driftctl

https://docs.driftctl.com
Admin
driftctl is CLI tool that measures infrastructure as code coverage, and tracks infrastructure drift.
Tokens:172,160
Snippets:2,320
Trust Score:8
Update:4 months ago
Show doc for...
Tokens:
Raw
### Full CircleCI Workflow Example

Source: https://docs.driftctl.com/0.25.0/ci_cd/guides/circleci

A comprehensive CircleCI configuration demonstrating a GitOps workflow with driftctl and scheduled runs. This example includes installation, scanning, and integration with Terraform.

```yaml
version: '2.1'  
  
orbs:  
  driftctl: snyk/driftctl@1  
  terraform: circleci/terraform@1  
  
jobs:
  driftctl:  
    executor: driftctl/default  
    environment:  
      DCTL_NO_VERSION_CHECK: 'true'  
      DCTL_FILTER: "Type==\'aws_instance\'"  
    steps:  
      - checkout # This step may be optional  
      - driftctl/install:  
          version: v0.6.0  
      - driftctl/scan  
  
workflows:  
  # This workflow schedules driftctl every 10 minutes  
  drift_monitoring:  
    triggers:  
      - schedule:  
          cron: "0,10,20,30,40,50 * * * *"  
          filters:  
            branches:  
              only:  
                - master  
    jobs:  
      - driftctl:  
          context: test-orb-driftctl  
  # The workflow below is an example to integrate driftctl in your GitOps pipeline  
  deploy_infrastructure:  
    jobs:  
      - driftctl:  
          context: test-orb-driftctl  
      - terraform/fmt:  
          checkout: true  
          context: test-orb-terraform  
      - terraform/validate:  
          checkout: true  
          context: test-orb-terraform  
          requires:  
            - terraform/fmt  
      - terraform/plan:  
          checkout: true  
          context: test-orb-terraform  
          persist-workspace: true  
          requires:  
            - terraform/validate  
            - driftctl  
      - approve:  
          type: approval  
          requires:  
            - terraform/plan  
      - terraform/apply:  
          attach-workspace: true  
          context: test-orb-terraform  
          requires:  
            - approve  

```

--------------------------------

### Full CircleCI Workflow Example with driftctl

Source: https://docs.driftctl.com/0.39.0/ci_cd/guides/circleci

This example demonstrates a comprehensive CircleCI workflow integrating driftctl for GitOps and scheduled monitoring. It includes installation, scanning, and Terraform operations.

```yaml
version: '2.1'  
  
orbs:  
  driftctl: snyk/driftctl@1  
  terraform: circleci/terraform@1  
  
jobs:
  driftctl:
    executor: driftctl/default  
    environment:  
      DCTL_NO_VERSION_CHECK: 'true'  
      DCTL_FILTER: "Type==\'aws_instance\'"  
    steps:  
      - checkout # This step may be optional  
      - driftctl/install:  
          version: v0.6.0  
      - driftctl/scan  
  
workflows:  
  # This workflow schedules driftctl every 10 minutes  
  drift_monitoring:
    triggers:  
      - schedule:  
          cron: "0,10,20,30,40,50 * * * *"  
          filters:  
            branches:  
              only:  
                - master  
    jobs:  
      - driftctl:  
          context: test-orb-driftctl  
  # The workflow below is an example to integrate driftctl in your GitOps pipeline  
  deploy_infrastructure:
    jobs:  
      - driftctl:  
          context: test-orb-driftctl  
      - terraform/fmt:  
          checkout: true  
          context: test-orb-terraform  
      - terraform/validate:  
          checkout: true  
          context: test-orb-terraform  
          requires:  
            - terraform/fmt  
      - terraform/plan:  
          checkout: true  
          context: test-orb-terraform  
          persist-workspace: true  
          requires:  
            - terraform/validate  
            - driftctl  
      - approve:  
          type: approval  
          requires:  
            - terraform/plan  
      - terraform/apply:  
          attach-workspace: true  
          context: test-orb-terraform  
          requires:  
            - approve  

