Infrastructure drift is a difference to investigate before the next apply, not an instruction to overwrite whatever is running. A manual change might be accidental, an approved emergency repair, or a sign that the wrong workspace or account is being inspected. The first useful deliverable is a decision about intent.
This guide is for teams reviewing infrastructure-as-code operations, including readers in Canada. Its workflow is illustrative technical guidance, not an account of a delivered client project, a claim about Canadian infrastructure requirements or a substitute for an environment-specific change procedure.
Establish which environment you are reviewing
Identify the repository revision, workspace, provider configuration, account or subscription, region where applicable, and remote-state backend. Confirm that the credentials can inspect the intended environment. A plausible-looking plan from the wrong context is still the wrong evidence.
Find the relevant incident or change record before classifying a difference. Record who changed the resource, why, and whether the change was temporary. Avoid copying secrets from state or provider responses into tickets or article-like reports; those records may be widely visible.
Do not start by disabling refresh to obtain a clean-looking result. An absence of newly observed differences under a restricted observation path does not establish that infrastructure matches the intended configuration.
Separate observation from desired configuration
Terraform's plan command documentation distinguishes normal planning from refresh-only mode. A refresh-only plan is intended to propose state and output updates reflecting remote changes; it does not, by itself, decide that those remote changes should become the desired configuration.
The resource drift tutorial demonstrates reviewing changes made outside Terraform. Use the documentation appropriate to the installed version and workflow. Do not assume that one command observes every unmanaged resource, unsupported attribute or dependency in an account.