Context
Drift means the remote object differs from Terraform's recorded or desired view because something changed outside the ordinary workflow. The difference may be a legitimate emergency change, another controller's responsibility, or an unauthorized edit. Adding ignore_changes immediately can hide evidence without deciding who should own the setting.
Before starting, identify the workspace, resource address, suspected external change, and owner of the remote setting. You need approved read access through the provider. Preserve the ordinary plan and relevant change records before editing lifecycle rules or accepting a new state snapshot.
1. Compare ordinary and refresh-only planning
terraform workspace show
terraform plan
terraform plan -refresh-only
An ordinary plan compares configuration with refreshed remote information and proposes the actions needed to reach the desired state. A refresh-only plan shows how state and outputs would change to reflect remote observations without proposing ordinary configuration reconciliation. Running the plan is different from applying it; a refresh-only apply changes state.
Do not disable refresh merely to make a difference disappear. That can leave the plan based on stale assumptions. Instead, identify whether the remote value is intended and whether the configuration should describe it.
2. Assign ownership to the changed attribute
For an explicitly illustrative example, an external controller writes one operational tag while Terraform owns the object's other tags. The team may choose a narrow ignore rule for that externally managed tag. That differs from ignoring every attribute because an unexplained plan is inconvenient.
A conceptual lifecycle fragment for a resource with a supported map-valued tags argument is:
lifecycle {
ignore_changes = [tags["external_owner"]]
}
This is a schema-dependent illustration, not a complete resource definition. Validate the actual resource path against its provider. ignore_changes affects update reconciliation for the named attribute; it is not a general ownership transfer or proof that the remote value is safe.
3. Choose reconciliation deliberately
If Terraform should own the setting, update or restore it through an approved plan. If the external change should become the new desired state, review a configuration change and inspect a fresh plan. If ownership is shared, document the precise ignored path, external controller, acceptable values, and separate detection mechanism.
Do not broaden the ignore list to suppress unrelated replacement or deletion. The plan's reason matters. A lifecycle rule can conceal an important security or availability difference if its scope is wider than the ownership contract.
Diagnose the drift decision
| Evidence | Ownership question | Review action |
|---|---|---|
| Emergency edit differs from configuration | Keep or revert the emergency state? | Compare approved incident decision |
| External controller repeatedly changes one field | Is that field delegated? | Narrow ownership and ignore scope |
| Many unrelated attributes drift | Wrong target or broad external change? | Provider identity and audit history |
| Plan is clean only with broad ignore rules | Is visibility being lost? | Remove unjustified suppression |
Also check whether provider upgrades or computed/default behavior changed the displayed representation. A difference can reflect interpretation rather than a human editing the remote object. Use provider diagnostics and release documentation when the remote change history does not explain the plan.
Verify and maintain a drift SOP
After the reviewed correction, run both the relevant observation plan and an ordinary plan. Confirm intended ownership, expected outputs, and no unrelated actions. Apply only through the established change workflow, then verify the remote setting with a harmless read.
Maintain an exception register containing attribute path, owning controller, reason, approval, and review date. Monitor drift outside those delegated fields, and periodically verify that ignored attributes still satisfy the application's requirements. An ignored value still matters operationally even when Terraform no longer proposes to change it.
Explore Clouvenix terraform automation for implementation and operational handover.