tfdrift Now Supports Microsoft Teams and OpsGenie Alerts

Quick update on tfdrift - the open-source Terraform drift detection CLI.

The most common feedback I've been getting since the Terraform Weekly feature: "We don't use Slack. Can you support Teams?" and "Our on-call runs through OpsGenie, not PagerDuty." Fair enough. v0.5.0 ships both.

Microsoft Teams Notifications

tfdrift can now send drift alerts directly to Microsoft Teams channels via webhooks:

tfdrift scan --path ./infrastructure --teams-webhook $TEAMS_WEBHOOK_URL

Or configure it in your .tfdrift.yml:

notifications:
  teams:
    webhook_url: ${TEAMS_WEBHOOK_URL}
    min_severity: high

The alerts use Teams' MessageCard format with severity-colored headers - red for Critical, orange for High, blue for Medium. Each card includes a summary section with workspace count, drift count, and severity breakdown, plus up to 10 drifted resources with their details.

Setting up the webhook takes about 2 minutes: go to your Teams channel → Connectors → Incoming Webhook → copy the URL. That's it.

OpsGenie Notifications

For teams running on-call through OpsGenie instead of PagerDuty:

tfdrift scan --path ./infrastructure --opsgenie-key $OPSGENIE_API_KEY

Or in config:

notifications:
  opsgenie:
    api_key: ${OPSGENIE_API_KEY}
    region: us   # or eu
    min_severity: critical

Drift severity maps directly to OpsGenie priority levels:

• Critical → P1
• High → P2
• Medium → P3
• Low → P4

This means your existing OpsGenie routing rules and escalation policies work automatically - a P1 drift alert gets the same treatment as any other P1 incident. Both US and EU OpsGenie regions are supported.

The Notification Stack So Far

With v0.5.0, tfdrift now supports five notification targets:

• Slack - webhooks with severity-filtered messages
• PagerDuty - Events API v2 with severity-to-priority mapping
• Microsoft Teams - MessageCard format with colored severity headers
• OpsGenie - Alert API with P1-P4 priority mapping, US/EU regions
• Generic webhooks - POST JSON to any HTTP endpoint

All of them support min_severity filtering - so you can send Critical drift to OpsGenie/PagerDuty for paging, High drift to Teams/Slack for awareness, and log everything else to JSON for weekly review.

# Example: multi-channel notification routing
notifications:
  opsgenie:
    api_key: ${OPSGENIE_API_KEY}
    min_severity: critical   # Page on-call for critical only
  teams:
    webhook_url: ${TEAMS_WEBHOOK_URL}
    min_severity: high       # Team channel for high+
  slack:
    webhook_url: ${SLACK_WEBHOOK_URL}
    min_severity: medium     # Broader visibility

This is the kind of severity-based routing that turns drift detection from a noisy alert into an operational workflow.

What's Next

The two features I keep hearing about: environment-conditional severity (same change = Critical in prod, Low in dev) and value-aware classification (inspecting what an attribute changed to, not just that it changed). Both are on the roadmap.

If you're using tfdrift and have opinions on what would make it more useful for your team, I'd love to hear about it.

pip install tfdrift --upgrade

GitHub: github.com/sudarshan8417/tfdrift

This is part of an ongoing series on infrastructure drift detection. tfdrift was recently featured in Terraform Weekly #279 by Anton Babenko (AWS Hero).