What Is Drift Detection?
Drift detection is the practice of regularly comparing the actual state of infrastructure against its declared, intended state to surface any divergence -- configuration drift -- before it causes problems.
You cannot fix drift you cannot see. Drift detection makes divergence visible by comparing what is actually running against what your infrastructure code says should be running, so you find and correct the gaps deliberately rather than discovering them during an incident.
How it works
Drift detection queries the real state of resources and compares it against the desired state described in code or a state file. Any difference -- an extra firewall rule, a changed instance size, a manually edited setting -- is reported as drift. The comparison turns invisible divergence into an explicit, reviewable list.
When to run it
Detection is most useful when run continuously or on a schedule, not just occasionally. Running it regularly catches drift soon after it appears, while the change is recent and easy to understand. Many teams also run it in CI before applying changes, so they know the starting state matches expectations.
Reading the results
Not all drift is equal. Some indicates a dangerous unauthorized change; some reflects legitimate emergency fixes that simply need codifying; some is benign noise from fields the platform manages itself. Triaging detected drift means deciding, per item, whether to revert reality to the code or update the code to match reality.
Remediation
Once drift is found, you reconverge. Re-applying the infrastructure code overwrites the drifted state and restores the declared configuration. Alternatively, if the manual change was correct, you fold it into the code so future applies preserve it. Either way, code and reality are brought back into agreement.
Detection versus prevention
Drift detection is a safety net, not a cure. The strongest defense against drift is preventing it -- through immutable infrastructure and disciplined infrastructure-as-code workflows. Detection complements prevention by catching the drift that slips through whatever gaps remain, keeping the overall system honest.
Key takeaways
- Drift detection compares actual infrastructure against its declared state.
- Running it continuously catches divergence early, while it is easy to fix.
- Remediate by re-applying code or codifying the legitimate change.