Daily Terragrunt Drift Detection with Detailed Exit Codes

Infrastructure drifts, someone clicks in a console, a provider changes a default, a hotfix never lands in the repo. This blueprint turns terragrunt run-all plan -detailed-exitcode into a daily watchdog for the whole estate. Terraform's detailed exit code contract is precise: 0 means no changes, 1 means an error, 2 means the plan found pending changes. The flow captures that code instead of letting it fail the task, publishes it through Kestra's outputs protocol, and branches on it, Discord hears about drift, a clean estate stays quiet, and a broken check raises its own distinct alert.

The demo estate ships inline through inputFiles with two local_file units, so the flow runs without cloud credentials. Because the demo starts from empty state, the very first execution reports drift by design, which conveniently proves the alert path works.

How it works

1. detect_drift (io.kestra.plugin.terragrunt.cli.TerragruntCLI) materializes the repo layout and runs terragrunt run-all plan --non-interactive --working-dir live -detailed-exitcode, capturing the log to plan.log.
2. The command's exit code is caught with || ec=$? so exit code 2 never fails the task, then emitted through the outputs protocol as {{ outputs.detect_drift.vars.plan_exit }}.
3. Exit code 1 is re-raised as a real failure, so an estate that cannot be planned lands in the errors block instead of masquerading as drift.
4. evaluate_drift (io.kestra.plugin.core.flow.If) branches on the code: alert_drift posts to Discord when it equals 2, log_clean writes a quiet all-clear otherwise.
5. A disabled-by-default Schedule trigger runs the check daily at 06:00.

What you get

• A binary, machine-readable drift signal per run instead of a human eyeballing plan text.
• Alerts only when there is something to act on, a clean estate produces no noise.
• The full plan.log artifact attached to every execution for immediate triage.
• A clear separation between "the estate drifted" and "the drift check broke".

Who it's for

• Platform teams who apply through pipelines but still get bitten by console changes.
• Compliance-minded organizations that need scheduled evidence the deployed estate matches the repo.
• On-call engineers who want drift to page a channel, not hide in a cron log.

Why orchestrate this with Kestra

A cron job running run-all plan can tell you the exit code, but nothing else: no history of when drift started, no stored plan output, no alert routing, no distinction between drift and breakage. Kestra keeps every check as an execution with its log artifact, exposes the exit code as structured output for branching, routes drift and failure to different messages, and the schedule, the check, and the alerting live in one reviewable YAML file.

Prerequisites

• A Discord incoming webhook for drift and failure alerts.
• No cloud credentials are needed for the demo. For a real estate, point the flow at your repository with namespaceFiles or a Git clone, use your real remote state, and pass provider credentials through the task env from {{ secret('...') }}.

Secrets

• DISCORD_WEBHOOK_URL: Discord incoming webhook URL.

Quick start

1. Add the DISCORD_WEBHOOK_URL secret to your Kestra namespace.
2. Execute the flow once, the demo starts from empty state, so Discord receives the drift alert and proves the path works.
3. Point the task at your real repository and state, then set disabled: false on the daily trigger.

How to extend

• Replace the inline inputFiles with namespaceFiles so the check runs against your real repository from namespace storage.
• Feed plan.log to an AI summarization task so the Discord alert says what drifted, not just that something did.
• Open a ticket automatically on drift by swapping the Discord task for a Jira or GitHub issue task.
• Run the check per environment folder by parameterizing --working-dir, as shown in the Terragrunt environment promotion blueprint.

Links

• Terragrunt plugin documentation
• Terragrunt documentation