All Tools View Categories About Contact Privacy

Terraform Drift Detection Helper

Compare your .tf configuration against a .tfstate JSON to find resources missing from state or orphaned in state.

Runs entirely in your browser - nothing is uploaded and no cloud connection is made. Real drift needs terraform plan.
0
in config
0
in state
0
orphaned
Your drift comparison will appear here.

About Terraform Drift Detection Helper

The Terraform Drift Detection Helper compares the resource addresses in your pasted Terraform configuration against those in a pasted .tfstate JSON, and lists the differences. It surfaces resources that exist in your code but not yet in state, and resources that exist in state but are absent from your current configuration, which are often orphaned infrastructure.

This is a local, client-side comparison of addresses only; it does not connect to a cloud and it does not compute real drift, which requires running terraform plan against live infrastructure. What it does provide is a fast, private first pass: confirm that what you intend to manage matches what Terraform already tracks, before you run a plan. Everything runs in your browser, so nothing is uploaded and no credentials are needed. It is useful for cleaning up deleted resources, finding orphaned state entries, and building a report you can attach to a review.

A key thing to understand is the boundary of this tool. It compares addresses, not attribute values, and it never calls a provider, so it cannot tell you that an aws_instance size was changed out of band. For that deeper check you still need terraform plan. But the address comparison catches the most common housekeeping problems: code that was written but never applied, and state that references resources nobody maintains anymore. Those are exactly the issues that accumulate silently over months of day to day work.

Used as a pre-plan step, the helper keeps your state tidy. Run it after refactoring modules or deleting resources by hand, and the orphan list will show what terraform destroy still needs to clean up. That small habit prevents surprise charges and keeps the state file honest about what really exists.

Features

  • Config vs state - compares resource addresses from both sources.
  • Config-only list - resources present in code but not in state.
  • Orphan list - resources in state but missing from config.
  • Counts - totals for in config, in state, and orphaned.
  • Markdown report - a two-list summary you can share.
  • Client-side only - parsed in your browser.
  • Copy, download and print - export the comparison as Markdown.
  • No cloud connection - paste both files and compare locally.
  • Private - your files never leave the page.
  • Fast - instant comparison of two text inputs.
  • Housekeeping - catch code-not-applied and zombie state.
  • Address accurate - matches full resource addresses, including modules.
  • Pre-plan step - tidy state before you run a real plan.
  • Honest state - keep the state file truthful about reality.

How to Use

  1. Open the helper and find the two input boxes on the left.
  2. Paste your .tf configuration into the first box.
  3. Paste your .tfstate JSON into the second box.
  4. Click Compare to scan both files for resource addresses.
  5. Review the config-only list to see resources not yet in state.
  6. Review the orphan list to see state entries without code.
  7. Check the totals at the top for a quick summary.
  8. Export the report with Copy, Download as Markdown, or Print.
  9. Start over with Clear, or load a sample with Load sample.
  10. Act on results by adding missing code or running terraform destroy on orphans.
  11. Follow up with terraform plan when you need true attribute drift, not just an address mismatch.

Examples

Example - config-only resource. An aws_instance defined in config but absent from state appears under In config but NOT in state, telling you it has not yet been created or applied.

Example - orphan. An aws_db_instance present in state but deleted from config appears under In state but NOT in config, flagging infrastructure that still exists and may need a destroy to avoid ongoing cost.

Example - module address. A resource inside a module such as module.net.aws_instance.web is compared by its full address, so the tool respects module scoping rather than only the local name, which keeps results accurate in real configurations.

Benefits

  • Fast - instant comparison of config and state.
  • No secrets sent - everything stays in the browser.
  • Clear - a two-list Markdown report.
  • Cleanup aid - find orphans before they cost money.
  • Private - no uploads or cloud connections.
  • Reviewable - attach the report to a pull request.
  • Accurate - compares full addresses, modules included.
  • Cheap - no plan run, no provider, no wait.

Frequently Asked Questions

What does this helper do?
It compares resource addresses in your .tf configuration against those in a .tfstate JSON and lists resources that are in config but not state, and vice versa. This scaffolds drift analysis.
Does it detect real-world drift?
No. Real drift is a difference between state and actual cloud resources, which requires terraform plan. This only compares config vs state addresses locally.
Do you connect to my cloud?
No. You paste both files and everything is compared in your browser. Nothing is uploaded.
What is an orphaned resource?
A resource present in state but absent from your current config - often deleted in code but not yet terraform destroyed.
Can I export the report?
Yes. Copy, download as .md, or print.