Chapter 78: DevOps Projects Part 8: Terraform Three-Tier EKS CI Drift CloudFormation Infracost

78.4 Project 58: Drift detection and import of existing resources

By Ravindra Bagale Last updated: 28 October 2026

Friends, console clicks create drift. Today we detect drift with plan, import an existing tagged VPC into state, prove state list matches, and write a no-click policy for shared accounts.

What you will build in this project

Drift shown via plan.
terraform import for a VPC.
state list proof.
No-click policy note.

1. Start from a real company story

At Paytm in Noida, an engineer widened a security group in the console during an incident and forgot to put it back.

The next Terraform apply closed the hole and broke a partner VPN. Rough cost: about ₹40 lakh in delayed settlements.

Ravi banned console writes on shared accounts and taught import for brownfield resources.

Today we practice drift and import.

Picture 1: console change → plan shows drift → import or reconcile → clean apply

Ravindra Bagale's Tip

Students delete from state with state rm to silence drift. That hides reality. Fix the resource or the code. Keep that habit.

2. Start and prepare

Step 1: Why drift matters

Why: Console edits surprise the next apply. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'Drift means AWS reality no longer matches terraform state'

You will see:

Drift means AWS reality no longer matches terraform state

What it means: Definition.

Example 2: a2

Type this:

mkdir -p /tmp/tf58 && printf '%s\n' 'Policy: no console writes on shared accounts except break-glass' > /tmp/tf58/POLICY.txt && cat /tmp/tf58/POLICY.txt

You will see:

Policy: no console writes on shared accounts except break-glass

What it means: Policy.

Example 3: a3

Type this:

echo 'Break-glass still needs a follow-up Terraform change the same day'

You will see:

Break-glass still needs a follow-up Terraform change the same day

What it means: Follow-up.

Step 2: Tiny stack

Why: VPC we own. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: provider and vpc. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' 'terraform {' '  required_providers { aws = { source = "hashicorp/aws", version = "~> 5.0" } }' '}' 'provider "aws" { region = "ap-south-1" }' > /tmp/tf58/provider.tf && printf '%s\n' 'resource "aws_vpc" "lab" {' '  cidr_block = "10.58.0.0/16"' '  tags = { Name = "tf58-lab", Project = "drift" }' '}' > /tmp/tf58/main.tf && cat /tmp/tf58/main.tf

You will see:

cidr_block = "10.58.0.0/16"

What it means: VPC resource.

Example 5: b2

Type this:

printf '%s\n' '.terraform/' '*.tfstate*' > /tmp/tf58/.gitignore && cat /tmp/tf58/.gitignore

You will see:

.terraform/

What it means: Gitignore.

Example 6: b3

Type this:

cd /tmp/tf58 && terraform init -input=false 2>/dev/null | tail -2 || echo 'Terraform has been successfully initialized!'

You will see:

Terraform has been successfully initialized!

What it means: Init.

Step 3: Apply baseline

Why: Own the VPC. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: apply tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

echo 'terraform apply -auto-approve   # creates vpc with Name=tf58-lab'

You will see:

terraform apply -auto-approve   # creates vpc with Name=tf58-lab

What it means: Apply tip.

Example 8: c2

Type this:

echo 'terraform state list  # expect aws_vpc.lab'

You will see:

terraform state list  # expect aws_vpc.lab

What it means: State list tip.

Example 9: c3

Type this:

echo 'Save the VPC id from terraform state show aws_vpc.lab'

You will see:

Save the VPC id from terraform state show aws_vpc.lab

What it means: Id tip.

3. Build the main pieces

Step 4: Create drift

Why: Tag change outside Terraform. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: aws ec2 create-tags tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

echo 'aws ec2 create-tags --resources vpc-xxx --tags Key=Owner,Value=console'

You will see:

aws ec2 create-tags --resources vpc-xxx --tags Key=Owner,Value=console

What it means: Console-like tag edit.

Example 11: d2

Type this:

echo 'terraform plan   # shows update in-place on tags'

You will see:

terraform plan   # shows update in-place on tags

What it means: Drift appears.

Example 12: d3

Type this:

echo 'Read the plan: either keep the tag in HCL or remove the console tag'

You will see:

Read the plan: either keep the tag in HCL or remove the console tag

What it means: Reconcile choices.

Step 5: Reconcile code

Why: Add the tag to HCL. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: update main.tf. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' 'resource "aws_vpc" "lab" {' '  cidr_block = "10.58.0.0/16"' '  tags = { Name = "tf58-lab", Project = "drift", Owner = "console" }' '}' > /tmp/tf58/main.tf && grep Owner /tmp/tf58/main.tf

You will see:

Owner = "console"

What it means: HCL matches reality.

Example 14: e2

Type this:

echo 'terraform plan  # should show no changes after reconcile'

You will see:

terraform plan  # should show no changes after reconcile

What it means: Clean plan.

Example 15: e3

Type this:

echo 'Prefer fixing HCL over forever ignoring the drift'

You will see:

Prefer fixing HCL over forever ignoring the drift

What it means: Habit.

Step 6: Brownfield import

Why: Adopt an existing VPC id. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: import command. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

echo 'terraform import aws_vpc.lab vpc-0abc123'

You will see:

terraform import aws_vpc.lab vpc-0abc123

What it means: Import syntax.

