Terraform Drift Detection with Slack Alerts

Catch Terraform infrastructure drift before it causes an incident. This blueprint runs terraform plan -detailed-exitcode on a schedule, inspects the exit code, and posts a Slack alert the moment the live cloud state diverges from the configuration in version control. It turns drift detection from an ad hoc check into a continuous, auditable control without standing up a separate CI job or pipeline.

How it works

1. The hourly_drift_check io.kestra.plugin.core.trigger.Schedule trigger fires on the configured cron (0 * * * *, disabled by default).
2. The plan task (io.kestra.plugin.terraform.cli.TerraformCLI) runs inside the hashicorp/terraform:latest container via the Docker task runner, executes terraform init in beforeCommands, then runs terraform plan -detailed-exitcode -no-color.
3. allowFailure: true lets the non-zero exit code from a drifted plan flow downstream instead of failing the execution.
4. The alert_on_drift task (io.kestra.plugin.core.flow.If) evaluates {{ outputs.plan.exitCode == 2 }}. Exit code 2 means changes are pending.
5. On drift, notify_drift (io.kestra.plugin.slack.notifications.SlackIncomingWebhook) posts a message to the Slack webhook so the team can review the plan and reconcile.

What you get

• Continuous drift detection without writing a custom CI job.
• A clear Slack signal the moment live infra diverges from code.
• Full plan logs and exit code captured as Kestra outputs for audit.
• A schedule you control, decoupled from pull request workflows.

Who it's for

• Platform and DevOps engineers responsible for cloud infrastructure.
• SRE teams that want early warning on out-of-band changes.
• Security and compliance teams tracking configuration integrity.

Why orchestrate this with Kestra

Terraform itself has no scheduler, no native alerting, and no execution history. CI pipelines can run plan on merge, but they miss changes made directly in the cloud console or by other tools. Kestra fills that gap with event and cron triggers, retries, full execution lineage, and declarative YAML you can review, diff, and version. The If task and allowFailure flag let you branch cleanly on the detailed exit code, and outputs are available for downstream tasks (open a ticket, page on-call, store the plan in object storage) without bolting on extra glue.

Prerequisites

• A Terraform configuration with a remote backend so plan reads real state.
• A Slack incoming webhook URL.
• Cloud provider credentials matching the configuration (AWS shown by default).

Secrets

• AWS_ACCESS_KEY_ID: AWS access key for the provider.
• AWS_SECRET_ACCESS_KEY: AWS secret key for the provider.
• SLACK_WEBHOOK_URL: Slack incoming webhook URL for drift alerts.

Quick start

1. Add the secrets above to your Kestra namespace or instance.
2. Replace the stub main.tf in inputFiles with your real configuration and remote backend block.
3. Adjust the cron in hourly_drift_check and set disabled: false to activate the schedule.
4. Run the flow once manually to confirm the plan executes and Slack receives a test alert when drift exists.

How to extend

• Swap AWS credentials for GCP, Azure, or other provider env vars your modules need.
• Add a third branch on non-zero, non-2 exit codes to page on-call when plan itself errors.
• Persist the plan output to S3 or GCS for compliance evidence.
• Open a Jira or GitHub issue automatically alongside the Slack alert.
• Replace the stub configuration with a Git-based inputFiles clone so the flow always plans the latest committed code.

Links

• Terraform plugin: https://kestra.io/plugins/plugin-terraform
• Terraform orchestration: https://kestra.io/orchestration/terraform
• Slack plugin: https://kestra.io/plugins/plugin-notifications