Detect, track and alert on infrastructure drift
 
 
 
 
Go to file
Elie 0749c72024
Create generic terraform provider
2021-02-12 16:18:26 +01:00
.circleci Split lint from test 2021-02-08 19:11:47 +01:00
.github Update version resolver 2021-01-27 20:39:49 +01:00
assets new driftctl icon that stands out in dark mode 2021-01-13 08:39:48 +01:00
bin 🍾 Initial release 2020-12-09 16:35:26 +01:00
build 🍾 Initial release 2020-12-09 16:35:26 +01:00
doc add support for dynamodb_table 2021-02-11 18:18:08 +01:00
logger log everything as trace 2021-02-11 14:17:06 +01:00
mocks add support for dynamodb_table 2021-02-11 18:18:08 +01:00
pkg Create generic terraform provider 2021-02-12 16:18:26 +01:00
scripts Add build checksums 2021-02-03 12:19:12 +01:00
sentry ignore usage errors from sentry capture 2021-02-09 22:19:24 +01:00
test Add new logger for terraform plugin 2021-02-10 15:04:07 +01:00
.all-contributorsrc docs: update .all-contributorsrc [skip ci] 2021-02-09 14:11:07 +00:00
.dockerignore add a docker build for driftcl & badge in readme 2020-12-11 17:12:22 +01:00
.editorconfig 🍾 Initial release 2020-12-09 16:35:26 +01:00
.gitignore 🍾 Initial release 2020-12-09 16:35:26 +01:00
.go-version 🍾 Initial release 2020-12-09 16:35:26 +01:00
.golangci.yml Remove reference used in loops 2021-02-04 22:45:10 +01:00
CONTRIBUTORS.md docs: update CONTRIBUTORS.md [skip ci] 2021-02-09 14:11:06 +00:00
Dockerfile add home support for docker image 2021-01-05 11:27:11 +01:00
LICENSE.md 🍾 Initial release 2020-12-09 16:35:26 +01:00
Makefile Split lint from test 2021-02-08 19:11:47 +01:00
README.md Update README.md 2021-02-09 17:53:06 +01:00
ROADMAP.md initial ROADMAP.md, after team meeting 2021-01-29 16:32:26 +01:00
codecov.yml 🍾 Initial release 2020-12-09 16:35:26 +01:00
go.mod go get github.com/hashicorp/terraform-exec@v0.12.0 2021-02-05 21:33:17 +09:00
go.sum go get github.com/hashicorp/terraform-exec@v0.12.0 2021-02-05 21:33:17 +09:00
main.go Merge branch 'main' into plugin_log_improvment 2021-02-11 14:55:00 +01:00

README.md

Driftctl

Measures infrastructure as code coverage, and tracks infrastructure drift.
IaC: Terraform, Cloud platform: AWS (Azure and GCP on the roadmap for 2021).
⚠️ This tool is still in beta state and will evolve in the future with potential breaking changes ⚠️

Why ?

Infrastructure as code is awesome, but there are too many moving parts: codebase, state file, actual cloud state. Things tend to drift.

Drift can have multiple causes: from developers creating or updating infrastructure through the web console without telling anyone, to uncontrolled updates on the cloud provider side. Handling infrastructure drift vs the codebase can be challenging.

You can't efficiently improve what you don't track. We track coverage for unit tests, why not infrastructure as code coverage?

driftctl tracks how well your IaC codebase covers your cloud configuration. driftctl warns you about drift.

Features

  • Scan cloud provider and map resources with IaC code
  • Analyze diff, and warn about drift and unwanted unmanaged resources
  • Allow users to ignore resources
  • Multiple output formats

Documentation & support

Getting started

Installation

driftctl is available on Linux, macOS and Windows.

Binaries are available in the release page.

