Terraform State Drift - "Objects have changed outside of Terraform"

Terraform found that real infrastructure no longer matches what state records. Something changed the resources out of band - a console edit, another tool, or a provider default - so plan shows a diff you did not expect.

What this error means

terraform plan reports "Note: Objects have changed outside of Terraform" and proposes changes you did not author, or apply fails because a resource is not in the state Terraform expected. The config did not change - reality did.

terraform plan output

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply":

  # aws_security_group.web has been changed
  ~ ingress { ... }

Common causes

Out-of-band changes to real resources

A console edit, a script, or another automation modified a resource Terraform manages. State still reflects the old shape, so plan wants to revert it.

A resource deleted or replaced externally

If something deleted a managed resource, state references an object that no longer exists, producing a mismatch on the next run.

How to fix it

Refresh and review the drift

Run a refresh-only plan to update state from reality and see exactly what diverged before deciding.

Terminal

terraform plan -refresh-only
# apply the refresh if the real change is the desired state
terraform apply -refresh-only

Reconcile config, state, or reality

If the out-of-band change should stay, update the Terraform config to match it.
If state is wrong about a moved/renamed resource, use terraform state mv or import to fix it.
If a managed object was deleted externally, let Terraform recreate it on the next apply.

How to prevent it

Make Terraform the single source of truth - avoid console edits to managed resources.
Run scheduled plan (drift detection) so divergence is caught early.
Restrict write access so only Terraform mutates managed infrastructure.