菜单
Use when detecting infrastructure drift between Terraform state and actual AWS resources. Identifies out-of-band changes.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | terraform-drift-detection |
| description | Use when detecting infrastructure drift between Terraform state and actual AWS resources. Identifies out-of-band changes. |
Detect and categorize drift between Terraform-managed state and actual infrastructure. Drift indicates out-of-band changes that can cause problems during the next apply.
Announce at start: "I'm using the terraform-drift-detection skill to check for infrastructure drift."
# Verify AWS credentials and account
aws sts get-caller-identity
# Confirm we're in the right directory/environment
pwd
ls -la *.tf 2>/dev/null | head -5
# Initialize if needed
terraform init
# Refresh state to detect drift
terraform plan -refresh-only -out=drift.out
# Convert to JSON for analysis
terraform show -json drift.out > drift.json
Parse drift.json and categorize changes:
| Category | Severity | Examples |
|---|---|---|
| Security Drift | CRITICAL | Security groups, IAM, encryption |
| Configuration Drift | HIGH | Instance settings, networking |
| Tag Drift | LOW | Tags modified outside Terraform |
| Metadata Drift | INFO | AWS-managed fields that change |
Task(drift-detector) → Categorize and assess drift impact
Agent should:
## Drift Detection Report
### Summary
- Total drifted resources: X
- Critical drift: Y
- High drift: Z
- Low/Info drift: W
### Critical Drift (Requires Immediate Attention)
| Resource | Attribute | State Value | Actual Value |
|----------|-----------|-------------|--------------|
| ... | ... | ... | ... |
### Potential Causes
- Manual console changes: [list if detected]
- AWS service updates: [list if detected]
- Unknown origin: [list if detected]
### Recommended Actions
1. [Action for each drifted resource]
Present user with options:
terraform apply -refresh-only to update state to match actualterraform apply to revert actual infrastructure to match codeNever auto-resolve drift. Always get user approval.
Store detected drift patterns:
Query memory before analysis:
Before presenting:
Use when executing implementation plans with independent tasks in the current session
Use when starting feature work that needs isolation from current workspace or before executing implementation plans - creates isolated git worktrees with smart directory selection and safety verification
Use when generating documentation for Terraform modules, infrastructure, or runbooks. Creates READMEs, operational guides, and architecture docs.
Use before any Terraform or AWS operation to verify correct credentials and profile are active. Prevents cross-environment accidents.
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies