Loading...
Quick Definition
Drift detection identifies when the actual state of infrastructure diverges from its declared configuration in code. Common in Infrastructure as Code workflows, it flags manual changes or unmanaged resources that can cause inconsistency, security gaps, or untracked cost.
Drift detection identifies differences between your infrastructure as defined in code and what actually exists in the cloud. When someone changes a setting manually in the console, the live environment drifts away from its Infrastructure as Code definition.
Drift is dangerous because it is invisible until it bites: the next code deployment can silently undo an urgent manual fix, security settings can be loosened outside review, and untracked resources can run up costs nobody is accounting for. Tools like Terraform compare desired state against reality and report every difference, turning drift from a mystery into a list.
Example. During an incident, an engineer manually doubles a database's size. Months later, a routine Terraform apply shrinks it back, causing a slowdown nobody connects to the deploy for hours. Drift detection after the incident would have flagged the mismatch the same week.
Drift detection enforces the GitOps promise that code is the source of truth. The Infrastructure as Code explainer covers the foundation.
Manual console changes, emergency fixes never backported to code, automation outside the IaC pipeline, and provider-side changes.
Continuously or at least daily in mature setups, and always before applying new infrastructure changes.
All unrecorded drift is risky. Legitimate urgent changes are fine if they are detected and folded back into code quickly.