How do you manage infrastructure drift in Terraform?
Interviewer Expectations for this Question
01
Core Competency
Assesses fundamental understanding of Terraform & IaC conventions, runtime behavior, and memory/performance considerations.
02
Evaluation Criteria
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
Comprehensive Model Answer
Verified Solution
Drift is a difference between real infrastructure and Terraform state, usually caused by manual changes.
Detect:
- terraform plan refreshes state and shows differences.
- terraform plan -refresh-only shows drift without proposing configuration changes.
- Scheduled CI plans on a branch detect drift automatically.
Respond:
- Decide whether the manual change is desired.
- If it should be reverted, run terraform apply to bring reality back to configuration.
- If the change is wanted, update code, then apply. Use terraform state mv or import to reconcile.
- Use terraform refresh or apply -refresh-only to update state from reality.
terraform plan -refresh-only
terraform import aws_s3_bucket.logs my-bucket
Prevent drift with policy: require all changes through CI, use read-only roles for humans, and enable AWS Config or Azure Policy alerts. Do not use terraform state rm to hide drift.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.