Live Demo: Event-Driven Terraform Drift Detection With Falco
summary
Shows a real system that turns CloudTrail events into near‑real‑time Terraform drift alerts using Falco as the rules engine, a custom TF drift comparator, CloudTrail parsing (over 200 event names mapped), Slack/PagerDuty webhooks, plus YQ and Remedify for repair guidance and CI end‑to‑end tests. It claims actor attribution (session name resolved), resource ID mapping, and a policy gate (allow/deny/remediate). Live demo fails but screenshots and CI tests validate detection; known gaps: API lacks auth (localhost only), partial GCP/Azure coverage, and limited resource types.
AI-written summary · about
chapters (12)
- 0:00Real-time Terraform drift detection
- 3:14Falco and cloud audit events
- 8:44Traditional drift detection limits
- 12:20Adapting Falco for monitoring
- 15:39System architecture overview
- 18:14Drift classification and policy gates
- 19:45Live demo attempt
- 25:56What works and gaps
- 27:44End-to-end tests for transparency
- 29:16Next steps beyond detection
- 31:08Incident response loop
- 32:35Summary and future goals
related talks
24mWhy you should take care of infrastructure drift
32mManaging Terraform resource drift using the GitOps method
29mTerraform Drift Detection and Reporting
12mDemo Theater: Practical Path to Infrastructure as Code at Scale
51mTerraform Cloud Learn Lab: Validate Infrastructure, Detect Drift & Enforce OPA Policies
27mAutomating for Failure: Disaster Recovery Testing with Terraform & Gremlin
05mProject Lightning Talk: Detect and Respond to Threats in Your Cloud Infrastructure With Falco
30mWhy you should take care of infrastructure drift