Drift No More: Automating CICD Security Audits of Configuration Drift
Practical guide for security engineers to automate auditing scripts that detect and remediate configuration drift in cloud and on-prem environments....
by Dan.C

If you’ve ever manually clicked through a cloud console to create servers, databases, or networks, you know it can get messy fast. What if you need to replicate the same environment tomorrow, or share it with your team? That is where Terraform comes in.
This post is your from zero to hero guide:
Terraform is an Infrastructure as Code (IaC) tool. Instead of manually creating resources in AWS, Azure, GCP, or other providers, you describe your infrastructure in declarative configuration files.
Imagine you’re telling a builder:
Terraform’s workflow always revolves around four core commands:
.tf) describing resources.At the end, you can destroy everything with a single command.
Download Terraform from HashiCorp’s official site.
Check installation:
terraform -v
Create a new folder and a file called main.tf.
Inside main.tf, write:
provider "aws" {
region = "us-east-1"
}
resource "aws_s3_bucket" "demo" {
bucket = "my-terraform-demo-bucket-12345"
acl = "private"
}
What this does:
aws_s3_bucket) and a name (demo).terraform init
This downloads the provider plugin (AWS in this case) into a hidden folder .terraform/.
Without init, Terraform doesn’t know how to talk to AWS.
terraform validate
Checks for typos and syntax errors. Think of it as a compiler for your infra.
terraform plan
Shows what Terraform would do:
terraform apply
Terraform now creates your resources. You’ll be asked to confirm with yes.
Behind the scenes, Terraform also updates its state file (terraform.tfstate). This file keeps track of all resources Terraform manages.
When you’re done testing:
terraform destroy
Terraform removes everything it created. This is super useful for keeping cloud costs down!
Instead of hardcoding values, make them dynamic:
variable "region" {
default = "us-east-1"
}
provider "aws" {
region = var.region
}
Run with custom variables:
terraform apply -var="region=eu-west-1"
Show useful information after deployment:
output "bucket_name" {
value = aws_s3_bucket.demo.bucket
}
View outputs:
terraform output
Terraform keeps track of what it manages in terraform.tfstate.
Think of modules like functions in programming. They package resources into reusable blocks.
Example:
module "network" {
source = "./modules/network"
cidr_block = "10.0.0.0/16"
}
This lets you structure large projects cleanly.
Workspaces let you separate environments (dev, staging, prod) while reusing the same configs.
terraform workspace new dev
terraform workspace select dev
terraform apply
Here’s your quick reference. Bookmark this!
terraform init # Initialize directory (downloads providers)
terraform validate # Validate configuration files
terraform fmt # Auto-format .tf files
terraform providers # Show required providers
terraform plan # Preview changes (dry run)
terraform apply # Apply changes
terraform destroy # Destroy all managed infrastructure
terraform state list # List resources in state
terraform state show <resource> # Show details of a resource
terraform state rm <resource> # Remove a resource from state
terraform refresh # Refresh local state from provider
terraform output # Show outputs
terraform apply -var="key=value" # Pass variable at runtime
terraform workspace list # List workspaces
terraform workspace new staging # Create new workspace
terraform workspace select staging # Switch to workspace
TF_LOG=DEBUG terraform plan # Debug logs
TF_LOG=TRACE terraform apply # Very detailed logs
Terraform is a powerful tool for managing infrastructure consistently and safely. The learning curve may feel steep at first, but once you understand the workflow (init → plan → apply → destroy) and how state files work, it becomes second nature.
Start small (like creating a single bucket or VM), then explore variables, modules, and remote state as you grow more confident. And whenever you forget a command—come back to the cheat sheet above.
Related Posts
Practical guide for security engineers to automate auditing scripts that detect and remediate configuration drift in cloud and on-prem environments....
A focused guide on securing Terraform infrastructure-as-code, covering state file protection, least privilege, secrets management, and guardrail automation
A practical reference for essential Linux commands every developer, sysadmin, or security engineer should know—organized for speed, efficiency, and daily...
Keep learning, stay inovative. — Dan.C
tags: terraform - infrastructure-as-code - iac - devops - cloud - aws - automation - infrastructure - cloud-computing - cheat-sheet - tutorial - beginners-guide