Homebrew for macOS

brew install driftctl

MacPorts for macOS

sudo port install driftctl

Docker

docker run -t --rm \
  -v ~/.aws:/home/.aws:ro \
  -v $(pwd):/app:ro \
  -v ~/.driftctl:/home/.driftctl \
  -e AWS_PROFILE=non-default-profile \
  cloudskiff/driftctl scan

-v ~/.aws:/home/.aws:ro (optionally) mounts your ~/.aws containing AWS credentials and profile

-v $(pwd):/app:ro (optionally) mounts your working dir containing the terraform state

-v ~/.driftctl:/home/.driftctl (optionally) prevents driftctl to download the provider at each run

-e AWS_PROFILE=cloudskiff (optionally) exports the non-default AWS profile name to use

cloudskiff/driftctl:<VERSION_TAG> run a specific driftctl tagged release

Manual

  • Linux

This is an example using curl. If you don't have curl, install it, or use wget.

# x64
curl -L https://github.com/cloudskiff/driftctl/releases/latest/download/driftctl_linux_amd64 -o driftctl

# x86
curl -L https://github.com/cloudskiff/driftctl/releases/latest/download/driftctl_linux_386 -o driftctl

Make the binary executable:

chmod +x driftctl

Optionally install driftctl to a central location in your PATH:

# use any path that suits you, this is just a standard example. Install sudo if needed.
sudo mv driftctl /usr/local/bin/
  • macOS
# x64
curl -L https://github.com/cloudskiff/driftctl/releases/latest/download/driftctl_darwin_amd64 -o driftctl

Make the binary executable:

chmod +x driftctl

Optionally install driftctl to a central location in your PATH:

# use any path that suits you, this is just a standard example. Install sudo if needed.
sudo mv driftctl /usr/local/bin/
  • Windows
# x64
curl https://github.com/cloudskiff/driftctl/releases/latest/download/driftctl_windows_amd64.exe -o driftctl.exe
# x86
curl https://github.com/cloudskiff/driftctl/releases/latest/download/driftctl_windows_386.exe -o driftctl.exe

Verify digital signatures

Cloudskiff releases are signed using PGP key (ed25519) with ID ACC776A79C824EBD and fingerprint 2776 6600 5A7F 01D4 84F6 376D ACC7 76A7 9C82 4EBD Our key can be retrieved from common keyservers.

# Download binary, checksums and signature
$ curl -L https://github.com/cloudskiff/driftctl/releases/latest/download/driftctl_linux_amd64 -o driftctl_linux_amd64
$ curl -L https://github.com/cloudskiff/driftctl/releases/latest/download/driftctl_SHA256SUMS -o driftctl_SHA256SUMS
$ curl -L https://github.com/cloudskiff/driftctl/releases/latest/download/driftctl_SHA256SUMS.gpg -o driftctl_SHA256SUMS.gpg

# Import key
$ gpg --keyserver hkps.pool.sks-keyservers.net --recv-keys 0xACC776A79C824EBD
gpg: key ACC776A79C824EBD: public key "Cloudskiff <security@cloudskiff.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

# Verify signature (optionally trust the key from gnupg to avoid any warning)
$ gpg --verify driftctl_SHA256SUMS.gpg
gpg: Signature made jeu. 04 févr. 2021 14:58:06 CET
gpg:                using EDDSA key 277666005A7F01D484F6376DACC776A79C824EBD
gpg:                issuer "security@cloudskiff.com"
gpg: Good signature from "Cloudskiff <security@cloudskiff.com>" [ultimate]

# Verify checksum
$ sha256sum --ignore-missing -c driftctl_SHA256SUMS
driftctl_linux_amd64: OK

Run

Be sure to have configured your AWS credentials.

You will need to assign proper permissions to allow driftctl to scan your account.

# With a local state
$ driftctl scan
# Same as
$ driftctl scan --from tfstate://terraform.tfstate

# To specify AWS credentials
$ AWS_ACCESS_KEY_ID=XXX AWS_SECRET_ACCESS_KEY=XXX driftctl scan
# or using a profile
$ AWS_PROFILE=profile_name driftctl scan

# With state stored on a s3 backend
$ driftctl scan --from tfstate+s3://my-bucket/path/to/state.tfstate

# With multiples states
$ driftctl scan --from tfstate://terraform_S3.tfstate --from tfstate://terraform_VPC.tfstate

Contribute

To learn more about compiling driftctl and contributing, please refer to the contribution guidelines and contributing guide for technical details.

This project follows the all-contributors specification and is brought to you by these awesome contributors.

Build with ❤️ from 🇫🇷 🇯🇵 🇬🇷 🇸🇪 🇺🇸