```

--------------------------------

### Full CircleCI Workflow Example

Source: https://docs.driftctl.com/0.15.0/ci_cd/guides/circleci

A comprehensive CircleCI configuration demonstrating GitOps integration and scheduled driftctl scans. Includes jobs for installation, scanning, Terraform formatting, validation, planning, and applying.

```yaml
version: '2.1'  
  
orbs:  
  driftctl: snyk/driftctl@1  
  terraform: circleci/terraform@1  
  
jobs:
  driftctl:
    executor: driftctl/default  
    environment:
      DCTL_NO_VERSION_CHECK: 'true'  
      DCTL_FILTER: "Type==\'aws_instance\'"  
    steps:
      - checkout # This step may be optional  
      - driftctl/install:
          version: v0.6.0  
      - driftctl/scan  

workflows:
  # This workflow schedules driftctl every 10 minutes  
  drift_monitoring:
    triggers:
      - schedule:
          cron: "0,10,20,30,40,50 * * * *"  
          filters:
            branches:
              only:
                - master  
    jobs:
      - driftctl:
          context: test-orb-driftctl  
  # The workflow below is an example to integrate driftctl in your GitOps pipeline  
  deploy_infrastructure:
    jobs:
      - driftctl:
          context: test-orb-driftctl  
      - terraform/fmt:
          checkout: true  
          context: test-orb-terraform  
      - terraform/validate:
          checkout: true  
          context: test-orb-terraform  
          requires:
            - terraform/fmt  
      - terraform/plan:
          checkout: true  
          context: test-orb-terraform  
          persist-workspace: true  
          requires:
            - terraform/validate  
            - driftctl  
      - approve:
          type: approval  
          requires:
            - terraform/plan  
      - terraform/apply:
          attach-workspace: true  
          context: test-orb-terraform  
          requires:
            - approve  

```

--------------------------------

### Basic .driftignore Examples

Source: https://docs.driftctl.com/0.22.0/usage/filtering/driftignore

Examples demonstrating how to ignore specific resources by type and ID, use wildcards for resource IDs and fields, and target specific fields within resources.

```yaml
# Will ignore S3 bucket called my-bucket
aws_s3_bucket.my-bucket

```

```yaml
# Will ignore every aws_instance resource
aws_instance.*

```

```yaml
# Will ignore environment for all lambda functions
aws_lambda_function.*.environment

```

```yaml
# Will ignore resources like aws_iam_role.AmazonSSMRoleForInstances and aws_iam_role.AWSServiceRoleForAmazonSSM
*role.*Amazon*

```

```yaml
# Will ignore lastModified for my-lambda-name lambda function
aws_lambda_function.my-lambda-name.last_modified

```

--------------------------------

### Install Fish Completion Script

Source: https://docs.driftctl.com/0.15.0/usage/cmd/completion-usage

Installs the Fish completion script for driftctl. The script is saved to ~/.config/fish/completions/driftctl.fish. Ensure the directory exists before saving.

```fish
$ driftctl completion fish > ~/.config/fish/completions/driftctl.fish  
```

--------------------------------

### Console Output Structure Example

Source: https://docs.driftctl.com/0.40.0/usage/cmd/scan-usage

Example structure of the console output, showing found missing resources, resources not covered by IaC, and coverage statistics.

```text
Found missing resources:  
  aws_s3_bucket:  
    - driftctl-bucket-test-2  
Found resources not covered by IaC:  
  aws_s3_bucket:  
    - driftctl-bucket-test-3  
Found 3 resource(s)  
 - 33% coverage  
 - 1 covered by IaC  
 - 1 not covered by IaC  
 - 1 missing on cloud provider  
```

--------------------------------

### Driftctl Scan HTML Output Examples

Source: https://docs.driftctl.com/0.16.0/usage/cmd/scan-usage

Examples of how to direct driftctl scan results to an HTML file.

```bash
$ driftctl scan --output html://output.html # Will output results to ./output.html  
$ DCTL_OUTPUT=html://output.html driftctl scan  

