Comparison
Drift detectionvsInfrastructure drift
Drift detection
a nightly job plans against production and tells you that fourteen things no longer match the code, before the next deploy does.
Running the comparison on a schedule purely to report divergence, without applying anything. It converts drift from a surprise discovered during an unrelated change into a routine signal, which is the whole point. It is also a useful security control, since an unexpected difference in a security group or a role is exactly what an unauthorised change looks like.
Full entry →Infrastructure drift
somebody fixed it in the console during an incident, and the next apply politely undid the fix.
Divergence between what the code declares and what actually exists, caused by manual changes, other automation or the provider itself. It is inevitable in any estate humans can still reach, and its danger is not the change itself but the next apply, which will reconcile it away without anyone connecting the two events. The incident-time console fix is the classic instance and the reason a follow-up code change belongs in the incident's action list.
Full entry →