Terraform Drift Calculator
Calculate infrastructure drift percentage between Terraform state and real-world resources, with a risk score.
Inputs
Resources where real-world state differs from Terraform state.
Total resources managed by this Terraform configuration/state.
Of the drifted resources, how many are critical (security groups, IAM, production databases).
Infrastructure Drift
6.00%
Drift Risk Level
Moderate
Risk Score
39.0/100
Critical Share of Drift
22.2%
Step by step
Drift %: drifted / total
9 / 150
= 6.00%
Risk score: drift×1.5 + critical×15
6.00×1.5 + 2×15
= 39.0
How it works
Drift occurs when real infrastructure diverges from what's recorded in Terraform state — typically from manual console changes or out-of-band automation. Formula: drift% = resources_with_diff / total_resources × 100. The risk score weights raw drift percentage alongside how many drifted resources are critical (security groups, IAM, production data stores), since a small number of critical drifted resources can matter more than a larger number of low-stakes ones.
Formulas
Drift percentage
drift_percent = (resources_with_diff / total_resources) × 100
- resources_with_diff
- Resources where real state differs from Terraform state
- total_resources
- Total managed resources
Risk score
risk_score = clamp(drift_percent × 1.5 + critical_drifted × 15, 0, 100)
- drift_percent
- Overall drift percentage
- critical_drifted
- Number of critical resources that have drifted
Frequently Asked Questions
How do I detect drift in Terraform?
Run `terraform plan -refresh-only` (or `terraform plan` in older versions) to compare real infrastructure against state without making changes — any diffs shown are drift.
What commonly causes drift?
Manual changes made directly in a cloud console or CLI, auto-scaling and managed services that change attributes outside Terraform's control, and other automation (e.g. a security team's compliance tooling) modifying resources Terraform also manages.
How do I fix drift?
Either update your Terraform configuration to match the real state and apply (adopting the manual change), or run `terraform apply` to revert the resource back to what's declared in code — the right choice depends on which is the source of truth.
How often should I check for drift?
Many teams run scheduled drift detection (daily or on a CI cron) for production infrastructure, since undetected drift compounds and makes the next real `apply` riskier and harder to predict.
You might also need
- Terraform Resource Count CalculatorCommonly used together
- Terraform Infrastructure Score CalculatorCommonly used together
- Terraform Plan Complexity CalculatorCommonly used together
- Terraform Apply Time CalculatorAlso in Terraform
- Terraform Workspace CalculatorAlso in Terraform
- Terraform Graph Complexity CalculatorAlso in Terraform