Terraform is declarative, meaning: The stuff you write into the terraform files (TF) is exactly the stuff you get configured. Example: you add a new database a

Terraform is declarative, meaning: The stuff you write into the terraform files (TF) is exactly the stuff you get configured. Example: you add a new database and a database user to the TF files, run terraform plan & apply, you do have the database and user configured. You remove the user and run plan & apply, terraform does remove the user. It goes the other way too: if you add additional port rules to a network security group (e.g. in AWS) by hand, terraform will remove them when plan & apply because they are not defined in the TF files. So in conclusion: for your declared state, there will be no drift.