Infrastructure drift detection

In this lesson, you will learn how to identify and reconcile discrepancies between your defined Infrastructure-as-Code (IaC) and the actual state of your cloud resources.

The Concept of Drift

Infrastructure drift occurs when manual changes—often made through a cloud provider's console or CLI—bypass your automated deployment pipelines. If your C# application expects a specific security group configuration or database performance tier, but a developer manually changes a setting to "fix" an issue, your environment is now "drifted." This creates a "snowdrift" effect where your source of truth (your IaC templates) no longer reflects reality, leading to deployment failures and security vulnerabilities.

Detecting and Remediating Drift

To manage this, we treat infrastructure like code: we define the desired state and compare it against the live state. In a professional .NET environment, we often leverage tools like Terraform or Pulumi to perform "plan" operations, but we can also implement programmatic drift detection using the Azure/AWS SDKs for .NET.

Consider a scenario where you must ensure a storage container remains private. You can write a background diagnostic service that periodically polls your cloud resources:

public async Task CheckStorageDriftAsync(BlobServiceClient client, string containerName)
{
    var containerClient = client.GetBlobContainerClient(containerName);
    var properties = await containerClient.GetPropertiesAsync();

    // Our IaC expects 'None', but someone manually set it to 'Blob'
    if (properties.Value.PublicAccess != PublicAccessType.None)
    {
        _logger.LogWarning("Drift detected on {Container}! Remediating...", containerName);
        await containerClient.SetAccessPolicyAsync(PublicAccessType.None);
    }
}

Why Remediation Matters

When you detect drift, you have two choices:

1. Auto-Remediation: The system automatically forces the resource back to the IaC definition. This is risky but maintains strict compliance.
2. Alerting: The system flags the drift in your centralized logging, notifying the DevOps team to update the IaC templates to match the new requirement if the manual change was actually necessary.

By automating this, you ensure that your production environment remains deterministic, making your CI/CD pipelines reliable and predictable.

Key Takeaway: Infrastructure drift detection ensures that your live cloud environment never diverges from your version-controlled infrastructure code, preventing "configuration entropy" and unauthorized security changes.