Terraform interview question · Most asked
What is drift, and how do you detect and handle it?
Summary
Drift is a difference between the real infrastructure and what Terraform's configuration and state say, usually from manual console changes, other tools or scripts, or provider-side defaults changing. terraform plan (which refreshes state) shows it; scheduled plan runs in CI or HCP Terraform drift detection catch it continuously.
Longer Answer
When you find drift, decide whether the real-world change should be kept (update the configuration to match, possibly with ignore_changes for values another system owns) or reverted (apply the configuration). The real fix is process: restrict console write access in production, route changes through code review, and alert on drift. terraform plan -refresh-only updates state to match reality without changing infrastructure.
Key Points
- Reality differs from config/state.
- Detect with scheduled plans.
- Adopt or revert, deliberately.
- Prevent with access controls and process.
More most-asked Terraform questions
- How do you handle secrets in Terraform?
- How would you run Terraform in CI/CD?
- What is Terraform state, why is it needed, and where should it be stored?
- count or for_each: when do you use each?
- Walk through terraform init, plan and apply. What does each do?
- What is Terraform, and how does it work at a high level?
- What are Terraform modules, and how do you design good ones?
- A terraform plan wants to destroy and recreate a database. What do you do?