中文
devexamples
← Workflows

阅读中文版本

Configuration-as-Code Audit Workflow

Find configuration changed outside the pipeline, reconcile drift back into code, add controls to prevent it, and ensure the code is the source of truth.

intermediate~120 miniacconfigoperations

Objective

Detect and eliminate drift between manual configuration and the code that is supposed to define it.

Environment

  • Drift detection or state comparison
  • Access to the configuration pipeline

Steps

1. Compare live configuration with what

Compare live configuration with what the code defines.

Expected state: Drift is detected objectively.

2. Reconcile each drift by either updating

Reconcile each drift by either updating the code or reverting the change.

Expected state: Code and reality agree again.

3. Trace how the drift happened

Trace how the drift happened and add prevention.

Expected state: The cause is removed.

4. Make drift detection a scheduled check,

Make drift detection a scheduled check, not a one-off.

Expected state: Code stays the source of truth.

Decision points

Revert drift or codify it?

  • Codify if legitimate
  • Always revert

Codify legitimate changes through review; revert everything else to keep code authoritative.

Block manual changes entirely?

  • Restrict with break-glass
  • Block

Restrict with an audited break-glass path; total blocking pushes people to less observable workarounds.

Expected outcome

Configuration matches the code, the causes of drift are prevented, and drift detection runs on a schedule.

Verification

Confirm the drift report is empty after reconciliation and that a manual change is detected by the next scheduled check.

Cleanup

Record reconciled drifts and the prevention changes made.

Overview

Detect and eliminate drift between manual configuration and the code that is supposed to define it. Confirm the drift report is empty after reconciliation and that a manual change is detected by the next scheduled check.

Steps

  1. Compare live configuration with what the code defines. Expected state: Drift is detected objectively.
  2. Reconcile each drift by either updating the code or reverting the change. Expected state: Code and reality agree again.
  3. Trace how the drift happened and add prevention. Expected state: The cause is removed.
  4. Make drift detection a scheduled check, not a one-off. Expected state: Code stays the source of truth.
terraform plan -detailed-exitcode
# exit code 2 means drift exists; reconcile or codify

Verification

  • Configuration matches the code, the causes of drift are prevented, and drift detection runs on a schedule.

Decision points

  • Revert drift or codify it? Options: Codify if legitimate; Always revert. Recommended: Codify legitimate changes through review; revert everything else to keep code authoritative.
  • Block manual changes entirely? Options: Restrict with break-glass; Block. Recommended: Restrict with an audited break-glass path; total blocking pushes people to less observable workarounds.