<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-cloud-resource-drift
description: >-
  Detect unmanaged and unauthorized changes to cloud infrastructure by comparing
  live state against Terraform state, CloudFormation stacks, and declared
  configurations using terraform plan, AWS Config, and drift detection tools.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - drift-detection
  - terraform
  - cloudformation
  - aws-config
  - compliance
  - change-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1578"]
---

# Detecting Cloud Resource Drift

## Overview

Resource drift occurs when live cloud infrastructure diverges from declared
state — manual console changes, direct API calls, or untracked automation.
Drift creates security blind spots and compliance violations. This skill
detects drift using Terraform plan, CloudFormation drift detection, and
AWS Config recording.

Mode: `[MODE: BLUE]` — Drift detection and compliance. `[MODE: ARCHITECT]` — Drift prevention design.

## Prerequisites

| Requirement | Details |
|---|---|
| Terraform >= 1.5 with remote state backend | Required |
| AWS CLI with Config and CloudFormation access | Required |
| State file access (S3, GCS, Azure Blob) | Required |

## Key Concepts

### Terraform Drift Detection

```bash
# Detect drift with detailed exit code
# Exit 0 = no changes, Exit 1 = error, Exit 2 = drift detected
terraform plan -detailed-exitcode -out=drift.tfplan

# Show planned changes
terraform show -json drift.tfplan | jq '.resource_changes[] | select(.change.actions != ["no-op"])'

# Refresh state and detect drift
terraform plan -refresh-only -detailed-exitcode

# List resources in state
terraform state list

# Show specific resource state vs live
terraform state show aws_s3_bucket.my_bucket
```

### CloudFormation Drift Detection

```bash
# Initiate drift detection
aws cloudformation detect-stack-drift --stack-name STACK_NAME

# Check detection status
aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id DETECTION_ID

# Get drifted resources
aws cloudformation describe-stack-resource-drifts \
  --stack-name STACK_NAME \
  --stack-resource-drift-status-filters MODIFIED DELETED

# List all stacks with drift
aws cloudformation list-stacks --output json | \
  jq '.StackSummaries[] | select(.DriftInformation.StackDriftStatus == "DRIFTED")'
```

### AWS Config for Continuous Monitoring

```bash
# Check compliance
aws configservice describe-compliance-by-config-rule --output json

# Get non-compliant resources
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name RULE_NAME --compliance-types NON_COMPLIANT

# Get resource configuration timeline
aws configservice get-resource-config-history \
  --resource-type AWS::EC2::SecurityGroup --resource-id SG_ID
```

## Workflow

```bash
# Run drift detection
node scripts/agent.js --action detect --path ./terraform --output /tmp/drift.json

# Review drifted resources
cat /tmp/drift.json | jq '.findings[] | select(.severity != "info")'
```

## Detection

```yaml
title: Cloud Resource Drift Detection
id: ffb8f3c5-a494-47d7-8fa5-70671be68aeb
status: experimental
description: Detects suspicious activity related to detecting cloud resource drift techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1578
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cloud Resource Drift Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1578 |

## Verification

- [ ] Terraform plan runs on schedule (no drift detected)
- [ ] CloudFormation stacks show IN_SYNC status
- [ ] AWS Config rules active for critical resource types
- [ ] Alerts fire on drift detection
- [ ] Manual changes require change management approval
- [ ] State files stored in encrypted, versioned backend

## References

- [Terraform Drift Detection](https://developer.hashicorp.com/terraform/tutorials/state/resource-drift)
- [CloudFormation Drift Detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html)
- [AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/)
