# Terraform / AWS Drift Detection Runbook (July 2026)

## Detect

1. Scheduled `terraform plan -refresh-only` (or full plan) per workspace in CI
2. AWS Config rules for compliance drift (encryption, public access, tags)
3. Optional: HCP Terraform / Atlantis / Spacelift drift runs — pipe to Slack/PagerDuty

## Triage

| Finding | Action |
|---------|--------|
| Console tweak that should stick | Codify + apply |
| Emergency change | Codify within SLA or revert |
| Out-of-band resource | `import` / `import` block (TF 1.5+) or destroy |
| Intentional delete | `state rm` then remove code |

## Prevent

- Prod writes via PR only (SCP / permission boundaries)
- Tag `managed-by=terraform`; Config flags untagged
- No `-auto-approve` on prod

## Counter-case

Plan-only without Config misses resources never in state.