An organisation's infrastructure code has become a sprawl of copied configurations. What module strategy works, and how is drift handled?

The module strategy

1. Modules at the level of a capability, not a resource. A module that provisions "a service with its network, identity, observability and deployment configuration correct" is useful. A module wrapping a single resource with a passthrough interface adds indirection and no value.

2. Opinionated defaults with narrow variation points. The module encodes the organisation's standards; the consumer supplies what genuinely differs. A module with forty parameters is a copy of the underlying provider with extra steps.

3. Versioned and consumed by version, so a module change does not alter every environment at once. Modules are interfaces and deserve the same compatibility discipline.

4. A small number of well-maintained modules rather than many partially-maintained ones. Sprawl usually comes from teams copying because the existing module did not quite fit — which is a signal that variation points are missing, not that another module is needed.

How drift is handled

1. Detect continuously. A scheduled plan-and-compare across every environment, reporting differences. Drift becomes visible within hours rather than at the next unrelated deployment.

2. Treat drift as a signal, not a violation. Persistent drift in one area usually indicates that the codified path is too slow, too rigid or missing a capability. Fixing the tooling reduces drift more reliably than enforcing policy.

3. Break-glass as a designed path — elevated access available, time-limited, loudly logged — so an engineer does not have to choose between the rules and the outage.

4. Reconciliation as a step in the incident process. The incident is not closed until manual changes are codified or reverted. This is the highest-value process change, because it attaches the obligation while the context is fresh.

5. Surface silent reversion. The apply pipeline should prompt on "this will remove resources or settings not in code" rather than doing it silently — so an unrelated deploy cannot quietly undo an incident fix.

The measure

Drift found per environment per week, and time to reconcile. Rising drift with slow reconciliation means the codified path is losing to the manual one, which is a tooling problem rather than a discipline problem.