🚨 OpenTofu Error: 'Objects have changed outside of OpenTofu' — Cause, Fix, and Troubleshooting Guide

Overview

At the start of tofu plan, OpenTofu refreshes state against the real infrastructure. If something changed the resources outside of OpenTofu — a console edit, another tool, an autoscaler — it reports the drift so you can decide whether to reconcile config or overwrite the change:

Note: Objects have changed outside of OpenTofu

OpenTofu detected the following changes made outside of OpenTofu since the last
"tofu apply" which may have affected this plan:

  # aws_instance.web has changed
  ~ resource "aws_instance" "web" {
      ~ instance_type = "t3.small" -> "t3.medium"
        id            = "i-0abc123"
    }

Unless you have made equivalent changes to your configuration, or ignored the
relevant attributes using ignore_changes, the following plan may include
actions to undo or respond to these changes.

Symptoms

• tofu plan prints Objects have changed outside of OpenTofu and lists drifted attributes.
• The subsequent plan proposes to revert those changes back to your config.
• Recurs every plan when another system keeps mutating the resource.
• Often surprises teams after a manual hotfix in a cloud console.

Common Root Causes

• Manual console edits — someone changed the resource directly.
• Another tool (a script, an operator, autoscaling) mutating the same object.
• Provider default drift — a server-side default changed under the resource.
• Out-of-band tags/policies applied by org automation.
• Config never updated to reflect an intentional real-world change.

How to diagnose

Refresh-only to see drift without changing anything:

tofu plan -refresh-only

Compare the live object to state for the drifted resource:

tofu state show aws_instance.web

Decide direction: does config need to catch up, or should OpenTofu revert the change?

tofu plan   # shows the actions that would reconcile

Fixes

Accept the real change by updating config to match, so the plan is a no-op:

resource "aws_instance" "web" {
  instance_type = "t3.medium"   # was t3.small; matches reality now
}

Record drift into state without altering infrastructure:

tofu apply -refresh-only

Overwrite the drift — if config is the source of truth, just apply and OpenTofu reverts it:

tofu apply

Stop fighting a system that owns the attribute with ignore_changes:

resource "aws_instance" "web" {
  lifecycle {
    ignore_changes = [instance_type]   # autoscaler owns this
  }
}

What to watch out for

• “Objects have changed outside” is a Note, not a hard error — but ignoring it means the next apply may revert real changes.
• Use ignore_changes only for attributes another system legitimately owns; overusing it hides real drift.
• Restrict console write access so infrastructure changes flow through OpenTofu.
• -refresh-only is the safe way to inspect and record drift before deciding.

Related

• OpenTofu Error: ‘Provider produced inconsistent final plan’ — Cause, Fix, and Troubleshooting Guide
• OpenTofu Error: ‘Resource already exists’ — Cause, Fix, and Troubleshooting Guide
• OpenTofu Error: ‘Error acquiring the state lock’ — Cause, Fix, and Troubleshooting Guide