Does terraform has any drifts for example if I remove a db from terraform is it going to.remove the db from prod? Can I trust it's always the same or do I have to do cleanups?
Re:Mistakes I've Made in AWS
by chrisandchris on Sunday September 12, 2021 @03:33AM
(#28499290)
Terraform is declarative, meaning: The stuff you write into the terraform files (TF) is exactly the stuff you get configured.
Example: you add a new database and a database user to the TF files, run terraform plan & apply, you do have the database and user configured. You remove the user and run plan & apply, terraform does remove the user.
It goes the other way too: if you add additional port rules to a network security group (e.g. in AWS) by hand, terraform will remove them when plan & apply because they are not defined in the TF files.
So in conclusion: for your declared state, there will be no drift.
The main difference, if I revoke a DB privilege, I have to add a line to Ansible with a REVOKE in most cases versus Terraform you just delete the config line and the tool realizes during its diff stage and performs the removal change (it's stateful and declarative)