> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anyshift.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Drift Detection

> Find the gap between what you declared in Terraform and what is actually running in your cloud and Kubernetes clusters.

## Overview

Drift happens. Someone edits a security group in the AWS console, an engineer scales a deployment manually, a failed `terraform apply` leaves state out of sync. Annie continuously correlates your **declared** infrastructure (Terraform code + state) with your **actual** infrastructure (live cloud, live Kubernetes) and surfaces the gaps.

<CardGroup cols={3}>
  <Card title="Declared" icon="code">
    What your Terraform modules and manifests say should exist.
  </Card>

  <Card title="Managed" icon="database">
    What your Terraform state believes it's tracking.
  </Card>

  <Card title="Actual" icon="cloud">
    What's really running in AWS, GCP, and Kubernetes right now.
  </Card>
</CardGroup>

## What You Can Ask Annie

<AccordionGroup>
  <Accordion icon="code-compare" title="Manual changes">
    * *"What resources were modified outside of Terraform this week?"*
    * *"Show me security groups changed via the AWS console in the last 24 hours"*
    * *"Which IAM roles had policies attached manually?"*
  </Accordion>

  <Accordion icon="ghost" title="Orphaned and unmanaged resources">
    * *"Which live resources are not in any Terraform state file?"*
    * *"Show me EC2 instances with no Terraform backing"*
    * *"Which S3 buckets exist in AWS but aren't declared anywhere?"*
  </Accordion>

  <Accordion icon="cubes" title="Kubernetes drift">
    * *"Are my declared replica counts matching the pods actually running?"*
    * *"Show me deployments where ready replicas differ from desired"*
    * *"Which ConfigMaps were edited directly in the cluster?"*
  </Accordion>

  <Accordion icon="link-slash" title="Broken references">
    * *"Which Terraform resources reference dependencies that no longer exist?"*
    * *"Show me state entries pointing to deleted cloud resources"*
  </Accordion>
</AccordionGroup>

## Real-World Examples

<AccordionGroup>
  <Accordion icon="fire" title="The 'who opened port 22?' investigation">
    PagerDuty alerted on an unexpected SSH attempt against a dev box.

    *"Has any security group been changed outside Terraform this week?"*

    > I found 2 manual changes:
    >
    > * `sg-dev-debug`: Port 22 opened to `0.0.0.0/0` via AWS console on Tuesday 14:03 by user `alice@...`
    > * `sg-prod-db`: Inbound rule for `10.0.5.0/24` added via CLI on Wednesday 09:17
    >
    > Neither change is reflected in the Terraform code or state.
  </Accordion>

  <Accordion icon="code-compare" title="Replica drift after a bad deploy">
    The checkout service is flaky. I suspect a partial rollout.

    *"Which deployments have fewer ready replicas than declared?"*

    > 3 deployments have drift:
    >
    > * `checkout`: declared 8, ready: 5 (3 pods in `ImagePullBackOff`)
    > * `billing-worker`: declared 4, ready: 4 ✓ (no drift)
    > * `search-indexer`: declared 2, ready: 0 (OOMKilled, CrashLoopBackOff)
    >
    > The `checkout` image tag in your Helm values doesn't exist in the registry.
  </Accordion>

  <Accordion icon="ghost" title="Finding orphaned cloud resources">
    I suspect the cloud bill has resources nobody remembers.

    *"Show me EC2 instances and RDS databases not backed by any Terraform state"*

    > I found 7 unmanaged resources across your AWS accounts:
    >
    > * 4 EC2 instances in `us-east-1` (tagged `env=experiment`, launched 2024)
    > * 2 RDS snapshots in `eu-west-1` (no source instance exists)
    > * 1 NAT Gateway in `us-west-2` (no route table references it)
  </Accordion>
</AccordionGroup>

## Best Practices

<CardGroup cols={2}>
  <Card title="Check drift before planning" icon="list-check">
    Ask Annie for drift in the target environment before running `terraform plan`. It often explains surprising diffs.
  </Card>

  <Card title="Scope by environment or module" icon="crosshairs">
    Drift queries are more useful when narrowed: *"...in the `prod` workspace"*, *"...in the `networking` module"*.
  </Card>

  <Card title="Combine with change history" icon="clock-rotate-left">
    Pair drift queries with [Change Management](/pages/product/time_travel) to see *who* made the change and *when*.
  </Card>

  <Card title="Investigate orphans periodically" icon="ghost">
    Unmanaged resources are both a cost and a security concern. Ask Annie monthly.
  </Card>
</CardGroup>

## Get Started

<CardGroup cols={2}>
  <Card title="Connect Terraform" icon="code" href="/pages/iac/terraform">
    You need code + state connected for drift detection to work.
  </Card>

  <Card title="Connect Kubernetes" icon="cubes" href="/pages/integration/kubernetes">
    Install the agent to get declared-vs-actual drift inside your clusters.
  </Card>
</CardGroup>