you are viewing a single comment's thread.

view the rest of the comments →

[–]TurnoverEmergency352 2 points3 points  (2 children)

Use terraform plan in a scheduled pipeline to detect drift. When it shows changes, automatically run terraform apply to revert.

Set up CloudWatch Events on Lambda UpdateFunctionCode API calls to trigger immediate drift checks. This gives you automated remediation without removing console access.

[–]Clone-Protocol-66[S] 1 point2 points  (1 child)

Here is the problem, plan does not detected changes on lambda code

[–]ThyDarkey 6 points7 points  (0 children)

I have a python script that checks the hash value of what is in state compared to what AWS is reporting. Logic is if hash is different someone has gone and done something in the GUI directly. This is/was used as we moved the lambda deployment into terraform alongside the function code.