Why Terraform is green when your cloud is broken

Terraform can show a clean plan even when cloud resources have drifted outside IaC.

In the case described, a manually edited S3 bucket policy differed from Terraform config and later triggered 403 errors.

Terraform state is only a snapshot from the last apply, so console edits and some service-managed changes can go unnoticed.

Teams that rely on Terraform alone may miss breaking drift or security issues in AWS infrastructure.