YAML for Terraform Drift Detection

View as Markdown

Run terraform/tofu init and plan in refresh-only mode to find resources that were changed or removed outside of Terraform, then render the drift per resource.

YAML parameters for Terraform Drift Detection

PARAMETERS

toolrequiredstring enum

The Terraform tool to run: OPENTOFU, TERRAFORM (FOSS, up to 1.5.7) or CUSTOM.

Allowed enum:

OPENTOFU,

TERRAFORM,

CUSTOM

typerequiredstring

Value: TERRAFORM_DRIFT_DETECTION

actionrequiredstring

Unique identifier for the action within the pipeline.

fail_on_driftboolean

Whether the action fails once the infrastructure differs from the Terraform state. Defaults to true; set it to false to report the drift in the output variables and let the pipeline continue.

versionstring

Tool version, e.g. 1.9.0 or latest. Required unless tool is CUSTOM.

custom_binary_pathstring

Path to the binary inside the Docker image, e.g. /usr/local/bin/tofu. Required when tool is CUSTOM.

docker_image_namestring

Custom Docker image to run in. Required when tool is CUSTOM.

docker_image_tagstring

Tag of the custom Docker image.

image_locationstring enum

The location of the image used by the action.

Allowed enum:

PUBLIC_REGISTRY,

PRIVATE_REGISTRY,

ACTION,

ARTIFACT_REGISTRY

docker_registrystring enum

The type of registry from which the image is retrieved.

Allowed enum:

NONE,

DOCKER_HUB,

AMAZON_ECR,

GOOGLE_GCR,

GOOGLE_ARTIFACT_REGISTRY,

OTHER,

GIT_HUB_CONTAINER_REGISTRY,

ARTIFACT_REGISTRY,

DIGITAL_OCEAN_CONTAINER_REGISTRY

registrystring

The URL of the Docker registry. Required when docker_registry is OTHER.

loginstring

Username for Docker registry authentication. Used with password when docker_registry is OTHER.

passwordstring

Password for Docker registry authentication. Used with login when docker_registry is OTHER.

regionstring

The region of the Docker registry (for Amazon ECR).

integrationstring

Docker registry integration used to pull the custom image. It refers to an integration in the workspace by its identifier, not by its display name.

working_directorystring

Path relative to the repository root. Defaults to ..

additional_argsstring

Extra CLI arguments appended to the command, as a single space-separated string. Example: -var-file=prod.tfvars -parallelism=20.

tf_workspacestring

Terraform workspace to run in, exported to the tool as TF_WORKSPACE. Set the same value in the Plan and Apply actions, otherwise Apply runs against a different state. Defaults to default, or to TF_WORKSPACE set as a pipeline variable.

backendTerraformRunBackendYaml

State backend configuration: type (CUSTOM, AMAZON, GOOGLE, ARTIFACT), integration, region, artifact and artifact_version. Defaults to CUSTOM, which means the backend is declared in the Terraform code. The backend integration is separate from the action integration pulling the custom runner image.

trigger_timestring enum

Specifies when the action should be executed.

Allowed enum:

ON_EVERY_EXECUTION,

ON_FAILURE,

ON_BACK_TO_SUCCESS,

ON_WARNING,

ON_WAIT_FOR_APPROVE,

ON_TERMINATE

loopstring[]

The list of variables for dynamic action execution. The action runs once for each value.

run_only_on_first_failureboolean

When true, the action runs only on the first failure instead of on each failure. Used only when trigger_time is ON_FAILURE.

disabledboolean

When set to true the action is disabled. By default it is set to false.

timeoutinteger

The timeout in seconds. It cannot exceed the action time limit of the workspace plan; a higher value is rejected.

ignore_errorsboolean

If set to true the execution will proceed, mark action as a warning and jump to the next action. Doesn't apply to deployment actions.

retry_intervalinteger

Delay time between auto retries in seconds.

retry_countinteger

Number of retries if the action fails.

Constraints: ≤ 10

run_nextstring enum

Defines whether the action should run in parallel with the next one.

Allowed enum:

WAIT_ON_SUCCESS,

IN_SOFT_PARALLEL,

IN_HARD_PARALLEL

trigger_conditionsTriggerConditionYaml[]

The list of trigger conditions to meet so that the action can be triggered.

variablesVariableYaml[]

The list of variables you can use in the action.

Last modified on Nov 2, 2026

Terraform CLI Terraform Plan

YAML examples for Terraform Drift Detection

Terraform Drift Detection

yaml

- action: "Detect drift"
  type: "TERRAFORM_DRIFT_DETECTION"
  tool: "OPENTOFU"
  version: "1.9.0"

Terraform Drift Detection reporting the drift without failing

yaml

- action: "Detect drift"
  type: "TERRAFORM_DRIFT_DETECTION"
  tool: "OPENTOFU"
  version: "1.9.0"
  working_directory: "./infrastructure/prod"
  tf_workspace: "production"
  additional_args: "-var-file=prod.tfvars -parallelism=20"
  fail_on_drift: false

Terraform Drift Detection with custom binary

yaml

- action: "Detect drift"
  type: "TERRAFORM_DRIFT_DETECTION"
  tool: "CUSTOM"
  custom_binary_path: "/opt/terraform/bin/terraform"
  docker_image_name: "mycompany/terraform-runner"
  docker_image_tag: "1.9.5"
  working_directory: "./infrastructure/prod"

Terraform Drift Detection with custom image from a private registry

yaml

- action: "Detect drift"
  type: "TERRAFORM_DRIFT_DETECTION"
  tool: "CUSTOM"
  custom_binary_path: "/usr/local/bin/tofu"
  docker_image_name: "mycompany/terraform-runner"
  docker_image_tag: "1.9.5"
  image_location: "PRIVATE_REGISTRY"
  docker_registry: "OTHER"
  registry: "my.registry.com"
  login: "buddyworks"
  password: "${top_secret_password}"
  working_directory: "./infrastructure/prod"

Terraform Drift Detection with state in a Buddy artifact

yaml

- action: "Detect drift"
  type: "TERRAFORM_DRIFT_DETECTION"
  tool: "OPENTOFU"
  version: "1.9.0"
  working_directory: "./infrastructure/prod"
  backend:
    type: "ARTIFACT"
    artifact: "terraform-state"
    artifact_version: "1.0.0"

Terraform Drift Detection with state in Amazon S3

yaml

- action: "Detect drift"
  type: "TERRAFORM_DRIFT_DETECTION"
  tool: "OPENTOFU"
  version: "1.9.0"
  working_directory: "./infrastructure/prod"
  backend:
    type: "AMAZON"
    integration: "amazon-web-services"
    region: "us-east-1"