> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Detect IaC Drift with Terraform Files

> Upload Terraform configuration files to InfraAudit and compare your declared infrastructure against live cloud resources to surface IaC drift findings.

InfraAudit can ingest Terraform configuration files and compare what they declare against the live state of your connected cloud resources. This catches IaC drift — cases where someone changed a resource directly in the cloud console without updating the Terraform code.

## How IaC drift detection works

<Steps>
  <Step title="Upload your Terraform files">
    Upload a `.tf` file or a ZIP of multiple `.tf` files to InfraAudit.
  </Step>

  <Step title="InfraAudit parses the declarations">
    InfraAudit statically parses the file and extracts declared resource types, names, and configuration attributes.
  </Step>

  <Step title="Resources are matched to live inventory">
    Each declared resource is matched to a corresponding live resource already discovered by your connected providers.
  </Step>

  <Step title="Attributes are compared">
    InfraAudit diffs the declared configuration attributes against the live values.
  </Step>

  <Step title="Differences become drift findings">
    Any attribute that differs between the Terraform declaration and the live resource creates an IaC drift finding.
  </Step>
</Steps>

<Note>
  InfraAudit parses `.tf` files statically. It does not run `terraform plan`, connect to your Terraform state backend, or require Terraform to be installed.
</Note>

## Upload Terraform files

<Tabs>
  <Tab title="UI">
    <Steps>
      <Step title="Open the IaC section">
        In the sidebar, click **IaC**, then click **Upload IaC definition**.
      </Step>

      <Step title="Select Terraform as the type">
        Choose **Terraform** from the type selector.
      </Step>

      <Step title="Upload the file">
        Upload your `.tf` file or a ZIP containing multiple `.tf` files. Optionally add a name like `main/vpc` for easy identification.
      </Step>

      <Step title="Review results">
        Click **Upload**. InfraAudit parses the file and immediately runs a drift comparison. Results appear in the IaC list.
      </Step>
    </Steps>
  </Tab>

  <Tab title="CLI">
    ```bash theme={null}
    # Upload a single file
    infraudit iac upload --provider terraform --file main.tf

    # Upload a directory as a ZIP
    zip -r infra.zip .
    infraudit iac upload --provider terraform --file infra.zip --name "main"

    # Upload and wait for drift results before exiting
    infraudit iac upload --provider terraform --file main.tf --wait
    ```
  </Tab>

  <Tab title="API">
    ```bash theme={null}
    curl -X POST http://localhost:8080/api/v1/iac/upload \
      -H "Authorization: Bearer $TOKEN" \
      -F "file=@main.tf" \
      -F "type=terraform" \
      -F "name=main"
    ```
  </Tab>
</Tabs>

## View IaC drift results

After uploading, click the definition in the **IaC** list. Each uploaded definition shows:

* Upload timestamp and parse status (success, or parse error with line details)
* Number of resources declared in the file
* Number of resources successfully matched to live inventory
* Number of IaC drift findings

Click a definition to see the drift detail — a table of declared versus live values for each drifted attribute.

## Supported resource types

InfraAudit matches Terraform resources to live inventory by type and identifier:

| Terraform resource type   | Matched on              |
| ------------------------- | ----------------------- |
| `aws_instance`            | Instance ID or name tag |
| `aws_s3_bucket`           | Bucket name             |
| `aws_db_instance`         | DB identifier           |
| `aws_lambda_function`     | Function name           |
| `aws_security_group`      | Security group ID       |
| `google_compute_instance` | Instance name           |
| `azurerm_virtual_machine` | VM name                 |

Resources that cannot be matched to a live resource are shown as **unmatched** and do not produce drift findings.

## CI/CD integration

Run IaC drift detection automatically in your Terraform deployment pipeline to catch drift before it causes problems:

```yaml theme={null}
# GitHub Actions example
- name: Check IaC drift
  run: |
    infraudit iac upload --provider terraform --file main.tf --wait
    DRIFT_COUNT=$(infraudit iac drift list -o json | jq length)
    if [ "$DRIFT_COUNT" -gt 0 ]; then
      echo "IaC drift detected: $DRIFT_COUNT findings"
      infraudit iac drift list
      exit 1
    fi
  env:
    INFRAUDIT_SERVER_URL: ${{ secrets.INFRAUDIT_URL }}
    INFRAUDIT_TOKEN: ${{ secrets.INFRAUDIT_TOKEN }}
```

## Notes

* Variables and dynamic references in `.tf` files are resolved where possible (literal values only). Expressions that depend on `terraform.tfvars` or runtime data are left unresolved and excluded from comparison.
* Sensitive attributes such as passwords and secrets are redacted in drift reports.
* For continuous monitoring, upload updated `.tf` files as part of your CI/CD pipeline after each deployment.