Configuration Drift
Divergence between the infrastructure described in code and the infrastructure actually running, usually caused by manual changes.
Someone fixes an incident through the console at 2 a.m. The change is correct, undocumented, and now invisible to the code. The next apply either reverts it — reintroducing the incident — or the tool reports a difference nobody understands.
Drift is not merely untidy. It means the code is no longer a description of reality, which removes the main benefits of infrastructure as code: the ability to recreate an environment, to diff two environments, and to review a change before it happens.
Detection is available and under-used: most tools can plan without applying and report differences, and several providers offer native drift detection. Running it on a schedule and alerting turns drift from an invisible accumulation into a visible one.
But the real fix is prevention rather than detection. Remove console write access in production, leaving read-only for investigation. Provide a break-glass path that is audited and time-limited for genuine emergencies, and require that any change made through it is reconciled into code within a defined window — a follow-up ticket created automatically at break-glass time.
The maturity test remains: can a production environment be rebuilt from an empty account using only what is in the repository? Drift is what makes the answer no.