Terraform Drift Reporter

What this skill does

Runs a refresh-only Terraform plan, parses the JSON output, and produces a markdown table of every drifted resource with file:line citations into the HCL plus a suggested resolution per row.

Inputs

• tf_dir: directory containing the root Terraform module.
• Cloud credentials in env (AWS_PROFILE, GOOGLE_APPLICATION_CREDENTIALS, etc.) — the skill assumes whichever provider is configured.
• Optional state_file: path to a local state file; otherwise remote state is used.

Steps

1. terraform -chdir=<tf_dir> init -backend=true -input=false.
2. terraform -chdir=<tf_dir> plan -refresh-only -out=drift.tfplan.
3. Convert plan to JSON: terraform -chdir=<tf_dir> show -json drift.tfplan > drift.json.
4. Parse resource_drift array from the JSON. Each entry has address, change.actions, change.before, change.after.
5. For each drifted resource, locate the HCL declaration: rg -n "resource \"<type>\" \"<name>\"" <tf_dir> to get file:line.
6. Compute a per-attribute diff: walk before vs after, collect the keys whose values differ.
7. Classify the resolution: if after (real cloud) is correct, suggest terraform apply to bring state in line; if before (state) is correct, suggest reverting the cloud change manually; ambiguous -> "review".
8. Emit a markdown table with columns: Resource, file:line, Drifted Attributes, Suggested Action.
9. Append a summary footer: count by action class, total drift count.
10. Exit 0 if no drift, 2 if drift detected.

Output

drift-report.md containing the table plus a fenced JSON block of the raw drift entries for machine consumption. Exit code distinguishes pass vs drift.

Verification

Re-run terraform plan -refresh-only after terraform apply -refresh-only and confirm zero drift entries — a no-op apply confirms the report was accurate. Sample-check three rows by issuing the equivalent cloud API call directly (e.g., aws ec2 describe-instances) and confirm the attribute values match change.after. If they don't, the provider plugin may have stale schema; pin a newer provider version and rerun.

Edge cases

• Resources with lifecycle.ignore_changes: exclude them from the table since drift is intentional.
• Empty plan (no resources): exit 0 with "no resources tracked".
• Provider returning errors mid-plan: surface as "unverifiable" rows instead of dropping; teams should investigate auth before trusting the report.
• Sensitive attributes redacted by Terraform: report the attribute name only, not values.