Infrastructure Drift Detection

Infrastructure Drift Detection Methods: Stateful vs Stateless vs Event-Driven

There are three primary strategies for detecting drift. A comprehensive approach often involves a combination of all three.

Terraform Drift Detection Tutorial: Automated Configuration Monitoring Tools

Let's see how these strategies are implemented with specific tools.

Terraform: Stateful Comparison

The simplest way to detect drift is to run `terraform plan` in a CI/CD job on a regular schedule. If the plan is not empty (and no code has changed), it indicates drift.

name: Terraform Drift Detection
on:
  schedule:
    - cron: '0 2 * * *' # Run at 2 AM UTC every day
jobs:
  drift-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - uses: hashicorp/setup-terraform@v2

      - name: Terraform Init
        run: terraform init

      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color -detailed-exitcode
        continue-on-error: true

      - name: Alert on Drift
        if: steps.plan.outputs.exitcode == 2
        run: |
          echo "🚨 Drift Detected! The terraform plan is not empty."
          # Add commands to send a Slack/Teams notification
          exit 1

OPA: Stateless Scanning of Live Resources

This approach involves writing a script to fetch the current configuration of a resource from the cloud provider's API, then using OPA to evaluate that configuration against a policy.

package drift.aws.s3

# Desired state is defined in an external data file
import data.desired_state

# Compare the live config (input) to the desired state
deny[msg] {
    input.versioning.enabled != desired_state.s3_buckets.critical_data.versioning
    msg := "S3 Versioning has drifted from desired state."
}

deny[msg] {
    input.server_side_encryption_configuration.rule.apply_server_side_encryption_by_default.sse_algorithm != "AES256"
    msg := "S3 Encryption has drifted from AES256."
}

deny[msg] {
    input.public_access_block_configuration.block_public_acls != true
    msg := "S3 public access block has drifted."
}

Real-Time Infrastructure Drift Detection: Event-Driven Cloud Monitoring Setup

The most advanced strategy uses cloud events to get immediate notification of changes. This allows you to detect and respond to drift in seconds, not hours.

💡 Infrastructure Drift Management Best Practices: Prevention and Remediation Guide