The problem Every time terraform plan showed drift, I'd see something like this: ~ aws_security_group.web will be updated in-place ~ ingress = [ { from_port = 22 protocol = "tcp" to_port = 22 }, ] Terraform tells you what changed. It tells you nothing about who changed it, when, or how. So I'd open the AWS Console, navigate to CloudTrail, set the time range, filter by resource, scroll through dozens of unrelated events, and eventually find the culprit — 20 minutes later. Every. Single. Time. What I built tf-why — a CLI that pipes terraform show -json output directly into AWS CloudTrail and gives you attribution in seconds.…