Terraform state drift detected in CI (plan shows unexpected changes)

Drift is when real infrastructure no longer matches state. A scheduled or PR plan surfaces it as changes that revert manual edits, so CI flags a diff nobody intended.

What this error means

A terraform plan in CI (often a drift-detection or PR job) shows updates/replacements to resources nobody changed in code, because the live resource was edited out-of-band.

terraform

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply":

  # aws_security_group.app has changed
  ~ ingress {
      ~ cidr_blocks = ["10.0.0.0/8"] -> ["0.0.0.0/0"]
    }

Common causes

Manual console changes

An operator edited the resource directly, diverging it from the Terraform-defined config.

Another tool manages the same resource

A second IaC tool or auto-remediation modifies a resource Terraform also manages.

Provider default changed

A provider upgrade changed a default the resource now reports differently.

How to fix it

Decide: codify or revert

If the out-of-band change is desired, update the Terraform config to match, then apply.
If it was unauthorized, apply to revert the resource to the declared config.
Use terraform plan -refresh-only to inspect drift without proposing code-driven changes.

Terminal

terraform plan -refresh-only

Ignore intentionally externally-managed fields

For attributes deliberately managed elsewhere, add them to lifecycle { ignore_changes = [...] } so they stop showing as drift.

How to prevent it

Restrict console write access so Terraform is the single source of truth.
Run scheduled drift-detection plans to catch divergence early.
Use ignore_changes for fields owned by another system.