```

--------------------------------

### Full GitLab CI Example with GitOps Workflow and Scheduled Run

Source: https://docs.driftctl.com/0.21.0/ci_cd/guides/gitlabci

This comprehensive example configures GitLab CI stages for initialization, validation, planning, and deployment. It includes a scheduled job for continuous drift detection and a classic GitOps workflow for applying infrastructure changes.

```yaml
stages:  
  - init  
  - validate  
  - plan  
  - deploy  
  
.driftctl:  
  image:  
    name: snyk/driftctl  
    entrypoint: [""]  
  script:  
    - driftctl scan  
  
# ====================  
# Scheduled driftctl run  
# ====================  
# Scheduled driftctl run  
driftctl:scheduled:  
  extends: .driftctl  
  only:  
    - schedules  
  stage: validate  
  variables:  
    AWS_DEFAULT_REGION: us-east-1  
    DCTL_FILTER: "Type=='aws_s3_bucket'"  
  
# ====================  
# Classic GitOps workflow  
# ====================  
  
# Used to share .terraform cached providers in terraform jobs  
.tfcache: &tfcache  
  cache:  
    key: ${CI_PIPELINE_ID}  
    paths:  
      - .terraform  
  
# Terraform image to use for every terraform jobs  
.terraform: &terraform  
  image:  
    name: hashicorp/terraform:0.14.4  
    entrypoint: [""]  
  
terraform/init:  
  <<: *terraform  
  <<: *tfcache  
  stage: init  
  except:  
    - schedules  
  script:  
    - terraform init  
  
driftctl:  
  extends: .driftctl  
  except:  
    - schedules  
  stage: validate  
  variables:  
    AWS_DEFAULT_REGION: us-east-1  
    DCTL_FILTER: "Type=='aws_s3_bucket'"  
  
terraform/fmt:  
  <<: *terraform  
  stage: validate  
  except:  
    - schedules  
  script:  
    - terraform fmt -check -diff  
  
terraform/validate:  
  <<: *terraform  
  <<: *tfcache  
  stage: validate  
  except:  
    - schedules  
  script:  
    - terraform validate  
  
terraform/plan:  
  <<: *terraform  
  <<: *tfcache  
  stage: plan  
  except:  
    - schedules  
  artifacts:  
    name: plan  
    expire_in: 1 day  
    paths:  
      - "plan.out"  
  script:  
    - terraform plan -out=plan.out  
  
terraform/apply:  
  <<: *terraform  
  <<: *tfcache  
  stage: deploy  
  when: manual  
  dependencies:  
    - terraform/plan  
  except:  
    - schedules  
  script:  
    - terraform apply plan.out  
  
```

--------------------------------

### Full CircleCI Workflow Example

Source: https://docs.driftctl.com/0.22.0/ci_cd/guides/circleci

A comprehensive CircleCI configuration demonstrating a GitOps workflow with driftctl and Terraform, including scheduled monitoring.

```yaml
version: '2.1'  
  
orbs:  
  driftctl: snyk/driftctl@1  
  terraform: circleci/terraform@1  
  
jobs:
  driftctl:
    executor: driftctl/default  
    environment:
      DCTL_NO_VERSION_CHECK: 'true'  
      DCTL_FILTER: "Type=='aws_instance'"
    steps:
      - checkout # This step may be optional  
      - driftctl/install:  
          version: v0.6.0  
      - driftctl/scan  

workflows:  
  # This workflow schedules driftctl every 10 minutes  
  drift_monitoring:
    triggers:
      - schedule:
          cron: "0,10,20,30,40,50 * * * *"  
          filters:
            branches:
              only:
                - master  
    jobs:
      - driftctl:
          context: test-orb-driftctl  
  # The workflow below is an example to integrate driftctl in your GitOps pipeline  
  deploy_infrastructure:
    jobs:
      - driftctl:
          context: test-orb-driftctl  
      - terraform/fmt:
          checkout: true  
          context: test-orb-terraform  
      - terraform/validate:
          checkout: true  
          context: test-orb-terraform  
          requires:
            - terraform/fmt  
      - terraform/plan:
          checkout: true  
          context: test-orb-terraform  
          persist-workspace: true  
          requires:
            - terraform/validate  
            - driftctl  
      - approve:
          type: approval  
          requires:
            - terraform/plan  
      - terraform/apply:
          attach-workspace: true  
          context: test-orb-terraform  
          requires:
            - approve  

```

--------------------------------

### Install Bash Completion Script

Source: https://docs.driftctl.com/0.15.0/usage/cmd/completion-usage

Installs the Bash completion script for driftctl. For Linux, it uses /etc/bash_completion.d/. For macOS, it uses /usr/local/etc/bash_completion.d/. Remember to open a new shell after installation.

```bash
# Linux:  
$ driftctl completion bash | sudo tee /etc/bash_completion.d/driftctl  
  
# macOS:  
$ driftctl completion bash > /usr/local/etc/bash_completion.d/driftctl  
```

