The Cloud Tools Question That Ninety Percent of Candidates Fumble

$ terraform plan

aws_security_group.app: Refreshing state... [id=sg-0abc123]

Terraform will perform the following actions:

  # aws_security_group.app will be updated in-place
  ~ resource "aws_security_group" "app" {
        id      = "sg-0abc123"
      ~ ingress = [
          - {
              - cidr_blocks = ["203.0.113.10/32"]
              - from_port   = 22
              - to_port     = 22
              - protocol    = "tcp"
              # (other attributes hidden)
            },
            # (1 unchanged element hidden)
        ]
    }

Plan: 0 to add, 1 to change, 0 to destroy.

"On the next plan, Terraform refreshes the security group
from AWS, sees an ingress rule that is not in the code,
and proposes an in-place update that removes it.

If someone runs apply without reading, the rule is gone.

So before anything, I want to know who added that rule
and why. It could be a mistake, or it could be someone
debugging an incident at night."

# Terraform 1.5 and later: declarative import
import {
  to = aws_s3_bucket.reports
  id = "myproj-reports-ap-south-1"
}

resource "aws_s3_bucket" "reports" {
  bucket = "myproj-reports-ap-south-1"
}

# Run:
#   terraform plan
# The plan shows the bucket will be imported.
# Adjust the resource block until the plan shows
# no other changes, then apply.

# Older CLI style, same effect:
#   terraform import aws_s3_bucket.reports myproj-reports-ap-south-1

resource "aws_autoscaling_group" "app" {
  name                = "app-asg"
  min_size            = 2
  max_size            = 6
  desired_capacity    = 2
  vpc_zone_identifier = var.private_subnet_ids

  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }

  lifecycle {
    # Scaling policies change this at runtime.
    # Without this, every apply would reset capacity to 2.
    ignore_changes = [desired_capacity]
  }
}

"On the next plan, Terraform refreshes the security group
and proposes removing the rule, since it is not in code.
A blind apply would delete it.

So first I would find out why it was added, from the
team or CloudTrail. If it was a mistake, I let Terraform
revert it. If it was a needed fix, I add the rule to the
code through a pull request, so the plan becomes clean.

To prevent repeats, I would keep console write access
limited, run a scheduled plan that alerts on drift, and
have a break-glass process where emergency changes are
codified the next working day."

name: drift-check
on:
  schedule:
    - cron: '30 3 * * *'
  workflow_dispatch:

permissions:
  id-token: write
  contents: read

jobs:
  plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.TF_READONLY_ROLE }}
          aws-region: ap-south-1
      - run: terraform init -input=false
      # -detailed-exitcode: 0 = no changes, 2 = changes, 1 = error
      - run: terraform plan -input=false -detailed-exitcode

DRIFT LAB

1. Create a security group with one rule in Terraform.
2. In the console, add a second inbound rule (your IP).
3. Run terraform plan. Read what it proposes.
4. Run terraform plan -refresh-only. Compare.
5. Option A: apply normally and watch the rule vanish.
6. Option B: add the rule to code; plan should be clean.
7. Create a bucket by hand; bring it in with an import block.
8. terraform destroy at the end.

DRIFT ANSWER CARD

DETECT    Next plan shows the difference.
          Blind apply would revert it.
ASK       Who changed it and why?
          Check with team, CloudTrail.
RECONCILE Mistake  -> let Terraform revert.
          Valid    -> update code via PR.
          Unmanaged-> import.
          Owned by automation -> ignore_changes.
PREVENT   Limit console writes, scheduled plan,
          break-glass process.

CAN I EXPLAIN THESE IN ONE SENTENCE EACH?

[ ] What terraform plan does before comparing
[ ] What -refresh-only changes and what it does not
[ ] When to use an import block
[ ] When ignore_changes is right, and when it is risky
[ ] What -detailed-exitcode returns
[ ] How CloudTrail helps find the person and time
[ ] What a break-glass process is