Detecting terraform drift with scheduled github actions and aws oidc

Infrastructure as Code teams face a persistent challenge where the actual state of cloud resources diverges from the code definitions. A recent technical guide published on October 14, 2026, outlines a method to detect this drift automatically using GitHub Actions and AWS OpenID Connect. The approach eliminates the need for long-lived access keys while ensuring that configuration changes are caught early.

What happened

The article, written by the software engineering team at ByteBridge Talent LLC, describes a pipeline that runs Terraform plans on a schedule. Instead of relying on manual checks or reactive debugging after a failed deployment, the system proactively compares the live infrastructure against the Terraform state. When differences are found, the workflow opens a GitHub issue to alert the team. This process uses AWS Identity and Access Management roles assumed via OIDC tokens, which are short-lived and scoped specifically to the repository and branch.

The workflow is designed to run nightly across multiple environments using a matrix strategy. It executes the command terraform plan -detailed-exitcode -lock=false to identify changes without locking the state file. If the exit code indicates drift, the automation creates or updates an issue in the repository. This ensures that the team has a clear, centralized record of discrepancies. The guide emphasizes that this method keeps the infrastructure secure by avoiding stored credentials and reduces noise by only reporting when necessary.

However, the author highlights a critical operational risk associated with this setup. GitHub disables scheduled workflows in repositories that have no activity for sixty days. If an infrastructure repository becomes quiet because no code changes are being merged, the drift detection jobs may silently stop running. This creates a false sense of security where the team believes they are monitoring drift, but the checks have actually ceased. The article notes that this silence can last indefinitely until someone pushes a new commit, potentially leaving significant drift undetected for weeks.

Key details

• The solution uses AWS OIDC identity providers to grant GitHub Actions temporary, read-only credentials without storing long-lived keys.
• Drift detection runs on a nightly schedule using a matrix to check multiple workspaces or directories in parallel.
• The workflow uses terraform plan -refresh-only to see real-world changes without diffing against pending code modifications.
• GitHub automatically disables scheduled workflows in repositories with no commit activity for sixty days, risking silent failure of drift checks.
• Drift issues are triaged into three categories: codify out-of-band changes, revert unauthorized changes, or ignore noisy attributes.
• The method only detects drift for resources managed by Terraform, leaving manually created resources invisible to this specific check.

Background

Terraform drift occurs when the actual state of cloud infrastructure differs from the configuration defined in code. This often happens when engineers make emergency changes directly in the cloud console during an incident, or when automated tools like autoscalers modify resource attributes. Without regular detection, these changes accumulate and cause conflicts during future deployments. Traditional methods to prevent this involve strict policy enforcement or manual audits, both of which can be slow or error-prone.

OpenID Connect allows external services like GitHub to authenticate with cloud providers like AWS without exchanging static secrets. Instead of embedding access keys in environment variables, the workflow requests a short-lived token. AWS validates this token against a trust policy configured in Identity and Access Management. This reduces the attack surface significantly, as there are no long-term credentials to leak or rotate. Combining this security model with scheduled automation creates a robust baseline for infrastructure hygiene.

Why it matters

For teams that self-host their software or manage complex cloud environments, maintaining configuration consistency is vital for stability and security. Undetected drift can lead to unexpected behavior during updates, such as accidental deletion of resources or failure to apply security patches. By automating the detection process, teams can address discrepancies before they compound into larger incidents. The use of OIDC further aligns with security best practices by minimizing credential exposure, which is crucial for organizations handling sensitive data.

The risk of silent workflow failure is particularly relevant for DevOps engineers who rely on automation for visibility. If the drift detection job stops running due to inactivity, the team loses its primary mechanism for identifying unauthorized changes. This gap can persist unnoticed, especially in stable environments where code changes are infrequent. Recognizing this limitation allows teams to implement secondary monitoring measures, ensuring that the safety net remains active even when development velocity slows down.

What you can do

• Configure AWS OIDC identity providers to allow GitHub Actions to assume read-only roles for drift detection.
• Implement a nightly GitHub Actions workflow that runs terraform plan with detailed exit codes to identify changes.
• Add a monitoring layer to detect if scheduled workflows have been disabled by GitHub due to repository inactivity.
• Use lifecycle { ignore_changes } in Terraform configurations to suppress noise from attributes managed by other controllers.
• Establish a triage process for drift issues, distinguishing between changes that should be codified and those that must be reverted.
• Supplement nightly checks with real-time alerts for security-sensitive resources using event-driven architectures like EventBridge.