--------------------------------

### Full CircleCI GitOps Workflow Example

Source: https://docs.driftctl.com/0.34.0/ci_cd/guides/circleci

This comprehensive example demonstrates a full CircleCI workflow integrating driftctl with Terraform for a GitOps pipeline. It includes scheduled drift monitoring and an infrastructure deployment process that blocks on drift detection.

```yaml
version: '2.1'  
  
orbs:  
  driftctl: snyk/driftctl@1  
  terraform: circleci/terraform@1  
  
jobs:
  driftctl:
    executor: driftctl/default  
    environment:
      DCTL_NO_VERSION_CHECK: 'true'  
      DCTL_FILTER: "Type=='aws_instance'"  
    steps:
      - checkout # This step may be optional  
      - driftctl/install:  
          version: v0.6.0  
      - driftctl/scan  
  
workflows:  
  # This workflow schedules driftctl every 10 minutes  
  drift_monitoring:
    triggers:
      - schedule:  
          cron: "0,10,20,30,40,50 * * * *"  
          filters:  
            branches:
              only:  
                - master  
    jobs:
      - driftctl:  
          context: test-orb-driftctl  
  # The workflow below is an example to integrate driftctl in your GitOps pipeline  
  deploy_infrastructure:
    jobs:
      - driftctl:  
          context: test-orb-driftctl  
      - terraform/fmt:  
          checkout: true  
          context: test-orb-terraform  
      - terraform/validate:  
          checkout: true  
          context: test-orb-terraform  
          requires:  
            - terraform/fmt  
      - terraform/plan:  
          checkout: true  
          context: test-orb-terraform  
          persist-workspace: true  
          requires:  
            - terraform/validate  
            - driftctl  
      - approve:  
          type: approval  
          requires:  
            - terraform/plan  
      - terraform/apply:  
          attach-workspace: true  
          context: test-orb-terraform  
          requires:  
            - approve  

```

--------------------------------

### Driftctl Scan JSON Output Examples

Source: https://docs.driftctl.com/0.16.0/usage/cmd/scan-usage

Examples of how to direct driftctl scan results to a JSON file or standard output.

```bash
$ driftctl scan --output json:///tmp/result.json # Will output results to /tmp/result.json  
$ driftctl scan --output json://result.json # Will output results to ./result.json  
$ driftctl scan --output json://stdout # Will output results in json to stdout directly  
$ DCTL_OUTPUT=json://result.json driftctl scan  

```

--------------------------------

### JSON Output Structure Example

Source: https://docs.driftctl.com/0.40.0/usage/cmd/scan-usage

Example structure of the JSON output, detailing summary statistics, managed, unmanaged, and missing resources, along with coverage and provider information.

```json
{
  "summary": {
    "total_resources": 3,
    "total_unmanaged": 1,
    "total_missing": 1,
    "total_managed": 1,
    "total_iac_source_count": 1
  },
  "managed": [
    // list of resources found in IaC and in sync with remote
    {
      "id": "driftctl-bucket-test-1",
      "type": "aws_s3_bucket",
      "source": { // Source encapsulates metadata explaining where the resource is coming from within an IaC
        "source": "tfstate://terraform.tfstate", // Represents the Terraform state file
        "namespace": "module", // If you use Terraform module, it will be displayed here
        "internal_name": "my_name" // Represents the internal Terraform resource's name
      }
    }
  ],
  "unmanaged": [
    // list of resources found in remote but not in IaC
    {
      "id": "driftctl-bucket-test-3",
      "type": "aws_s3_bucket"
    }
  ],
  "missing": [
    // list of resources found in IaC but not on remote
    {
      "id": "driftctl-bucket-test-2",
      "type": "aws_s3_bucket"
    },
  ],
  "coverage": 33,
  "provider_name": "AWS",
  "provider_version": "2.18.5",
  // Scan duration in seconds
  "scan_duration": 27,
  "date": "2022-04-08T10:35:00Z"
}
```

