阅读中文版本

Environment Config Drift Remediation Workflow

Detect configuration drift from the declared desired state and reconcile it deliberately instead of by manual edits.

Overview

Detect and reconcile configuration drift back to the declared state.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• Infrastructure as code
• A drift detection tool
• Ownership records

Procedure

1. Detect drift

Compare live configuration against the declared desired state on a schedule.

Expected state: Drift is detected before it causes surprises.

2. Attribute the drift

Determine who or what changed the resource outside the pipeline.

Expected state: The source of the change is understood.

3. Reconcile deliberately

Either accept the change into the declared state or revert it.

Expected state: Live state matches the declared state intentionally.

4. Prevent recurrence

Remove manual access where it allowed the drift.

Expected state: The same drift cannot happen again the same way.

# detect drift against declared state
terraform plan -detailed-exitcode

Verification

Confirm drift is detected, reconciled to the intended state, and the manual path that caused it is closed.

Decision points

Revert drift or accept it?

• Accept if deliberate, revert otherwise
• Always revert

Recommendation: Revert accidental drift; accept deliberate changes by updating the code, not the live state.

Detect on schedule or on change?

• Both
• Detect on schedule only

Recommendation: Detect on change to catch drift sooner and on schedule as a backstop.

Common failures

• Undetected drift causes environment-only bugs.
• Reverting deliberate changes disrupts work.
• Manual access that caused drift allows recurrence.