v3.2.0 · MIT

Diff your infrastructure before it diffs you.

tern compares declared state against running state across every cloud you use, and tells you what drifted in one screen instead of twelve consoles.

Install Read the docs

~/infrazsh

$ tern diff --env prod
# 3 resources drifted, 214 in sync
~ aws_security_group.edge   ingress 0.0.0.0/0 added
~ gcp_bucket.logs           retention 30d -> 7d
- azure_vm.batch-04         deleted outside tern

Install

One binary, no runtime

Homebrew Cargo Binary

macOS and Linuxsh

brew install tern

from sourcesh

cargo install tern --locked

verify the checksumsh

curl -LO https://example.com/tern-3.2.0.tar.gz
sha256sum -c tern-3.2.0.tar.gz.sha256

Benchmarks

Measured on 12,000 resources

Median of ten runs, cold cache, same machine.
Tool	Full diff	Memory	Clouds
tern 3.2	4.1s	88 MB	AWS, GCP, Azure
Provider plan	61s	1.4 GB	One at a time
Custom scripts	—	—	Whatever you wrote

Read-only by default

tern never writes. Credentials need list and describe, nothing else.

Exit codes for CI

0 in sync, 2 drift found, 1 error. Put it in a pipeline and it gates.

Machine output

--format json for everything, with a stable schema across minors.