--------------------------------

### Full CircleCI Workflow Example

Source: https://docs.driftctl.com/0.17.0/ci_cd/guides/circleci

A comprehensive CircleCI configuration demonstrating a GitOps workflow with driftctl and Terraform, including scheduled monitoring and deployment steps.

```yaml
version: '2.1'  
  
orbs:  
  driftctl: snyk/driftctl@1  
  terraform: circleci/terraform@1  
  
jobs:  
  driftctl:  
    executor: driftctl/default  
    environment:  
      DCTL_NO_VERSION_CHECK: 'true'  
      DCTL_FILTER: "Type=='aws_instance'"  
    steps:  
      - checkout # This step may be optional  
      - driftctl/install:  
          version: v0.6.0  
      - driftctl/scan  
  
workflows:  
  # This workflow schedules driftctl every 10 minutes  
  drift_monitoring:  
    triggers:  
      - schedule:  
          cron: "0,10,20,30,40,50 * * * *"  
          filters:  
            branches:  
              only:  
                - master  
    jobs:  
      - driftctl:  
          context: test-orb-driftctl  
  # The workflow below is an example to integrate driftctl in your GitOps pipeline  
  deploy_infrastructure:  
    jobs:  
      - driftctl:  
          context: test-orb-driftctl  
      - terraform/fmt:  
          checkout: true  
          context: test-orb-terraform  
      - terraform/validate:  
          checkout: true  
          context: test-orb-terraform  
          requires:  
            - terraform/fmt  
      - terraform/plan:  
          checkout: true  
          context: test-orb-terraform  
          persist-workspace: true  
          requires:  
            - terraform/validate  
            - driftctl  
      - approve:  
          type: approval  
          requires:  
            - terraform/plan  
      - terraform/apply:  
          attach-workspace: true  
          context: test-orb-terraform  
          requires:  
            - approve  

```

--------------------------------

### Install driftctl with MacPorts

Source: https://docs.driftctl.com/0.15.0/installation

Install driftctl on macOS using MacPorts. This command installs the community port for driftctl.

```bash
sudo port install driftctl
```

--------------------------------

### Install driftctl with Homebrew

Source: https://docs.driftctl.com/0.15.0/installation

Install driftctl on macOS using Homebrew, a popular package manager. This command installs the official driftctl formula.

```bash
brew install driftctl
```

--------------------------------

### Full GitLab CI Configuration Example

Source: https://docs.driftctl.com/0.15.0/ci_cd/guides/gitlabci

This snippet provides a comprehensive .gitlab-ci.yml configuration demonstrating a full GitOps workflow with driftctl and Terraform, including scheduled drift detection.

```yaml
stages:  
  - init  
  - validate  
  - plan  
  - deploy  

.driftctl:  
  image:  
    name: snyk/driftctl  
    entrypoint: [""]  
  script:  
    - driftctl scan  
  
# ====================  
# Scheduled driftctl run  
# ====================  
# Scheduled driftctl run  
driftctl:scheduled:  
  extends: .driftctl  
  only:  
    - schedules  
  stage: validate  
  variables:  
    AWS_DEFAULT_REGION: us-east-1  
    DCTL_FILTER: "Type=='aws_s3_bucket'"  
  
# ====================  
# Classic GitOps workflow  
# ====================  

# Used to share .terraform cached providers in terraform jobs  
.tfcache: &tfcache  
  cache:  
    key: ${CI_PIPELINE_ID}  
    paths:  
      - .terraform  
  
# Terraform image to use for every terraform jobs  
.terraform: &terraform  
  image:  
    name: hashicorp/terraform:0.14.4  
    entrypoint: [""]  
  
terraform/init:  
  <<: *terraform  
  <<: *tfcache  
  stage: init  
  except:  
    - schedules  
  script:  
    - terraform init  
  
driftctl:  
  extends: .driftctl  
  except:  
    - schedules  
  stage: validate  
  variables:  
    AWS_DEFAULT_REGION: us-east-1  
    DCTL_FILTER: "Type=='aws_s3_bucket'"  
  
terraform/fmt:  
  <<: *terraform  
  stage: validate  
  except:  
    - schedules  
  script:  
    - terraform fmt -check -diff  
  
terraform/validate:  
  <<: *terraform  
  <<: *tfcache  
  stage: validate  
  except:  
    - schedules  
  script:  
    - terraform validate  
  
terraform/plan:  
  <<: *terraform  
  <<: *tfcache  
  stage: plan  
  except:  
    - schedules  
  artifacts:  
    name: plan  
    expire_in: 1 day  
    paths:  
      - "plan.out"  
  script:  
    - terraform plan -out=plan.out  
  
terraform/apply:  
  <<: *terraform  
  <<: *tfcache  
  stage: deploy  
  when: manual  
  dependencies:  
    - terraform/plan  
  except:  
    - schedules  
  script:  
    - terraform apply plan.out  
  
