Skip to main content
← back to extensions

Aws/terraform Drift

@webframp/aws/terraform-driftv2026.10.21.1· Apache-2.0· 5d agoWORKFLOWSREPORTS
01README

Terraform drift detection for AWS — compares Terraform state against live AWS resources to find configuration drift.

Orchestrates data collection from @webframp/terraform (state via CLI) and @webframp/aws/inventory + @webframp/aws/networking (live AWS via SDK), then produces a drift report highlighting missing, extra, and changed resources.

Quick Start

swamp extension pull @webframp/aws/terraform-drift

swamp model create @webframp/terraform tf-infra \
  --global-arg workDir=/path/to/terraform/repo
swamp model create @webframp/aws/inventory aws-inventory \
  --global-arg region=us-east-1
swamp model create @webframp/aws/networking aws-networking \
  --global-arg region=us-east-1

swamp workflow run @webframp/terraform-drift
02Release Notes

2026.10.21.1

Fixed: Terraform attributes masked as ***SENSITIVE*** by @webframp/terraform read_state produced false drift. A wholly sensitive tag map (for example merge() over a sensitive variable) arrives as the mask string, and the report either listed one fake tags.<n> drift per character or failed with a TypeError. A masked scalar (instance_type, subnet_id, name, public_ip, internal) was reported as changed, and a masked id, arn or allocation_id was reported as missing_in_aws.

Changed: Masked values are now treated as unverifiable rather than drift. The JSON output adds an unverifiable array (tfAddress, tfType, resourceId, field) and a summary.unverifiableFields count, and the Markdown report adds an "Unverifiable Fields" section when any exist. A resource with a masked identifier is skipped rather than flagged missing. When tags_all is masked the report no longer falls back to tags, which omits provider default_tags.

Upgrade note: Additive output change; existing summary and findings fields are unchanged. Works with any @webframp/terraform version; the masking it handles arrives with @webframp/terraform 2026.10.21.1.

03Workflows1
@webframp/terraform-drifta1b2c3d4-e5f6-7890-abcd-ef1234567890

Compare Terraform state against live AWS resources to detect drift. Collects Terraform-declared state via CLI, then gathers live AWS resource data, and produces a drift report.

gather-terraform-stateRead Terraform state and resource inventory
1.tf-list-resourcestf-infra.list_resources— List all resources in Terraform state
2.tf-read-statetf-infra.read_state— Read full Terraform state with all resource attributes
3.tf-get-outputstf-infra.get_outputs— Read Terraform output values
gather-aws-live-stateCollect live AWS resource state for comparison
1.aws-inventoryaws-inventory.inventory_all— Run full AWS resource inventory
2.aws-nat-gatewaysaws-networking.list_nat_gateways— List NAT Gateways
3.aws-load-balancersaws-networking.list_load_balancers— List load balancers
4.aws-elastic-ipsaws-networking.list_elastic_ips— List Elastic IPs
04Reports1
@webframp/terraform-drift-reportworkflow
drift_report.ts

Compares Terraform state against live AWS resources to identify configuration drift

awsterraformdriftcompliance
05Previous Versions19
2026.10.14.1Apache-2.0(was none)

2026.10.14.1

Added: The manifest now declares license: Apache-2.0 (SPDX). The registry quality rubric scores a declared license separately from the bundled LICENSE.md.

Upgrade note: Metadata only. No code, schema, or behavioral changes.

2026.09.25.1

Upgrade note: Updated the required @webframp/aws/inventory and @webframp/aws/networking dependencies to 2026.09.24.1. Pull all three extensions together.

2026.09.25.1

2026.09.25.1

Upgrade note: Updated the required @webframp/aws/inventory and @webframp/aws/networking dependencies to 2026.09.24.1. Pull all three extensions together.

updated dependencies

2026.09.18.1

2026.09.18.1

Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the repo. No behavioral changes in this extension.

updated dependencies

2026.09.17.2

2026.09.17.2

Changed: Refreshed the @webframp/aws/inventory and @webframp/aws/networking manifest pins to 2026.09.17.1. No code or behavioral changes.

