I built a Terraform drift monitor because driftctl is abandoned and everything else costs $700/month
Background: I'm a DevOps engineer working at a multinational company managing AWS infrastructure with Terraform. Like a lot of teams, we kept getting burned by the same thing, someone makes a manual change in the AWS console during an incident, forgets to update Terraform, and three weeks later terraform apply reverts it and breaks something at 2am.
driftctl was our go-to for catching this. Then Snyk acquired them and archived the repo earlier this year.
Looked at the alternatives:
- terraform plan on a cron job: catches it but doesn't tell you WHO changed it or WHEN
- Firefly, ControlMonkey: great products, pricing starts at $699/month which is hard for smaller teams
- Scalr, env0: free drift detection but requires migrating your entire Terraform workflow to their platform — we didn't want to do that just for alerts
So I built IaCRadar (iacradar.dev) evenings over the past few months while still employed full time.
What it does:
- Connects to your existing S3 state bucket (no platform migration)
- Checks live AWS against your Terraform state hourly
- Sends Slack or Teams alerts when something drifts
- Covers IAM policies, trust relationships, security groups (ingress + egress), S3 bucket policies, S3 public access blocks, EC2, RDS, EKS node groups and cluster versions, Lambda, ASG, KMS key policies, Route53 and CloudWatch
What it doesn't do (yet):
- Unmanaged resources (things not in Terraform at all)
- Auto-remediation
- Non-AWS providers
Setup is a CloudFormation one-click that deploys a read-only IAM role in your account (cross-account STS assume role, same pattern Datadog uses). Or a Terraform module if you prefer keeping everything in code.
14 day free trial, no credit card required.
Would love feedback from people who've dealt with this problem. What checks are you missing that driftctl had? What would make you actually pay for something like this vs rolling your own?