What is Terraform state drift and how do you handle it?

State drift occurs when the real infrastructure differs from what Terraform state believes it to be — typically due to manual changes made in the AWS console or another tool.

Detection: terraform plan will show changes that seem unexpected.

Resolution options:

1. Import: terraform import to import manually created resources into state.
2. Refresh: terraform refresh to update state to match reality (deprecated in favor of plan -refresh-only).
3. Accept drift: Use lifecycle { ignore_changes = [...] } for intentionally externally-managed attributes.

Prevention: Forbid all manual console access to production environments using IAM SCPs.