Drift detection in CI/CD in Terraform - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is drift detection in Terraform CI/CD pipelines?

In a Terraform-based CI/CD pipeline, what does drift detection mean?

A Detecting changes in infrastructure that were made outside of Terraform management

B Automatically applying all pending Terraform changes without review

C Running Terraform plan only when code changes are pushed

D Backing up Terraform state files to a remote location

💡 Hint

Think about what happens if someone changes the cloud setup manually, not through Terraform.

Drift detection means identifying when the real infrastructure differs from what Terraform expects, usually because of manual changes outside Terraform.

💻 Command Output

intermediate

Output of Terraform plan detecting drift

What output will Terraform show if the actual infrastructure has drifted from the last applied state?

Terraform

terraform plan

A Shows 'No changes. Infrastructure is up-to-date.'

B Shows a list of changes Terraform will apply to fix the drift

C Throws an error about missing state file

D Automatically applies changes without confirmation

💡 Hint

Terraform plan shows what it will do to match the real infrastructure to the code.

If drift exists, terraform plan will show the changes needed to bring infrastructure back in sync with the code.

🔀 Workflow

advanced

Best place to add drift detection in CI/CD pipeline

Where in a CI/CD pipeline should you add drift detection to catch manual changes early?

A Before applying changes, run 'terraform plan' to detect drift

B Only after applying changes, run 'terraform apply' without plan

C Skip drift detection and rely on manual audits

D Run drift detection only on production environment after deployment

💡 Hint

Think about catching problems before making new changes.

Running 'terraform plan' before applying changes helps detect drift early and prevents applying unexpected changes.

❓ Troubleshoot

advanced

Why does Terraform plan show no changes despite drift?

You suspect drift in your infrastructure, but running terraform plan shows no changes. What could cause this?

A Terraform does not support drift detection

B Terraform automatically fixed the drift before plan

C Terraform state file is outdated or corrupted

D The cloud provider API is down

💡 Hint

Think about what Terraform uses to compare infrastructure state.

If the state file is outdated or corrupted, Terraform cannot detect drift correctly and may show no changes.

✅ Best Practice

expert

Automating drift detection in multi-environment CI/CD

In a multi-environment setup (dev, staging, prod), what is the best practice to automate drift detection?

A Ignore drift detection in non-production environments

B Only run drift detection manually when issues are reported

C Run 'terraform apply' daily to force sync all environments

D Schedule regular 'terraform plan' runs with state refresh for each environment and alert on drift

💡 Hint

Think about proactive monitoring and alerting.

Regular automated 'terraform plan' runs with state refresh help detect drift early and alert teams to fix it before problems grow.