# Terraform: "Objects have changed outside of Terraform" is information, not an error

## What you are seeing

```
Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # aws_instance.web has changed
  ~ instance_type = "t3.micro" -> "t3.small"
```

Someone or something changed the infrastructure without Terraform: console clicks, another tool, autoscaling, a teammate. Terraform noticed during refresh and is telling you before planning.

## First response

1. Read the note. For each changed object, decide: was this change legitimate (then update config to match), or rogue (then let the next apply revert it)?
2. Legitimate change: update the config to the real value so the plan goes clean. Config should describe reality.
3. Rogue change: do nothing special. The plan will show Terraform reverting it; review that the revert is what you want before applying.
4. Changes you cannot explain are an incident signal: unknown actors modifying infra. Find out who before applying anything.

## Rules for agents

1. Never suppress this with `-refresh=false` to make plans "clean". That hides reality; the drift is still there and the apply will still fight it.
2. Do not blindly apply to "fix" drift without reading what the plan reverts. Reverting a legitimate hotfix made during an incident re-breaks the incident.
3. Frequent drift on the same resource means something is managing it outside Terraform (autoscaler, external controller). Either bring that system under Terraform or add a scoped `ignore_changes`, with a comment saying why.
4. After reconciling, the plan should be empty or contain only intended changes. That is your verification.