6.3.1. Resource Drift and Refresh-Only Mode

💡 First Principle: Drift is detected by comparing recorded state against live reality, so the safe response is to update Terraform's record (not the infrastructure) — which is exactly what refresh-only mode does.

Drift occurs when real infrastructure changes outside Terraform — someone edits a setting in the console, or another tool modifies a resource. Terraform detects drift by refreshing: querying providers for current real-world values and comparing them to state. A normal plan refreshes by default and will show drift as differences it intends to reconcile back to your configuration.

To update state to match reality without changing infrastructure, use refresh-only mode: terraform plan -refresh-only previews the state updates, and terraform apply -refresh-only writes them. This is the modern, safe replacement for the deprecated standalone terraform refresh command.

⚠️ Exam Trap: Refresh-only updates state only — it never modifies real infrastructure. By contrast, a normal apply after detecting drift will change reality back to match your configuration. Know which direction each reconciles: refresh-only moves state toward reality; normal apply moves reality toward config.

Reflection Question: Someone manually changed a security group rule. Describe what a normal apply would do versus apply -refresh-only, and when you'd choose each.