Configuration Drift Detection
Continuously comparing declared infrastructure against what actually exists, so out-of-band change is found on a Tuesday rather than during a rebuild.
Infrastructure as code describes what should exist. Drift is the difference between that and what does — a security group widened during an incident, a manually resized instance, a resource created by a console click, a setting changed by a provider's own upgrade.
Undetected drift has one specific failure mode: the code stops being a viable
description of the estate. The next apply either reverts an important manual
fix or refuses to proceed, and the discovery happens at the worst time, which is
when someone is trying to rebuild after a failure.
Detection is a scheduled plan-only run that reports differences without applying them. The valuable design decision is what to do with the report: automatically reverting drift is correct for security-relevant settings and dangerous for capacity ones, where the manual change is often a correct response to load that the code has not caught up with. Splitting the estate into "reverted automatically" and "raised as a ticket" is more useful than a single policy.