hardScenarioDesignSeniorStaff
How do you engineer an automated reconciliation system to detect, remediate, and prevent Terraform state drift in a massive multi-account cloud environment?
2 min readUpdated 2026-08-15
Answer
Short answer
A deep examine managing Infrastructure as Code at scale, focusing on the architectural patterns required to handle state drift, enforce compliance, and maintain state integrity.
Was this answer helpful?
Likely follow-ups
- How would you handle a case where the manually-applied out-of-band change was actually correct and the Terraform configuration itself is now the stale artefact?
- How does your drift detection pipeline's design change once you are running speculative plans across tens of thousands of workspaces instead of hundreds?
- An engineer pushes a change directly through the cloud console that bypasses your Service Control Policy guardrails entirely. How do you detect that the guardrail itself failed?
Related questions
- How do you architect an automated lifecycle management system to identify, quarantine, and terminate orphaned cloud resources without accidentally destroying critical infrastructure?hardAlso on cloud-infrastructure and automation2 min
- A Terraform plan in CI wants to destroy resources in production. What has to happen before anyone is allowed to approve it?hardAlso on terraform6 min
- Why is state the hard part of Terraform, and how do you manage drift, imports and locking around it?hardAlso on terraform6 min
- A test fails in CI and all you get is 'expected true, got false'. What should the framework have given you instead?mediumAlso on automation4 min