#CodeBuild

2 posts

I Added a Tag in AWS. Terraform Removed It Automatically.

I added a tag directly to an EC2 instance in AWS, then ran my Terraform drift detector. The change was classified as LOW, Lambda started a separate remediation build, and Terraform removed the tag automatically.

July 30, 2026Terraform Drift: Catching Infrastructure Changes Before They Catch You

#Terraform#aws

The Security Group Change Terraform Never Told Me About

Terraform could reproduce my infrastructure, but it could not warn me when someone changed AWS manually. I built a CodeBuild job that runs Terraform plan, handles the drift exit code correctly, reads shared configuration from SSM, and sends an SNS email when the real infrastructure no longer matches the code.

July 15, 2026Terraform Drift: Catching Infrastructure Changes Before They Catch You

#Terraform#aws

#CodeBuild — Lalit Bagga