My Terraform Drift Pipeline Fixed the Change, Then Forgot It

My Terraform drift pipeline could detect a manual EC2 tag change, classify it as LOW, and run Terraform to remove it.

Then the pipeline moved on.

The evidence existed, but it was spread across CodeBuild output, Lambda logs, and an SNS message. If I wanted to know what changed, how it was classified, and whether remediation started, I had to reconstruct the event from multiple AWS services.

The pipeline could act on drift. It could not remember drift.

Phase 4 added that memory: a durable DynamoDB record, a read only API, and a small dashboard that turns the event history into something I can inspect without opening three AWS consoles.

My Terraform Drift Pipeline Fixed the Change, Then Forgot It

Related reading

I Added a Tag in AWS. Terraform Removed It Automatically.

Infrastructure Drift: Detecting and Preventing It

The Security Group Change Terraform Never Told Me About

My Terraform Drift Alert Could Not Explain the Drift

Detecting and Managing Terraform Drift

Setting Up Continuous Terraform Drift Monitoring With GitHub Actions and Slack