Refresh, Drift, and Reconciliation

Scenario: An operator changes a server size in the FakeCloud console. The next plan wants to restore the configured size.

Refresh reads remote objects and updates Terraform's in-memory view before diffing. Drift is a difference caused outside the authoritative configuration. Decide whether to revert the remote change, update configuration to adopt it, or deliberately ignore a field. plan -refresh-only and apply -refresh-only can reconcile state to external changes without proposing configured infrastructure changes, but adoption still requires code to match future intent.

Analogy: Configuration is the approved map, state is yesterday's survey, and refresh sends a surveyor back to the land. A discrepancy needs a governance decision, not an automatic winner.

A worked configuration

terraform plan
terraform plan -refresh-only
terraform apply -refresh-only
terraform state show fakecloud_server.api

Frequent drift signals unclear ownership, emergency procedures that never feed back into code, or fields controlled by another system. Monitor drift and make break-glass changes produce a follow-up pull request.

Note: Treat the plan as a change contract: understand every create, update, replacement, and destroy before approving it.

Goal: Reinforce this lesson in the tf-state-drift-recovery Terraform lab. Open /labs/terraform and choose slug tf-state-drift-recovery; the lab runs real Terraform against the offline FakeCloud provider.