What is Configuration Drift? Tools, Causes & Risks
· via Spacelift
Why this matters now: Drift is the gap between what your code says and what actually runs, accumulating through actions like hotfixes and console edits. Nobody notices it happening; you find it when the next apply behaves in ways you did not expect. This article is naming the causes, the risks and the tooling in one place.
Three takeaways:
- The causes: manual changes and human error, inconsistent deployment processes across environments, external dependencies that shift underneath you, and changes made without version control. Differences between dev, staging and production, plus thin documentation, round out the list. None of them look like mistakes at the time they happen.
- The risk compounds: the next apply either reverts someone’s fix or fails on state it does not expect. The named risks go further: security gaps from weakened rules and missed patches, compliance violations under GDPR or HIPAA, downtime, and slower troubleshooting when environments quietly differ. The examples will feel familiar: security group edits straight in production, IAM roles that differ between environments, replica counts changed directly on the cluster.
- Detection is cheap now, and continuous drift checks belong next to your other scheduled jobs. The tool list spans IaC (Terraform, OpenTofu, Spacelift), configuration management (Ansible, Puppet), GitOps delivery (ArgoCD, Flux) and cloud-native monitors (AWS Config, Azure Policy). Prevention is still the better spend: keep every configuration in version control, standardize the pipelines, and pair disciplined Terraform practices with tests around your IaC so most drift never appears in the first place.
What I’d add today: Configuration drift is difficult to address in existing and brownfield setups. Automation is the only real way to address it effecttively.
Who should read it: anyone operating IaC alongside humans with console access, which is everyone. If drift keeps coming back in the same places, the fix is structural, and a wider modernization plan covering state, pipelines and guardrails is the better follow-up than another round of detection.