What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Configuration drift occurs when a system’s live settings diverge from the configuration meant to describe or control it. In cloud infrastructure, that often means deployed resources no longer match their infrastructure-as-code (IaC) definitions. Detecting a difference is only the first step: teams must still decide whether to adopt an approved change into code or restore the declared configuration.
What configuration drift means
In an IaC workflow, version-controlled declarations describe the intended infrastructure, while cloud services expose the resources that are actually running. Drift is the difference between those states. AWS describes it as a gap that develops between cloud infrastructure and IaC configuration; AWS CloudFormation identifies drift when actual resource properties differ from the expected properties in a stack template. AWS explains IaC and drift; CloudFormation documents drift detection.
As an Amazon Associate I earn from qualifying purchases.
The term also applies beyond cloud IaC: any managed system can drift when its actual settings stop matching the expected or recorded settings. A reported difference is not automatically a security incident, nor proof that the declaration is still the right target. An emergency change may be valid and should be preserved; an accidental or unauthorized change may need to be reversed.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Why configuration drift accumulates
- Manual changes: Someone edits a resource in a cloud console or through an API or CLI instead of changing the IaC and deploying it. The live system changes, but the version-controlled declaration does not. AWS identifies direct, untracked changes as a common source of drift.
- Separate teams and incomplete visibility: Operational silos, shared ownership, and uncoordinated changes make it harder to maintain a single change record or consistent view of the infrastructure. AWS discusses these operational causes.
- Urgent operational response: Teams may intentionally change a resource outside the normal workflow to address a time-sensitive incident. The change may be necessary, but it still needs a deliberate decision about whether it becomes the new declared state. CloudFormation describes intentional and accidental out-of-band changes.
- Changes over a service’s lifecycle: Service degradation, failures, expiring certificates, and manual modifications can leave actual resources different from their intended configuration. HashiCorp’s Terraform tutorial gives examples of lifecycle-related drift.
- Resources outside IaC management: A manually created resource may not be tracked or controlled by the IaC workflow. If it should be managed, it may need a definition and an import into the tool’s state. HashiCorp demonstrates importing an existing security group.
- Unset attributes and defaults: If a critical setting is omitted from configuration, a cloud or provider default may determine its live value. Terraform drift detection is limited to attributes defined in configuration, so teams should explicitly declare attributes that matter operationally. HashiCorp documents this coverage boundary.
What can go wrong
- Security exposure: Drift can leave resources or data less protected than intended. In HashiCorp’s tutorial, a security-group rule changes from a restricted CIDR to
0.0.0.0/0, illustrating how an access-control change could expose a service. It is an example, not an inevitable result of drift. See the Terraform example. - Surprising deployments: A later Terraform plan may reveal differences not represented in code, prompting review of a potentially large execution plan before work can continue. HashiCorp describes this operational risk.
- Complicated stack operations: Out-of-band changes can complicate CloudFormation stack updates or deletions. AWS says resolving drift helps ensure configuration consistency and successful stack operations. AWS CloudFormation drift documentation.
- Inconsistent environments: If environments are changed independently, reproducing them and applying security or operational standards becomes harder. AWS recommends baselining environments and making routine changes through IaC. AWS guidance on IaC practices.
How drift detection works—and what it can miss
Terraform plans and state
terraform plan -refresh-only inspects how Terraform’s state would change to reflect live infrastructure and lets an operator review the observed changes. Applying a refresh-only operation updates state; it does not itself modify the infrastructure. A regular plan or apply can propose infrastructure actions to reconcile live resources with configuration, so inspect its proposed changes before applying. HashiCorp’s resource-drift tutorial explains the workflow.
#1 Best Overall
HCP Terraform health assessments
HCP Terraform health assessments compare actual infrastructure settings with resources recorded in workspace state. HashiCorp describes them as non-actionable, refresh-only plans: the assessment does not update state or infrastructure configuration. Assessments can be scheduled or run on demand. The tutorial describes scheduled checks approximately every 24 hours, but cadence and product requirements can change; consult current HCP Terraform drift-detection documentation for applicable requirements.
CloudFormation drift detection
CloudFormation compares actual resource properties with the expected properties in a stack template, including parameter values, and can report details for individual resources. It only checks resource types that support drift detection; unsupported types are reported as NOT_CHECKED. AWS lists the detection behavior and limitations.