```

--------------------------------

### Install driftctl to PATH

Source: https://docs.driftctl.com/0.15.0/installation

Optionally, move the executable to a directory in your system's PATH for global access. You may need sudo privileges.

```bash
# use any path that suits you, this is just a standard example. Install sudo if needed.  
$ sudo mv driftctl /usr/local/bin/  


```

--------------------------------

### Example Nil Pointer Crash Report Stacktrace

Source: https://docs.driftctl.com/0.15.0/usage/flags/crash-reporting

This is an example of a raw stacktrace generated from a nil pointer dereference error during a driftctl run.

```go
runtime.errorString: runtime error: invalid memory address or nil pointer dereference  
  File "/go/src/app/pkg/parallel_runner.go", line 93, in (*ParallelRunner).Run.func1.1  
  File "/go/src/app/pkg/remote/aws/s3_bucket_supplier.go", line 71, in readBucketRegion  
  File "/go/src/app/pkg/remote/aws/s3_bucket_inventory_supplier.go", line 42, in (*S3BucketInventorySupplier).Resources  
  File "/go/src/app/pkg/scanner.go", line 28, in (*Scanner).Resources.func1  
  File "/go/src/app/pkg/parallel_runner.go", line 97, in (*ParallelRunner).Run.func1  


```

--------------------------------

### Full CircleCI Workflow Example with driftctl

Source: https://docs.driftctl.com/0.16.0/ci_cd/guides/circleci

A comprehensive CircleCI configuration demonstrating a GitOps workflow with driftctl integration and a scheduled monitoring job.

```yaml
version: '2.1'  
  
orbs:  
  driftctl: snyk/driftctl@1  
  terraform: circleci/terraform@1  
  
jobs:
  driftctl:
    executor: driftctl/default  
    environment:
      DCTL_NO_VERSION_CHECK: 'true'  
      DCTL_FILTER: "Type=='aws_instance'"
    steps:
      - checkout # This step may be optional  
      - driftctl/install:  
          version: v0.6.0  
      - driftctl/scan  

workflows:
  # This workflow schedules driftctl every 10 minutes  
  drift_monitoring:
    triggers:
      - schedule:
          cron: "0,10,20,30,40,50 * * * *"  
          filters:
            branches:
              only:
                - master  
    jobs:
      - driftctl:
          context: test-orb-driftctl  
  # The workflow below is an example to integrate driftctl in your GitOps pipeline  
  deploy_infrastructure:
    jobs:
      - driftctl:
          context: test-orb-driftctl  
      - terraform/fmt:
          checkout: true  
          context: test-orb-terraform  
      - terraform/validate:
          checkout: true  
          context: test-orb-terraform  
          requires:
            - terraform/fmt  
      - terraform/plan:
          checkout: true  
          context: test-orb-terraform  
          persist-workspace: true  
          requires:
            - terraform/validate  
            - driftctl  
      - approve:
          type: approval  
          requires:
            - terraform/plan  
      - terraform/apply:
          attach-workspace: true  
          context: test-orb-terraform  
          requires:
            - approve  

```

--------------------------------

### AWS Least Privileged Policy Example

Source: https://docs.driftctl.com/0.18.0/providers/aws/authentication

Example of a least privileged IAM policy for AWS. Ensure this policy grants only the necessary permissions for your application.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "application-autoscaling:DescribeScalableTargets",
                "application-autoscaling:DescribeScalingPolicies",
                "application-autoscaling:DescribeScheduledActions",
                "autoscaling:DescribeLaunchConfigurations"
            ]
        }
    ]
}
```

--------------------------------

### driftctl Docker Usage Examples

Source: https://docs.driftctl.com/next/installation

Demonstrates various ways to run driftctl via Docker, including with local state, S3 backend state, multiple states, and named AWS profiles.

