Question

Your platform team manages all Google Cloud infrastructure with Terraform, storing state in a GCS backend. Recently, several on-call engineers made manual changes in the Cloud Console during incidents, and these changes were later silently overwritten by the next Terraform apply, causing an outage. Leadership wants an automated way to detect when the live infrastructure diverges from the committed Terraform code, without automatically modifying resources. What should you implement?

Accepted Answer

Configure a scheduled Cloud Build (or scheduled pipeline) job that runs 'terraform plan -detailed-exitcode' against the committed code and alerts the team when a non-zero drift exit code is returned.

Answer

Enable a scheduled pipeline that runs 'terraform apply -auto-approve' every hour so the live environment always matches the code.

Answer

Turn on Organization Policy constraints to block all manual changes in the Cloud Console for every project.

Answer

Store Terraform state in a second GCS bucket and run a periodic diff between the two state files to find changes.