DriftArmor CLI

Local implement coach for Azure Terraform plans (check), plus a destructive-change gate on plan JSON (drift). Wraps Checkov custom policies for check and prints citation checklists with exit codes.

Active check packs (report order): AKS → Azure SQL → SQL Managed Instance → Storage → Managed Redis → Key Vault → ACR → Service Bus → VM → NSG → Front Door. drift groups the same way (plus Other for unmatched types).

Product / marketing site: driftarmor.net

drift is not live cloud drift detection. It classifies resource_changes from terraform show -json (create/update/delete/replace). It does not call Azure/AWS/GCP APIs or find unmanaged resources.

Install

pip install driftarmor

Requires Python 3.11+.

From source (contributors)

git clone https://github.com/kodias/driftarmor-cli.git
cd driftarmor-cli
python3 -m venv .venv
source .venv/bin/activate
pip install -e ".[dev]"

checkov is a package dependency; pip install -e . is enough for a local editable install.

Usage

driftarmor -v
driftarmor --version

# From a Terraform module directory (runs init + plan + show -json; terraform on PATH)
driftarmor check --dir .
driftarmor drift --dir ./infra

# Existing show -json file
driftarmor check --plan plan.json
driftarmor check --plan plan.json --json
driftarmor check --plan plan.json --no-color

# Binary plan file from `terraform plan -out=tfplan` (runs show -json)
driftarmor check --plan tfplan
driftarmor drift --plan tfplan --json

# Or export JSON yourself
terraform plan -out=tfplan
terraform show -json tfplan > plan.json
driftarmor check --plan plan.json

Human output uses green / yellow / red on TTY. Colors disable when stdout is not a TTY, when NO_COLOR is set, or with --no-color. --json never uses ANSI.

Large plan files are loaded fully into memory (same as check).

Exit codes

Fixtures

driftarmor check --plan fixtures/aks-plan/fail.json          # exit 1
driftarmor check --plan fixtures/storage-plan/pass.json      # exit 0
driftarmor check --plan fixtures/sql-plan/fail.json          # exit 1
driftarmor check --plan fixtures/sqlmi-plan/pass.json        # exit 0
driftarmor check --plan fixtures/redis-plan/pass.json        # exit 0
driftarmor check --plan fixtures/keyvault-plan/fail.json     # exit 1
driftarmor check --plan fixtures/acr-plan/pass.json          # exit 0
driftarmor check --plan fixtures/servicebus-plan/fail.json   # exit 1
driftarmor check --plan fixtures/vm-plan/fail.json           # exit 1
driftarmor check --plan fixtures/nsg-plan/pass.json          # exit 0
driftarmor check --plan fixtures/frontdoor-plan/fail.json    # exit 1
driftarmor drift --plan fixtures/drift-plan/replace.json     # exit 1
pytest

Providers

• check — Checkov policy packs (auto-detected from plan resources):
  • AKS — azurerm_kubernetes_cluster (+ node pools)
  • Azure SQL — azurerm_mssql_server / _database / _firewall_rule
  • SQL Managed Instance — azurerm_mssql_managed_instance
  • Storage — azurerm_storage_account (HTTPS, TLS, public blobs, network)
  • Managed Redis — azurerm_managed_redis
  • Key Vault — azurerm_key_vault (RBAC, purge protection, network)
  • ACR — azurerm_container_registry (local auth, anonymous pull, network)
  • Service Bus — azurerm_servicebus_namespace (auth, TLS, inline network rules)
  • VM — azurerm_linux_virtual_machine / azurerm_windows_virtual_machine
  • NSG — azurerm_network_security_group / azurerm_network_security_rule
  • Front Door — azurerm_cdn_frontdoor_profile / _firewall_policy / _security_policy
• drift — provider-agnostic plan-diff (any Terraform plan JSON); Service Bus queues, topics, subscriptions, and legacy standalone network rules are grouped with the Service Bus product even though they do not activate namespace checks

AKS

Azure SQL

SQL Managed Instance

Storage

Managed Redis

Key Vault

Azure Container Registry

Service Bus

Virtual Machines

Network Security Groups

Front Door

Founder dogfood

Track misses while using this on real plans: wedge-miss-list.md.