Loading
Config drift rarely shows up as a single dramatic incident. It shows up as a thousand small inconsistencies that make every future change riskier than the last.
Every platform team has a version of the same story: an environment that was provisioned correctly eighteen months ago, patched by hand a dozen times since, and now differs from its own infrastructure-as-code definition in ways nobody can fully enumerate. This is drift, and it's rarely dramatic enough to trigger an incident on its own. Instead, it accumulates quietly until it makes an unrelated change dangerous.
A bug is a defect in logic. Drift is a defect in truth — the gap between what your manifest says should exist and what's actually running. That gap grows for mundane reasons: a hotfix applied directly to production during an incident, a manual permission grant that was never revoked, a resource resized to handle a traffic spike and never resized back. None of these are mistakes in isolation. Collectively, they mean your infrastructure-as-code stops being a reliable description of reality.
The cost shows up later, and indirectly. A team tries to reproduce production in staging and can't, because staging quietly diverged. An audit takes three weeks longer than it should because nobody can produce an authoritative list of what's actually deployed. A security review flags a public storage bucket that was never supposed to be public, and nobody remembers when or why it changed.
Most teams eventually add some form of drift detection — a scheduled job that diffs live state against the IaC definition and posts the result to a channel nobody reads closely enough. This helps, but only partially. Detection without a fast, low-friction remediation path just becomes another alert competing for attention. The teams that actually solve drift pair detection with automatic remediation plans and policy guardrails that catch violations before they're applied, not after.
The goal isn't to eliminate every manual change — sometimes a hotfix during an incident is exactly the right call. The goal is to make sure that change is reconciled back into the source of truth quickly, deliberately, and visibly, rather than silently accumulating as one more inconsistency for the next engineer to discover the hard way.