Tired of vague Terraform drift alerts? A new method turns simple notifications into detailed, actionable insights, telling you exactly which resources changed and their severity without overwhelming you.
Ever gotten a Terraform drift alert that just told you something changed, but not 'what'? It's like getting a notification that your car has a problem without knowing if it's a flat tire or just a loose gas cap. Our trusted tech friend encountered this exact issue with their Terraform setup: their automated alerts could detect drift and send an email, but the message was vague, offering no details about 'which' resources were altered or 'how critical' the change was.
This is a common headache for anyone managing infrastructure as code. You need to know if an IAM role's permissions suddenly changed, a network configuration shifted, or if it's something less impactful. A simple 'drift exists' isn't enough to act quickly or prioritize.
So, here’s a clever fix that helps you understand what's really going on. Instead of just sending a basic email, the solution involves creating a structured event with precise details. First, the process runs `terraform plan` to identify changes and saves the plan. If changes are found, `terraform show -json` converts this plan into a machine-readable JSON format. Since the full JSON can be quite large, a tool called `jq` is used to filter out only the essential bits: the resource `address`, its `type` (like `aws_iam_role`), and the `actions` taken (like `create`, `update`, or `delete`).
This condensed, valuable information is then published as a single structured event to an SNS topic. From there, it intelligently splits into two paths. One copy goes to an SQS queue, which acts as a secure audit log for all changes, ensuring you have a record. The other copy is sent to a Lambda function. This function's job is to instantly classify the change's severity – rating it as HIGH, MEDIUM, or LOW – based on the resource type and actions. Finally, these classifications are stored in CloudWatch logs, giving you clear insights into your infrastructure's integrity. This way, you get actionable intelligence, letting you respond effectively to actual infrastructure shifts without getting overwhelmed by vague alerts.
This is a common headache for anyone managing infrastructure as code. You need to know if an IAM role's permissions suddenly changed, a network configuration shifted, or if it's something less impactful. A simple 'drift exists' isn't enough to act quickly or prioritize.
So, here’s a clever fix that helps you understand what's really going on. Instead of just sending a basic email, the solution involves creating a structured event with precise details. First, the process runs `terraform plan` to identify changes and saves the plan. If changes are found, `terraform show -json` converts this plan into a machine-readable JSON format. Since the full JSON can be quite large, a tool called `jq` is used to filter out only the essential bits: the resource `address`, its `type` (like `aws_iam_role`), and the `actions` taken (like `create`, `update`, or `delete`).
This condensed, valuable information is then published as a single structured event to an SNS topic. From there, it intelligently splits into two paths. One copy goes to an SQS queue, which acts as a secure audit log for all changes, ensuring you have a record. The other copy is sent to a Lambda function. This function's job is to instantly classify the change's severity – rating it as HIGH, MEDIUM, or LOW – based on the resource type and actions. Finally, these classifications are stored in CloudWatch logs, giving you clear insights into your infrastructure's integrity. This way, you get actionable intelligence, letting you respond effectively to actual infrastructure shifts without getting overwhelmed by vague alerts.
