Docs · Core concepts

Drift detection

Your Terraform plan vs. your Terraform state file.

How it works

DriftGuard compares the resources in your terraform plan output against your Terraform state file. Any resource that exists in the plan but not in the state file (or vice-versa) is flagged as drift.

AWS integration

Grant DriftGuard read-only access to your AWS account via STS AssumeRole. DriftGuard fetches the S3 state backend and compares it to the PR plan. No credentials are stored — only short-lived session tokens from STS.

# In your repo settings (DriftGuard dashboard)
aws_role_arn: arn:aws:iam::123456789:role/DriftGuardReadOnly
state_bucket: my-tf-state-bucket
state_key: prod/terraform.tfstate
aws_region: eu-west-1

Without AWS access

Without AWS integration, DriftGuard falls back to comparing the plan against any terraform.tfstate file committed in the repository. This is less accurate but requires no IAM setup.

Docs · Core concepts

Drift detection

Your Terraform plan vs. your Terraform state file.

How it works

AWS integration

# In your repo settings (DriftGuard dashboard)
aws_role_arn: arn:aws:iam::123456789:role/DriftGuardReadOnly
state_bucket: my-tf-state-bucket
state_key: prod/terraform.tfstate
aws_region: eu-west-1

Without AWS access

Without AWS integration, DriftGuard falls back to comparing the plan against any terraform.tfstate file committed in the repository. This is less accurate but requires no IAM setup.