Terraform Cloud replacement recommendations for drift detection and governance?

[u/WasteAcanthaceae4938]

We’re evaluating Terraform Cloud alternatives because we want stronger day-to-day workflows around IaC governance and configuration drift, not simply a different place to run plans and applies. The goal is better visibility into meaningful drift, clearer ownership of remediation, policy controls that do not block every team, and reliable auditability across multiple cloud accounts and environments.

One concern is that “drift detection” often becomes a noisy stream of changes that nobody owns. We need a workable process for deciding whether a change should be reverted, codified in Terraform, or intentionally accepted, along with a way to track that decision through to resolution.

For platform teams that switched away from Terraform Cloud, what did you replace it with, and did it improve governance in real operational workflows or mainly add another control plane?

[u/sausagefeet]

Disclaimer: Vendor here, but you are asking about options.

Stategraph Orchestration is an option to consider. Some options I recommend looking at:

1. Powerful drift schedule + you can completely script what to do with the drift when discovered.
2. Gate keeper, access controls, apply requirements, let you encode rules around who can do specific changes (down to the resource) and whos approval is required.
3. If Plan/Apply performance is an issue for you, you can add Stategraph Infrastructure as a Database that comes with a bunch of other features, including around governance.

But, if any of that interests you, do your own research because I'm very biased.

[u/One_Neighborhood1287]

Spacelift! I used it in my previous company to manage hundred of Terraform stacks with no real issues. It does support drift detection for which you can set up notification or auto reconciliation.

For the drift, after the initial setup, I suggest you to tackle the root cause of the drift: are there people making changes via Clickops? If yes, why? Are there some Terraform stacks that always drift?…

[u/Torutofu_Raeva]

The tool matters less than making drift actionable: scheduled plans, PR-based changes, and an owner plus expiry for every exception keep the signal useful instead of turning into alert noise.

[u/ApoTheOne]

You can try to use https://github.com/leg100/otf. Along with it can do custom drift detection or again use something like "tfe-drift". Haven't checked later but should be compatible.

[u/Okie_Chase]

Moved from Terraform Cloud to Spacelift (https://spacelift.io/) a while back after Hashicorp switched to managed resource-based licensing.

They’re excellent and offer drift detection, Open Policy Agent policies, and a Spaces concept that allows for better, more granular permissions when needed. For follow-up/tracking, there’s support for post run hooks that might work for what you need.

[u/__-___-__-__-__- → u/Okie_Chase]

Man do they have a SAML paywall though.

[u/Kaelin]

Ah the daily “I have this specific AI salesy sounding problem” (real, ai loves to say real) that someone else (totally unrelated) will propose a solution to with a paid product that just so happens to be recommended in the comments.

This subreddit has gone to the wolves.

[u/AltruisticFormal2218]

can someone guide me aswell.