Q: A terraform apply is failing due to configuration drift, but the underlying infrastructure is live and mission-critical. How do you reconcile state and fix the drift without causing downtime?

Immediately create a backup snapshot of the current remote state file before running any write operations. Run `terraform plan` and analyze every resource flagged with `~` (update in-place), `+` (create), and especially `-` or `- / +` (destroy and recreate).

# Backup remote state
terraform state pull > terraform-state-backup-$(date +%s).json
# Run targeted speculative plan without touching live infrastructure
terraform plan -detailed-exitcode -out=tfplan.binary
terraform show -json tfplan.binary > plan_analysis.json

If Terraform plans to destroy and recreate a live resource, identify the argument forcing recreation (e.g. changing an EC2 AMI, RDS storage type, or VPC subnet CIDR). Add `lifecycle { create_before_destroy = true }` or `lifecycle { ignore_changes = [ ... ] }` in your HCL code to block destructive replacements.

# Prevent accidental destruction of live databases/clusters
lifecycle {
  prevent_destroy = true
  ignore_changes = [
    tags["LastModified"],
    allocated_storage,
    security_groups
  ]
}

Run `terraform apply -refresh-only` (in Terraform 1.1+) to update Terraform's state file with real-world infrastructure attributes without applying configuration changes. Once state matches cloud reality, inspect the diff and update your Terraform HCL code to mirror the live configuration.

# Inspect and approve state refresh safely
terraform apply -refresh-only
# Update HCL code to match newly refreshed attributes

Once HCL matches live state, run `terraform plan` to confirm that the diff is zero (`No changes. Your infrastructure matches the configuration`). If minor unmanaged resources exist, adopt them cleanly using `terraform import`.