https://www.sre.wang/en/tags/driftctl/Recent content in Driftctl on SRE Engineering Practicehttps://www.sre.wang/share-card-square.jpghttps://www.sre.wang/share-card-square.jpgHugo -- gohugo.ioenFri, 23 Oct 2026 00:37:42 +0800https://www.sre.wang/en/posts/terraform-drift-detection-remediation/Fri, 23 Oct 2026 00:37:42 +0800https://www.sre.wang/en/posts/terraform-drift-detection-remediation/Your Terraform state says everything is fine, but production has an untracked security group — configuration drift is the biggest blind spot in IaC. This article covers the three drift types (Emergent/Pseudo/Introduced), terraform plan -detailed-exitcode detection, driftctl/Snyk IaC comparison, embedding drift detection in CI/CD pipelines, three remediation strategies (reconcile/import/rebuild), 6 production pitfalls, and a drift governance framework with HCP Terraform vs self-hosted selection guidance.