Infrastructure Drift Is a Control Problem, Not a Surprise

Infrastructure drift is the gap between declared and actual state. It can start with a console change, an emergency fix, or a resource changing during its lifecycle. Left untracked, it makes incidents harder to explain and deployments less predictable.

IaC and GitOps tools expose drift by comparing desired state with live resources. Terraform and Pulumi offer drift checks; controllers reconcile configuration with clusters. Argo CD compares Git with live manifests, while Flux uses an interval-based server-side apply dry-run to detect and correct differences.

Remediation needs guardrails: policy checks, pull requests, approvals, and audit logs. Treat self-healing and pruning as explicit decisions. Argo CD self-heal is opt-in, and Flux deletes removed objects only when pruning is enabled. AWS Config supports manual or automatic remediation through Systems Manager Automation documents.

Takeaway: detect continuously, explain the differences, review every change, and automate only reversions you can safely undo. Drift management is a control loop around declared infrastructure, not a button after an incident. Track drift now.