terraform plan is great at one thing: telling you how your managed resources have drifted from your config. But it has a blind spot baked into its design — it only knows about resources that are in your state file. A security group someone spun up in the console, an RDS instance a teammate created with the CLI, an S3 bucket left behind by a deleted stack: plan will never mention any of them, because as far as Terraform is concerned, they don't exist. For a drift detector that's a ...