Terraform: "Objects have changed outside of Terraform" is information, not an error

TL;DR: The drift note after refresh is not a failure. It lists real-world changes Terraform noticed. Read the note. Config should describe reality.

What you are seeing

Note: Objects have changed outside of Terraform

Terraform detected the following changes made outside of Terraform since the
last "terraform apply" which may have affected this plan:

  # aws_instance.web has changed
  ~ instance_type = "t3.micro" -> "t3.small"

Someone or something changed the infrastructure without Terraform: console clicks, another tool, autoscaling, a teammate. Terraform noticed during refresh and is telling you before planning.

First response

1. Read the note. For each changed object, decide: was this change legitimate (then update config to match), or rogue (then let the next apply revert it)?
2. Legitimate change: update the config to the real value so the plan goes clean. Config should describe reality.
3. Rogue change: do nothing special. The plan will show Terraform reverting it; review that the revert is what you want before applying.
4. Changes you cannot explain are an incident signal: unknown actors modifying infra. Find out who before applying anything.

Rules for agents

1. Never suppress this with -refresh=false to make plans "clean". That hides reality; the drift is still there and the apply will still fight it.
2. Do not blindly apply to "fix" drift without reading what the plan reverts. Reverting a legitimate hotfix made during an incident re-breaks the incident.
3. Frequent drift on the same resource means something is managing it outside Terraform (autoscaler, external controller). Either bring that system under Terraform or add a scoped ignore_changes, with a comment saying why.
4. After reconciling, the plan should be empty or contain only intended changes. That is your verification.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Terraform.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Terraform behavior.

Refresh detects external changes and reports them as a note listing changed objects before the plan; -refresh=false skips this. Verified against live plan/apply docs 2026-09-26. Verified against live docs 2026-09-26.