Open Source Summit Korea 2026

Terraform is widely used to manage infrastructure as code, but traditional drift detection relies on periodic scans or manual checks such as terraform plan. This approach often fails to detect real-time changes, manual modifications, or unauthorized actions.

In this technical feature demonstration, we present an open source approach to drift detection using an event-driven model powered by Falco.

We will demonstrate how:

infrastructure is provisioned using Terraform
manual or out-of-band changes introduce drift
Falco detects these changes in real time via event streams
an open source tool analyzes and surfaces these events as actionable drift signals

Unlike traditional drift detection tools, this approach enables near real-time detection, user attribution, and continuous visibility into infrastructure changes.

This session introduces the concept of “event-driven runtime drift” and shows how it complements Terraform-based workflows using open source technologies.

The demo is based on a publicly available open source project, allowing attendees to reproduce the setup and apply it to their own environments.