manages
• Terraform state was not updated after a failed apply
• Provider version upgrade changed resource attribute computation
• Import was done incorrectly, leaving attributes out of sync

#Diagnosis Steps

1. 1Run `terraform plan` to see the full list of drifted resources
2. 2Compare state with reality: `terraform show` vs cloud console
3. 3Check who changed the resource: cloud audit logs (CloudTrail, Activity Log)
4. 4Use `terraform refresh` to update state to match reality (careful: may lose intended changes)
5. 5Check provider changelog for breaking changes if upgrading

>Fix

1. 1If manual changes should be kept: `terraform apply -refresh-only` to update state
2. 2If Terraform config is correct: `terraform apply` to revert manual changes
3. 3For specific resources: `terraform import <resource> <id>` to re-import
4. 4Move resources in state if they were renamed: `terraform state mv <old> <new>`
5. 5If state is corrupted: restore from state backup and re-plan

*Prevention

• Enforce a no-manual-changes policy: all infrastructure changes through Terraform
• Use drift detection tools: Terraform Cloud drift detection, driftctl
• Enable state locking and versioning for rollback capability
• Run terraform plan on a schedule to detect drift early
• Use read-only console access for engineers who should not make manual changes

Related Error Messages