Comparison
Drift detectionvsPlan and apply
Drift detection
a nightly job plans against production and tells you that fourteen things no longer match the code, before the next deploy does.
Running the comparison on a schedule purely to report divergence, without applying anything. It converts drift from a surprise discovered during an unrelated change into a routine signal, which is the whole point. It is also a useful security control, since an unexpected difference in a security group or a role is exactly what an unauthorised change looks like.
Full entry →Plan and apply
the tool prints exactly what it will create, change and destroy, and you read the destroy list before typing yes.
The two-phase model of declarative infrastructure tooling: compute the difference between desired and recorded state and show it, then execute it. The plan is the single most valuable safety feature in the category, and reviewing it — particularly the replacements and deletions — is the actual control. A plan is only as good as its freshness, since anything that changes between planning and applying is not in it.
Full entry →