Scan resources from the input Terraform statefile and compare it to your current profile infrastructure.
Currently, driftctl only supports reading IaC from a Terraform state. We are investigating to support the Terraform code as well, as a state does not represent an intention.
Multiple states can be read by passing
- Terraform state
You can use any unsupported backend by using
terraform to pipe your state in a file and then use this file with driftctl:
driftctl needs read-only access so you could use the policy below to ensure minimal access to your state file.
driftctl supports multiple kinds of output formats and by default uses the standard output (console).
From Terraform documentation, a
computed field is often used to represent values that are not user configurable or can not be known at time of
terraform plan or
Since those values are not known ahead of time from terraform point of view, it is obviously possible that the values displayed in a terraform state file are not up-to-date and may require a
Thus, it could be possible that driftctl finds drifts that are considered false positives because of those outdated values.
We decided to output computed fields and to display a message at the end of the scan to remind you of this behavior.
driftctl supports multiple providers. By default it will scan against AWS, but you can change this using
driftctl supports these providers:
This flag prevents stdout to be use for anything but the scan result.