Terraform Drift Detection Before AI Agents Apply Infrastructure Changes

An AI agent should not run terraform apply against production just because the diff looks reasonable.

The first question is drift:

Does real infrastructure still match the state and configuration the agent thinks it is changing?

If the answer is no, the agent may be planning against a stale map. That is how safe-looking changes delete emergency fixes, reopen ports, shrink the wrong node pool, or undo a manual incident response.

Drift Is Normal

Drift happens when real infrastructure changes outside the normal IaC workflow.

Common causes:

• Incident hotfixes.
• Console changes.
• Provider-side defaults.
• Manual security fixes.
• Failed deploys.
• Imported resources.
• Out-of-band automation.
• Separate teams managing adjacent resources.

Terraform's drift documentation is direct about the risk: when state, configuration, and real infrastructure diverge, Terraform may reconcile them in ways you did not intend.

AI agents make this more important because they can move quickly through a plan, patch, and apply loop.

The Safer Order

Use this order before any agent-assisted IaC change.

1. Refresh Reality Without Changing It

For Terraform, use a refresh-only plan to inspect changes between state and real infrastructure before making a normal plan.

terraform plan -refresh-only

OpenTofu has a similar refresh-only plan mode. The point is to detect reality first.

Do not treat this as a boring preflight. It is the step that tells you whether the agent is working with current truth.

2. Identify Whether Drift Was Intentional

Not all drift is bad.

Intentional drift:

• Emergency mitigation during an incident.
• Temporary capacity increase.
• Manual firewall rule while waiting for a formal patch.
• Production-only setting not yet encoded.

Accidental drift:

• Console edit with no owner.
• Deleted resource.
• Public rule added during debugging.
• Forgotten test infrastructure.
• Failed cleanup.

The remediation differs. Sometimes you update code to match reality. Sometimes you revert reality to match code. Sometimes you import resources. Sometimes you leave it alone until the owner reviews it.

3. Run The Normal Plan

Only after drift is understood should the agent produce the actual change plan.

For Azure Bicep or ARM, use what-if to preview changes before deployment. For CloudFormation, drift detection can identify unmanaged configuration changes on stacks and resources.

The exact tool differs by provider. The operating principle is the same:

observe reality -> detect drift -> explain impact -> review -> apply

4. Attach Evidence To The Change

An AI-generated infrastructure PR should include:

• Drift result.
• Provider and workspace.
• Affected resources.
• Planned changes.
• Risk.
• Rollback.
• Human reviewer.
• Whether the agent had write capability.

Clanker Cloud should make this easier by collecting Terraform/OpenTofu, AWS, Azure, Kubernetes, and GitHub context into one reviewed plan.

What Clanker Cloud Should Do Here

Useful prompts:

• "Run a read-only drift investigation for this Terraform workspace."
• "Explain which resources differ from state and whether the drift looks intentional."
• "Compare Terraform drift with live AWS and Kubernetes context."
• "Create a review-before-apply plan for this patch."
• "What could this apply break, and what is the rollback?"

The important word is "review." Clanker Cloud should help the agent produce evidence, not bypass the human.

Startup Version

For a small team:

• Run refresh-only before production applies.
• Keep emergency manual changes in a visible note or issue.
• Do not let coding agents apply infra changes without review.
• Prefer small, explicit Terraform changes.
• Use Clanker Cloud to connect the IaC diff to live cloud context.

This is enough to avoid the most expensive mistakes.

Enterprise Version

For larger teams:

• Run scheduled drift detection.
• Require drift status in infrastructure PRs.
• Separate read-only detection from write-capable apply.
• Add approval policies by environment and resource type.
• Track exceptions and emergency changes.
• Attach plans and evidence to change management records.

The enterprise concern is not just correctness. It is auditability.

The Takeaway

AI agents can help write infrastructure changes. They should not assume the world still matches the code.

Drift detection is the reality check before agent-assisted apply. Clanker Cloud's role is to make that check understandable across IaC, cloud resources, Kubernetes, and review workflows.

Sources

• Terraform: Manage resource drift
• OpenTofu plan command
• AWS CloudFormation drift detection
• Azure Bicep what-if
• Clanker Cloud review-before-apply Terraform example