Detect infrastructure drift between Terraform state and actual cloud resources. Identifies
unmanaged resources, manual changes, and configuration drift. Use when:
- User asks to check for infrastructure drift
- User wants to find unmanaged cloud resources
- User mentions "drift detection" or "Terraform drift"
- User asks to compare cloud state to IaC
- User wants to audit infrastructure changes
Detect infrastructure drift between Terraform state and actual cloud resources. Identifies
unmanaged resources, manual changes, and configuration drift. Use when:
- User asks to check for infrastructure drift
- User wants to find unmanaged cloud resources
- User mentions "drift detection" or "Terraform drift"
- User asks to compare cloud state to IaC
- User wants to audit infrastructure changes
allowed-tools
Bash Read Write Grep
license
Apache-2.0
compatibility
Requires Snyk CLI installed and authenticated. Uses `snyk iac describe` CLI command
(shell execution). Cloud provider credentials must be configured (AWS, Azure, or GCP).
Terraform state file (local or remote) required.
metadata
{"author":"Snyk","version":"1.0.0"}
Infrastructure Drift Detector
Detect, track, and resolve infrastructure drift between Terraform state and actual cloud resources to maintain Infrastructure as Code integrity.
Core Principle: Your cloud should match your code.
Note: This skill uses CLI command (requires shell execution).
snyk iac describe
Quick Start
# Basic drift scan against a local Terraform state file
snyk iac describe --from=tfstate://terraform.tfstate
# Output as JSON for further analysis
snyk iac describe --from=tfstate://terraform.tfstate --json > drift-report.json
Prerequisites
Terraform project with state file (local or remote)
Cloud provider credentials configured
snyk CLI installed
Network access to cloud APIs
Supported Cloud Providers
Provider
Setup
AWS
AWS credentials (profile, env vars, or IAM role)
Azure
Azure CLI login or service principal
GCP
Application default credentials or service account
For a full list of supported resource types per provider, see SERVICES.md.
Prioritize Critical issues first (e.g. SSH opened to 0.0.0.0/0, production HA disabled), then High risk issues (e.g. unmanaged IAM users or security groups). Document the affected resource, the risk, and the intended remediation action for each finding.
Phase 4: Remediation
Goal: Resolve drift and restore IaC integrity.
Step 4.1: Import Unmanaged Resources
For resources that should be in Terraform:
# Generate import block
terraform import aws_s3_bucket.manual_bucket prod-logs-manual
# Or use import block (Terraform 1.5+)
import {
to = aws_s3_bucket.manual_bucket
id = "prod-logs-manual"
}
For detailed worked examples, see EXAMPLES.md. Brief references:
Post-Incident Audit: Run drift detection with JSON output, filter for security-related resources, identify unauthorized changes, generate incident report, remediate and document.
Pre-Deployment Check: Run drift detection, fail deployment if drift exists, resolve drift first, then proceed with deployment.
Shadow IT Discovery: Run drift detection, filter to unmanaged resources, categorize by owner/purpose, import or remove as appropriate.
Error Handling
State Access Error
Error: Could not read Terraform state
Solutions:
1. Verify state file path
2. Check S3/backend permissions
3. Ensure terraform init has been run
Cloud Credential Error
Error: Authentication failed
Solutions:
1. Verify cloud credentials
2. Check IAM permissions for describe/list
3. Ensure credentials not expired
Service Not Supported
Warning: Service X not supported
Solutions:
1. Check supported services list
2. Use Terraform plan comparison instead
3. Report to Snyk for feature request
Constraints
Read-only: This skill only detects drift, doesn't modify resources
Credentials required: Needs cloud provider access
Service coverage: Not all resource types supported
State required: Must have Terraform state to compare