2026.09.17.1

Changed: Bump @webframp/terraform 2026.08.28.1 → 2026.09.15.1

Changed: Bump @webframp/aws/inventory 2026.08.29.1 → 2026.09.15.1

Changed: Bump @webframp/aws/networking 2026.08.29.1 → 2026.09.15.1

2026.09.04.1

Changed: Bump @webframp/terraform 2026.08.26.3 → 2026.08.28.1

Changed: Bump @webframp/aws/inventory 2026.08.26.3 → 2026.08.29.1

Changed: Bump @webframp/aws/networking 2026.08.26.2 → 2026.08.29.1

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @webframp/terraform 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/networking 2026.08.20.1 → 2026.08.26.2

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

updated dependencies

2026.09.17.1

2026.09.17.1

Changed: Bump @webframp/terraform 2026.08.28.1 → 2026.09.15.1

Changed: Bump @webframp/aws/inventory 2026.08.29.1 → 2026.09.15.1

Changed: Bump @webframp/aws/networking 2026.08.29.1 → 2026.09.15.1

2026.09.04.1

Changed: Bump @webframp/terraform 2026.08.26.3 → 2026.08.28.1

Changed: Bump @webframp/aws/inventory 2026.08.26.3 → 2026.08.29.1

Changed: Bump @webframp/aws/networking 2026.08.26.2 → 2026.08.29.1

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @webframp/terraform 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/networking 2026.08.20.1 → 2026.08.26.2

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

updated dependencies

2026.09.04.1

2026.09.04.1

Changed: Bump @webframp/terraform 2026.08.26.3 → 2026.08.28.1

Changed: Bump @webframp/aws/inventory 2026.08.26.3 → 2026.08.29.1

Changed: Bump @webframp/aws/networking 2026.08.26.2 → 2026.08.29.1

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @webframp/terraform 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/networking 2026.08.20.1 → 2026.08.26.2

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

updated dependencies

2026.08.28.2

2026.08.28.2

Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.

Upgrade note: License text only. No API, schema, or runtime behavior changed.

2026.08.28.1

Changed: Bump @webframp/terraform 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/networking 2026.08.20.1 → 2026.08.26.2

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

2026.08.28.1

2026.08.28.1

Changed: Bump @webframp/terraform 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3

Changed: Bump @webframp/aws/networking 2026.08.20.1 → 2026.08.26.2

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

updated dependencies

2026.08.26.1

2026.08.26.1

Changed: Normalized deno.json configuration for repo-wide consistency: added explicit compilerOptions.strict and migrated zod dependency to the import map (bare "zod" specifier instead of inline npm:zod@4.4.3). No behavioral changes — runtime resolution is identical.

2026.08.25.1

2026.08.25.1

Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.

updated labels

2026.08.24.1

2026.08.24.1

Added: Troubleshooting section documenting false "No Drift Detected" when upstream data is missing, false "missing_in_aws" from failed gather steps, the ineffective workflow region input, silent resource skipping for unmapped ID fields, and the fully-silent getData error handling.

2026.08.20.1

2026.08.20.1

Changed: Bump @webframp/terraform 2026.07.18.1 → 2026.08.20.1

Changed: Bump @webframp/aws/inventory 2026.08.05.1 → 2026.08.20.1

Changed: Bump @webframp/aws/networking 2026.08.05.1 → 2026.08.20.1

2026.08.15.1

Changed: Bump @webframp/aws/inventory 2026.08.02.1 → 2026.08.05.1

Changed: Bump @webframp/aws/networking 2026.08.02.1 → 2026.08.05.1

2026.08.05.1

Changed: Bump @webframp/aws/inventory 2026.08.01.1 → 2026.08.02.1

Changed: Bump @webframp/aws/networking 2026.08.01.1 → 2026.08.02.1

2026.08.02.1

Changed: Bump @webframp/aws/inventory 2026.07.30.1 → 2026.08.01.1

Changed: Bump @webframp/aws/networking 2026.07.30.1 → 2026.08.01.1

2026.07.31.1

Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1

Changed: Bump @webframp/aws/networking 2026.07.24.1 → 2026.07.30.1

2026.07.27.1

Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1

Changed: Bump @webframp/aws/networking 2026.07.21.1 → 2026.07.24.1

2026.07.24.1

Changed: Bump dependency pins to latest published versions:

  • @webframp/terraform 2026.07.16.1 → 2026.07.18.1
  • @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
  • @webframp/aws/networking 2026.07.18.1 → 2026.07.21.1

updated dependencies

2026.08.15.1

2026.08.15.1

Changed: Bump @webframp/aws/inventory 2026.08.02.1 → 2026.08.05.1

Changed: Bump @webframp/aws/networking 2026.08.02.1 → 2026.08.05.1

2026.08.05.1

Changed: Bump @webframp/aws/inventory 2026.08.01.1 → 2026.08.02.1

Changed: Bump @webframp/aws/networking 2026.08.01.1 → 2026.08.02.1

2026.08.02.1

Changed: Bump @webframp/aws/inventory 2026.07.30.1 → 2026.08.01.1

Changed: Bump @webframp/aws/networking 2026.07.30.1 → 2026.08.01.1

2026.07.31.1

Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1

Changed: Bump @webframp/aws/networking 2026.07.24.1 → 2026.07.30.1

2026.07.27.1

Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1

Changed: Bump @webframp/aws/networking 2026.07.21.1 → 2026.07.24.1

2026.07.24.1

Changed: Bump dependency pins to latest published versions:

  • @webframp/terraform 2026.07.16.1 → 2026.07.18.1
  • @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
  • @webframp/aws/networking 2026.07.18.1 → 2026.07.21.1

updated dependencies

2026.08.05.1

2026.08.05.1

Changed: Bump @webframp/aws/inventory 2026.08.01.1 → 2026.08.02.1

Changed: Bump @webframp/aws/networking 2026.08.01.1 → 2026.08.02.1

2026.08.02.1

Changed: Bump @webframp/aws/inventory 2026.07.30.1 → 2026.08.01.1

Changed: Bump @webframp/aws/networking 2026.07.30.1 → 2026.08.01.1

2026.07.31.1

Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1

Changed: Bump @webframp/aws/networking 2026.07.24.1 → 2026.07.30.1

2026.07.27.1

Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1

Changed: Bump @webframp/aws/networking 2026.07.21.1 → 2026.07.24.1

2026.07.24.1

Changed: Bump dependency pins to latest published versions:

  • @webframp/terraform 2026.07.16.1 → 2026.07.18.1
  • @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
  • @webframp/aws/networking 2026.07.18.1 → 2026.07.21.1

updated dependencies

2026.08.02.1

2026.08.02.1

Changed: Bump @webframp/aws/inventory 2026.07.30.1 → 2026.08.01.1

Changed: Bump @webframp/aws/networking 2026.07.30.1 → 2026.08.01.1

2026.07.31.1

Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1

Changed: Bump @webframp/aws/networking 2026.07.24.1 → 2026.07.30.1

2026.07.27.1

Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1

Changed: Bump @webframp/aws/networking 2026.07.21.1 → 2026.07.24.1

2026.07.24.1

Changed: Bump dependency pins to latest published versions:

  • @webframp/terraform 2026.07.16.1 → 2026.07.18.1
  • @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
  • @webframp/aws/networking 2026.07.18.1 → 2026.07.21.1

updated dependencies

2026.07.31.1

2026.07.31.1

Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1

Changed: Bump @webframp/aws/networking 2026.07.24.1 → 2026.07.30.1

2026.07.27.1

Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1

Changed: Bump @webframp/aws/networking 2026.07.21.1 → 2026.07.24.1

2026.07.24.1

Changed: Bump dependency pins to latest published versions:

  • @webframp/terraform 2026.07.16.1 → 2026.07.18.1
  • @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
  • @webframp/aws/networking 2026.07.18.1 → 2026.07.21.1

updated dependencies

2026.07.27.1

2026.07.27.1

Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1

Changed: Bump @webframp/aws/networking 2026.07.21.1 → 2026.07.24.1

2026.07.24.1

Changed: Bump dependency pins to latest published versions:

  • @webframp/terraform 2026.07.16.1 → 2026.07.18.1
  • @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
  • @webframp/aws/networking 2026.07.18.1 → 2026.07.21.1

updated dependencies

2026.07.24.1

2026.07.24.1

Changed: Bump dependency pins to latest published versions:

  • @webframp/terraform 2026.07.16.1 → 2026.07.18.1
  • @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
  • @webframp/aws/networking 2026.07.18.1 → 2026.07.21.1

updated dependencies

2026.07.20.1

2026.07.20.1

Changed: Refreshed dependency pins to the latest published releases. No behavioral changes to the drift-detection workflow or report.

Upgrade note: Bumps @webframp/terraform 2026.04.22.2 → 2026.07.16.1, and @webframp/aws/inventory + @webframp/aws/networking 2026.05.20.1 → 2026.07.18.1, pulled automatically with this extension.

updated dependencies

06Stats
A
100 / 100
Downloads
69
Archive size
13.0 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License2/2earned
  • Verified public repository2/2earned
Repository
https://github.com/webframp/swamp-extensions
07Platforms
08Labels
#aws#compliance#drift#iac#infrastructure#terraform