[nerdjon]

Oh yeah, drift detection is very limited. However being able to run it periodically and trigger an alarm from a central service (going back to my first point) without needing access to the repo is a major plus.

With Terraform (unless there is functionality I am unaware of) you need the repo where the terraform is stored to be able to perform that check. Then you need to setup the system that does the periodic checks (yes I know a cron in CI is barely any work if thats your desire).

Ultimately like a lot of things, CloudFormation VS Terraform is a long list of tradeoffs. I just would not personally write off CloudFormation depending on I actually need.