```bash
# With a local state  
$ docker run -t --rm \  
  -v $(pwd):/app:ro \  
  -v ~/.driftctl:/root/.driftctl \  
  -e AWS_ACCESS_KEY_ID=XXXXXXXX \  
  -e AWS_SECRET_ACCESS_KEY=XXXX \  
  snyk/driftctl scan  
  
# With state stored on a s3 backend  
$ docker run -t --rm \  
  -v $(pwd):/app:ro \  
  -v ~/.driftctl:/root/.driftctl \  
  -e AWS_ACCESS_KEY_ID=XXXXXXXX \  
  -e AWS_SECRET_ACCESS_KEY=XXXX \  
  snyk/driftctl scan --from tfstate+s3://my-bucket/path/to/state.tfstate  
  
# With multiple states  
$ docker run -t --rm \  
    -v $(pwd):/app:ro \  
    -v ~/.driftctl:/root/.driftctl \  
    -e AWS_ACCESS_KEY_ID=XXXXXXXX \  
    -e AWS_SECRET_ACCESS_KEY=XXXX \  
    snyk/driftctl scan --from tfstate://terraform_S3.tfstate --from tfstate://terraform_VPC.tfstate  
  
# Using a named profile  
$ docker run -t --rm \  
    -v ~/.aws:/root/.aws:ro \ # mount your aws config folder  
    -v $(pwd):/app:ro \  
    -v ~/.driftctl:/root/.driftctl \  
    -e AWS_PROFILE=your-profile \  
    snyk/driftctl scan  
```

--------------------------------

### AWS Least Privileged Policy Example

Source: https://docs.driftctl.com/0.40.0/providers/aws/authentication

Example of a least privileged IAM policy for S3, SNS, and SQS services. Ensure to only grant necessary permissions.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowS3ListAndDescribe",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketWebsite",
                "s3:GetEncryptionConfiguration",
                "s3:GetInventoryConfiguration",
                "s3:GetLifecycleConfiguration",
                "s3:GetMetricsConfiguration",
                "s3:GetReplicationConfiguration",
                "s3:ListAllMyBuckets",
                "s3:ListBucket",
                "sns:GetSubscriptionAttributes",
                "sns:GetTopicAttributes",
                "sns:ListSubscriptions",
                "sns:ListSubscriptionsByTopic",
                "sns:ListTagsForResource",
                "sns:ListTopics",
                "sqs:GetQueueAttributes",
                "sqs:ListQueues",
                "sqs:ListQueueTags"
            ]
        }
    ]
}
```

--------------------------------

### AWS Least Privilege Policy Example

Source: https://docs.driftctl.com/0.34.0/providers/aws/authentication

This snippet shows an example of a least privilege policy for AWS, specifying necessary permissions for DynamoDB and RDS operations.

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowDynamoDBAndRDSDescribeActions",
            "Effect": "Allow",
            "Action": [
                "dynamodb:ListTagsOfResource",
                "dynamodb:DescribeTimeToLive",
                "dynamodb:DescribeTableReplicaAutoScaling",
                "dynamodb:DescribeContinuousBackups",
                "rds:DescribeDBClusters",
                "rds:DescribeGlobalClusters",
                "application-autoscaling:DescribeScalableTargets",
                "application-autoscaling:DescribeScalingPolicies",
                "application-autoscaling:DescribeScheduledActions",
                "autoscaling:DescribeLaunchConfigurations",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeListeners"
            ]
        }
    ]
}
```

--------------------------------

### JSON Output Structure Example

Source: https://docs.driftctl.com/0.23.0/usage/cmd/scan-usage

Example structure of the JSON output, detailing summary statistics, managed, unmanaged, missing resources, and differences found during the scan.

```json
{
  "summary": {
    "total_resources": 3,
    "total_changed": 1,
    "total_unmanaged": 1,
    "total_missing": 1,
    "total_managed": 1,
    "total_iac_source_count": 1
  },
  "managed": [
    // list of resources found in IaC and in sync with remote
    {
      "id": "driftctl-bucket-test-1",
      "type": "aws_s3_bucket",
      "source": { // Source encapsulates metadata explaining where the resource is coming from within an IaC
        "source": "tfstate://terraform.tfstate", // Represents the Terraform state file
        "namespace": "module", // If you use Terraform module, it will be displayed here
        "internal_name": "my_name" // Represents the internal Terraform resource's name
      }
    }
  ],
  "unmanaged": [
    // list of resources found in remote but not in IaC
    {
      "id": "driftctl-bucket-test-3",
      "type": "aws_s3_bucket"
    }
  ],
  "missing": [
    // list of resources found in IaC but not on remote
    {
      "id": "driftctl-bucket-test-2",
      "type": "aws_s3_bucket"
    },
  ],
  "differences": [
    // A list of changes on managed resources
    {
      "res": {
        "id": "driftctl-bucket-test-1",
        "type": "aws_s3_bucket"
      },
      "changelog": [
        {
          "type": "update", // Kind of change, could be one of update, create, delete
          "path": [
            // Path of the change, sorted from root to leaf
            "Versioning",
            "0",
            "Enabled"
          ],
          "from": false, // Mixed type
          "to": true // Mixed type
        }
      ]
    }
  ],
  "coverage": 33,
  "provider_name": "AWS",
  "provider_version": "2.18.5",
  // Scan duration in seconds
  "scan_duration": 27
}

```

--------------------------------

### Full Jenkinsfile Example for GitOps Workflow

Source: https://docs.driftctl.com/0.19.0/ci_cd/guides/jenkins

This Jenkinsfile orchestrates a complete GitOps workflow, including driftctl scanning, Terraform operations, and deployment. It requires AWS credentials to be configured in Jenkins.

