{
  "id": 243928,
  "title": "My Terraform Drift Pipeline Fixed the Change, Then Forgot It",
  "url": "https://urgent.news/2026/08/07/my-terraform-drift-pipeline-fixed-the-change-then-forgot-it",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-07T00:51:46.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/lbagga/my-terraform-drift-pipeline-fixed-the-change-then-forgot-it-gpg"
  },
  "original_language": "en",
  "account": "The Terraform drift pipeline was able to detect manual EC2 tag changes, classify them as LOW severity, and initiate remediation for eligible LOW drift. However, the pipeline did not retain the drift information. Phase 4 addressed this issue by implementing a durable DynamoDB record, a read-only API, and a simple dashboard to track event history without opening multiple AWS consoles. The pipeline stored every classified event in a DynamoDB table with a composite key, consisting of the project and timestamp. This allowed for easy retrieval of the drift event history by project and timestamp. A second Lambda function with restricted DynamoDB permissions was created to serve as a read-only history API. This API allowed users to query the drift event history for a specific Terraform project without requiring access to DynamoDB credentials. The dashboard received static HTML, CSS, and JavaScript from CloudFront, and JavaScript called the API Gateway, while the API Lambda queried DynamoDB to retrieve the event history. The dashboard displayed the live dashboard, providing users with an easy way to inspect the drift event history without needing to navigate through multiple AWS services.",
  "summary": "My Terraform drift pipeline could detect a manual EC2 tag change, classify it as LOW, and run Terraform to remove it. Then the pipeline moved on. The evidence existed, but it was spread across CodeBuild output, Lambda logs, and an SNS message. If I wanted to know what changed, how it was classified, and whether remediation started, I had to reconstruct the event from multiple AWS services. The…",
  "key_points": [
    "Terraform drift pipeline detects manual EC2 tag changes and classifies them as LOW severity.",
    "Implements durable DynamoDB record, read-only API, and simple dashboard to track drift events.",
    "Dashboard provides live event history without accessing multiple AWS consoles."
  ],
  "editors_take": "Implementing a durable DynamoDB record and read-only API lets users track Terraform drift event history easily, without needing access to multiple AWS services or DynamoDB credentials.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}