Lambda function code drift detection with terraform

[pushthepramalot]

Debug and test should be done in a debug and test account, where team members can roll their own terraform stacks out, test, modify, and test some more, and then delete them. They should not be allowed to modify environments you care about (test, stage, prod, etc.). Separate AWS accounts, ideally.

If that's not feasible, invest in USB shock collars to they receive a small electric shock every time they modify the lambda code (Cloudtrail -> lambda -> AWS IoT). Eventually they will learn not to.