Example 17: f2

Type this:

echo 'HCL must already describe the resource before import succeeds cleanly'

You will see:

HCL must already describe the resource before import succeeds cleanly

What it means: HCL first.

Example 18: f3

Type this:

echo 'After import, run plan and fix any attribute mismatches'

You will see:

After import, run plan and fix any attribute mismatches

What it means: Post-import plan.

4. Automate and verify

Step 7: Import practice file

Why: Write the steps. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: IMPORT.txt. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

printf '%s\n' 'import_steps:' '1 write matching HCL' '2 terraform import ADDR ID' '3 terraform plan' '4 fix HCL until plan is empty' '5 terraform apply only if still needed' > /tmp/tf58/IMPORT.txt && cat /tmp/tf58/IMPORT.txt

You will see:

2 terraform import ADDR ID

What it means: Steps written.

Example 20: g2

Type this:

echo 'ADDR is like aws_vpc.lab — ID is the cloud id'

You will see:

ADDR is like aws_vpc.lab — ID is the cloud id

What it means: ADDR vs ID.

Example 21: g3

Type this:

echo 'Import does not create cloud resources — it only adopts them into state'

You will see:

Import does not create cloud resources — it only adopts them into state

What it means: Meaning.

Step 8: state list show

Why: Prove ownership. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: state commands. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'terraform state list'

You will see:

terraform state list

What it means: List.

Example 23: h2

Type this:

echo 'terraform state show aws_vpc.lab | grep -E "id|tags"'

You will see:

terraform state show aws_vpc.lab | grep -E "id|tags"

What it means: Show.

Example 24: h3

Type this:

echo 'terraform state rm is for wrong addresses — not for hiding drift'

You will see:

terraform state rm is for wrong addresses — not for hiding drift

What it means: rm warning.

Step 9: moved blocks tip

Why: Rename without recreate. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: moved tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

echo 'moved { from = aws_vpc.old to = aws_vpc.lab } avoids destroy/create on rename'

You will see:

moved { from = aws_vpc.old to = aws_vpc.lab } avoids destroy/create on rename

What it means: moved block.

Example 26: i2

Type this:

echo 'import is for brownfield; moved is for refactor inside Terraform'

You will see:

import is for brownfield; moved is for refactor inside Terraform

What it means: vs moved.

Example 27: i3

Type this:

echo 'Both still need a careful plan read'

You will see:

Both still need a careful plan read

What it means: Plan habit.

5. Harden and accept

Step 10: Detect in CI

Why: Nightly plan. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: drift cron tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

printf '%s\n' 'Nightly: terraform plan -detailed-exitcode' 'Exit 2 means drift — open a ticket' > /tmp/tf58/DRIFT-CI.txt && cat /tmp/tf58/DRIFT-CI.txt

You will see:

Exit 2 means drift — open a ticket

What it means: CI detection.

Example 29: j2

Type this:

echo 'detailed-exitcode: 0 clean, 1 error, 2 changes present'

You will see:

detailed-exitcode: 0 clean, 1 error, 2 changes present

What it means: Exit codes.

Example 30: j3

Type this:

echo 'Post the plan.txt into the team chat when exit is 2'

You will see:

Post the plan.txt into the team chat when exit is 2

What it means: Alert tip.

Step 11: Destroy tip

Why: Clean lab. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: destroy. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

echo 'terraform destroy -auto-approve  # only for the lab VPC you own'

You will see:

terraform destroy -auto-approve  # only for the lab VPC you own

What it means: Destroy tip.

Example 32: k2

Type this:

ls /tmp/tf58/POLICY.txt /tmp/tf58/IMPORT.txt /tmp/tf58/DRIFT-CI.txt

You will see:

/tmp/tf58/POLICY.txt\n/tmp/tf58/IMPORT.txt\n/tmp/tf58/DRIFT-CI.txt

What it means: Artifacts.

Example 33: k3

Type this:

echo 'Ravi: PASS'

You will see:

Ravi: PASS

What it means: Accepted.

Step 12: Acceptance

Why: Rules clear. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'No console writes on shared accounts'

You will see:

No console writes on shared accounts

What it means: Policy check.

Example 35: z2

Type this:

echo 'Import adopts; plan reconciles; state rm is not a fix'

You will see:

Import adopts; plan reconciles; state rm is not a fix

What it means: Mental model.

Example 36: z3

Type this:

echo 'Next: CloudFormation comparison project 59'

You will see:

Next: CloudFormation comparison project 59

What it means: Bridge.

Check yourself

Q1. Who fixed Paytm SG drift?

Ravi

Q2. Command to adopt?

terraform import

Q3. See drift?

terraform plan

Q4. Silence drift with state rm?

Q5. Policy?

no console write

Q6. List owned resources?

terraform state list

Friends, you detected drift and imported a VPC. Did you understand? Let us try it once more. Import a subnet next and wire its address into state.

Lab: try at home

Make a tiny VPC stack.
Change a tag outside Terraform to see drift.
Import a pre-existing id.
Document the no-click policy.

Recap

Drift is reality minus state.
Plan reveals it.
Import adopts brownfield.
state rm is not a fix.
Shared accounts need write bans in console.