The Security Group Change Terraform Never Told Me About

Terraform had a blind spot in my three-tier project.

The code could create the infrastructure. The state lived in S3. But if someone changed a security group in the AWS console, Terraform would not tell me when it happened.

I would discover it the next time I ran terraform plan.

That could be tomorrow or six months later.

So I built a drift detector that runs the same plan inside CodeBuild and sends an SNS email when Terraform finds a difference.

The Security Group Change Terraform Never Told Me About

Related reading

I built a Terraform security scanner that lives inside GitHub PRs

My Terraform Drift Alert Could Not Explain the Drift

Detecting and Managing Terraform Drift

Your Infrastructure Has Bugs Too: Scanning Terraform with Checkov (IaC SAST)

I Built My First AWS Network with Terraform. Here's Everything That Went Wrong.

4 AWS Infrastructure Gotchas That Will Get Your Account Hacked (And How to Fix…