Calculate the percentage of resources that have drifted from their Terraform state.
Drift occurs when real infrastructure diverges from what's recorded in Terraform state — typically from manual console changes or out-of-band automation. Formula: drift% = resources_with_diff / total_resources × 100. The risk score weights raw drift percentage alongside how many drifted resources are critical (security groups, IAM, production data stores), since a small number of critical drifted resources can matter more than a larger number of low-stakes ones.
Drift percentage
drift_percent = (resources_with_diff / total_resources) × 100
Risk score
risk_score = clamp(drift_percent × 1.5 + critical_drifted × 15, 0, 100)
Run `terraform plan -refresh-only` (or `terraform plan` in older versions) to compare real infrastructure against state without making changes — any diffs shown are drift.
Manual changes made directly in a cloud console or CLI, auto-scaling and managed services that change attributes outside Terraform's control, and other automation (e.g. a security team's compliance tooling) modifying resources Terraform also manages.
Either update your Terraform configuration to match the real state and apply (adopting the manual change), or run `terraform apply` to revert the resource back to what's declared in code — the right choice depends on which is the source of truth.
Many teams run scheduled drift detection (daily or on a CI cron) for production infrastructure, since undetected drift compounds and makes the next real `apply` riskier and harder to predict.