My Terraform Drift Pipeline Fixed the Change, Then Forgot It
My Terraform drift pipeline could detect a manual EC2 tag change, classify it as LOW, and run Terraform to remove it. Then the pipeline moved on. The evidence existed, but it was spread across CodeBuild output, Lambda logs, and an SNS message. If I wanted to know what changed, how it was classified, and whether remediation started, I had to reconstruct the event from multiple AWS services. The…
The Terraform drift pipeline was able to detect manual EC2 tag changes, classify them as LOW severity, and initiate remediation for eligible LOW drift. However, the pipeline did not retain the drift information. Phase 4 addressed this issue by implementing a durable DynamoDB record, a read-only API, and a simple dashboard to track event history without opening multiple AWS consoles.
The pipeline stored every classified event in a DynamoDB table with a composite key, consisting of the project and timestamp. This allowed for easy retrieval of the drift event history by project and timestamp. A second Lambda function with restricted DynamoDB permissions was created to serve as a read-only history API. This API allowed users to query the drift event history for a specific Terraform project without requiring access to DynamoDB credentials.
The dashboard received static HTML, CSS, and JavaScript from CloudFront, and JavaScript called the API Gateway, while the API Lambda queried DynamoDB to retrieve the event history. The dashboard displayed the live dashboard, providing users with an easy way to inspect the drift event history without needing to navigate through multiple AWS services.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