```groovy
# ====================  
# Classic GitOps workflow  
# ====================  
  
pipeline {  
	agent any  
	environment {  
		AWS_DEFAULT_REGION="us-east-1"  
		AWS_ACCESS_KEY_ID=credentials("AWS_ACCESS_KEY_ID")  
		AWS_SECRET_ACCESS_KEY=credentials("AWS_SECRET_ACCESS_KEY")  
		PATH="$PATH:$HOME/dctlenv/bin/"  
	}  
	stages {  
		stage("Init") {  
			steps {  
				sh "terraform init"  
			}  
		}  
		stage('Validate') {  
			failFast true  
			parallel {  
				stage("driftctl") {  
					steps {  
						sh "which dctlenv || git clone https://github.com/wbeuil/dctlenv"  
						sh "dctlenv use latest"  
						sh "driftctl scan"  
					}  
				}  
				stage("terraform/fmt") {  
					steps {  
						sh "terraform fmt -check -diff"  
					}  
				}  
				stage("terraform/validate") {  
					steps {  
						sh "terraform validate"  
					}  
				}  
			}  
		}  
		stage("Plan") {  
			steps {  
				sh "terraform plan -out=plan.out"  
			}  
		}  
		stage("Deploy") {  
			steps {  
				sh "terraform apply -input=false plan.out"  
			}  
		}  
	}  
}  
  

```

--------------------------------

### Download driftctl, checksums, and signature for verification

Source: https://docs.driftctl.com/0.15.0/installation

Download the binary, checksums, and signature files to verify the integrity and authenticity of the release.

```bash
# Download binary, checksums and signature  
$ curl -L https://github.com/snyk/driftctl/releases/latest/download/driftctl_linux_amd64 -o driftctl_linux_amd64  
$ curl -L https://github.com/snyk/driftctl/releases/latest/download/driftctl_SHA256SUMS -o driftctl_SHA256SUMS  
$ curl -L https://github.com/snyk/driftctl/releases/latest/download/driftctl_SHA256SUMS.gpg -o driftctl_SHA256SUMS.gpg  


```

--------------------------------

### Example Telemetry Data

Source: https://docs.driftctl.com/0.16.0/usage/flags/disable-telemetry

This is an example of the telemetry data that driftctl collects by default. It includes version, OS, architecture, resource counts, duration, and provider name.

```json
{
    "version": "0.7.1",
    "os": "linux",
    "arch": "amd64",
    "total_resources": 100,
    "total_managed": 10,
    "duration": 300, // analysis time in seconds
    "provider_name": "aws"
}

```

--------------------------------

### Install Fish Completion Script

Source: https://docs.driftctl.com/0.16.0/usage/cmd/completion-usage

Generate the completion script for Fish and save it to the appropriate completions directory. Ensure the directory exists before saving the file. A new shell is needed to test.

```bash
$ driftctl completion fish > ~/.config/fish/completions/driftctl.fish  

```

--------------------------------

### Example Telemetry Data

Source: https://docs.driftctl.com/0.19.0/usage/flags/disable-telemetry

This is an example of the telemetry data that driftctl collects by default. It includes version, OS, architecture, resource counts, analysis duration, and provider name.

```json
{
    "version": "0.7.1",
    "os": "linux",
    "arch": "amd64",
    "total_resources": 100,
    "total_managed": 10,
    "duration": 300, // analysis time in seconds
    "provider_name": "aws"
}
```
Tokens:
Raw