Comparison boundaries and apparent differences
A check only tells you what its comparison covers. Terraform reports changed attributes defined in the configuration, while CloudFormation coverage depends on resource-type support. Differences can also be textual rather than operational: CloudFormation gives the example of 1024 MB and 1GB, which represent equal quantities but can produce a drift result because their text differs. Provider defaults for unset Terraform attributes can likewise appear as differences. Verify the actual property values, provider normalization, and tool coverage before treating a report as a meaningful change. Terraform coverage notes; CloudFormation comparison notes.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteHow to reconcile a detected difference safely
- Inspect the report. Identify the resource and properties involved. Confirm that the resource type and attributes are in scope, and check whether defaults or equivalent values explain the difference.
- Establish intent and ownership. Look for a change record or incident context. Determine who made the change, why it was made, and whether it is still needed; an out-of-band action may have been an intentional response to an urgent event.
- Choose the desired state. If the live change is approved, update the IaC declaration so it represents and manages that state, then review a plan. If the change is unwanted, use a reviewed deployment or corrective action to restore the declared state. If the resource should be managed but is not, define it and import it into the appropriate IaC state.
- Review the impact before applying. A reconciliation can reverse manual changes or affect multiple resources. Read the full plan and investigate large or unexpected change sets; do not enable automatic remediation without clear intent and safeguards.
- Verify and communicate. Run detection again, confirm that the chosen configuration is represented, and record the disposition for the teams that share responsibility for the resource.
How to prevent drift from becoming routine
- Use IaC as the normal change path. Make deployments, updates, and new environment features through version-controlled IaC so changes can be reviewed, tested, and reproduced. AWS recommends IaC for environment changes.
- Test changes in staging. Use a separate staging environment to catch errors before production changes. AWS recommends staging before production.
- Declare critical attributes explicitly. Do not rely on provider defaults for settings whose values matter to security or operations if those attributes need to be visible to Terraform’s configuration-based drift checks. HashiCorp describes the configured-attribute boundary.
- Encode standards and validate them. Terraform preconditions, postconditions, input constraints, and policy engines such as Sentinel or OPA can express requirements. Configuration-level checks depend on module authors and users including or consuming them; organization-level policy can enforce broader rules. HashiCorp discusses configuration and policy checks.
- Coordinate ownership and access. Clarify who is responsible for shared infrastructure, protect controls from unauthorized modification, and communicate platform changes to workload teams. AWS discusses shared responsibility and communication.
- Schedule checks and run them after suspected changes. Recurring checks help surface changes; targeted, on-demand checks are useful after an incident or suspected out-of-band edit. Their value depends on the selected system’s coverage and execution requirements. HCP Terraform documents scheduled and on-demand assessments.
- Maintain an inventory. Identify resources outside the IaC workflow and bring those that should be controlled under management, including by defining and importing existing resources where appropriate. HashiCorp’s tutorial shows the import approach.
Choosing a drift-management approach
Terraform and CloudFormation fit different IaC workflows, and the available documentation does not establish a neutral winner. Compare the practical differences before choosing or configuring a process:
| Decision point | Terraform and HCP Terraform | AWS CloudFormation |
|---|---|---|
| What is compared? | Terraform’s refresh-only plan observes live infrastructure relative to state; HCP health assessments compare actual settings with resources recorded in workspace state. HashiCorp documentation. | Actual resource properties are compared with expected properties in the stack template, including parameter values. AWS documentation. |
| Coverage | Drift detection reports changed resource attributes defined in configuration. HashiCorp documentation. | Only supported resource types are checked; unsupported types are reported as NOT_CHECKED. AWS documentation. |
| Timing | HCP Terraform offers scheduled and on-demand assessments; a refresh-only plan can be run manually. HashiCorp documentation. | Not stated in the cited CloudFormation documentation. |
| Effect of a check | HCP health assessments are non-actionable and do not update state or infrastructure configuration. A Terraform refresh-only apply updates state without modifying infrastructure. HashiCorp documentation; Terraform tutorial. | Detection reports differences; reconciliation is a separate decision and operation. AWS documentation. |
| Validation and policy | Terraform supports configuration conditions and constraints; Sentinel or OPA can express organizational policy. Their enforcement depends on how checks and policies are incorporated. HashiCorp documentation. | Not stated in the cited CloudFormation drift-detection documentation. |
| Reconciliation | Review a plan to adopt approved changes or restore declared values; unmanaged resources can be defined and imported. HashiCorp tutorial. | Use the reported differences to decide whether to update the template or restore the intended resource properties. AWS documentation. |
Choose based on the IaC model already in use, resource and attribute coverage, review controls, alerting needs, and operational requirements. In either workflow, detection exposes a discrepancy; it does not decide which state should be authoritative.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
