Configuration drift is the gradual divergence between the configuration a system should have, as defined in code, and the configuration it actually has. It happens when people make manual changes, hotfixes aren’t written back to code, or automation runs inconsistently across environments.
Drift causes “works in staging, fails in production” incidents, security gaps and failed audits. It also makes the next automated change risky, because the code no longer describes reality.
How to prevent configuration drift
- Make code the only path to change, and restrict console and SSH changes.
- Detect drift on a schedule by comparing live state with code. Terraform
planand Ansible check mode both show differences. - Remediate by reapplying code or updating code to match an approved change.
- Govern code before it’s applied, so new drift isn’t introduced by bad or non-compliant changes.
Drift detection and remediation belong to execution platforms. Steampunk Spotter covers step 4: it verifies Ansible and Terraform code before execution, so the code you reapply is code you can trust.
