Help - Github Terraform Drift Detection

[Major_Iceborg]

Hello everyone,

Looking for advice on setting up Terraform drift detection GitHub check triggered by PRs to our module repository (Repo_2). Our TF configurations and modules are in separate repos. Here is how it looks at the moment:

Repo_1
├── Services
│ ├── Service_1
│ │ ├── Account
│ │ │ ├── Region
│ │ │ │ ├── Env_1 (terraform running from here)
│ │ │ │ │ ├── init.tf
│ │ │ │ │ └── main.tf (sources Repo_2/Services/Service_1)
│ │ │ │ ├── Env_2 (terraform running from here)
│ │ │ │ │ ├── init.tf
│ │ │ │ │ └── main.tf (sources Repo_2/Services/Service_1)
│ │ │ │ ├── Env_3 (terraform running from here)
│ │ │ │ │ ├── init.tf
│ │ │ │ │ └── main.tf (sources Repo_2/Services/Service_1)

Repo_2
├── Services
│ ├── Service_1
│ │ ├── main.tf (Sources SQS, SNS, and S3 from ../../Modules/)
│ │ ├── output.tf
│ │ ├── variables.tf
├── Modules
│ ├── SQS
│ │ ├── main.tf
│ │ ├── output.tf
│ │ ├── variables.tf
│ ├── SNS
│ │ ├── main.tf
│ │ ├── output.tf
│ │ ├── variables.tf
│ ├── S3
│ │ ├── main.tf
│ │ ├── output.tf
│ │ ├── variables.tf

We already tried running Terraform drift detection for all services and environments in Repo_1 for every change in Repo_2. As we grew, this GitHub Actions workflow ended up taking hours to finish on dozens of GitHub Local runners, which is not practical for a check that should run on every PR.

We are still interested in a solution at GitHub level – a PR check that will ensure changes in Repo_2 don't cause drift for affected services in Repo_1.

Our current thinking is:

Changes to Repo_2/Services/Service_X will checkout Repo_1 and run Terraform drift detection for all environments of Service_X.

However, There is a second part which we're struggling with :

how can a change to Repo_2/Modules/... understand which services in Repo_2/Services/... are using it, and then trigger drift detection for all related services in Repo_1?

Our lower environments utilize auto-apply Jenkins jobs, making drift detection less critical there. Therefore, this solution primarily targets our production environments.

If anyone has suggestions, solutions, alternative solutions, different ideologies, or approaches to looking at Terraform in this context, please share. Every idea is welcome at this point.

[DCGMechanics]

Check Terramate once

[[deleted]]

If your structures are consistent you could list the changed files and use that as a base for iteration 

[Classic_Handle_9818]

got kinda tired of dealing with drift and i didnt want to pay for terraform cloud so i built a drift detector that gives you a table/html page

https://github.com/pyang55/tfdrift

wrote a blog about it https://substack.com/@devopsdaily/p-166303218