The Terraform plan looked clean—until the runtime told a different story. That gap is Infrastructure as Code drift, and it’s where security problems start.
IaC drift detection is the process of finding when your deployed infrastructure has changed from the state defined in code. It happens when someone edits production resources directly, a service makes unauthorized changes, or a bad actor exploits social engineering to alter infrastructure without leaving a clear commit history. Drift erodes trust in deployments, breaks reproducibility, and hides vulnerabilities.
Social engineering raises the risk. Attackers target engineers or operators, tricking them into making “quick fixes” in cloud consoles or pipelines. Those changes bypass the IaC workflow, never hit version control, and push the live environment out of sync. Without automated IaC drift detection, these changes can persist undetected, even in regulated environments.
Effective drift detection starts with continuous comparison between your IaC definitions—Terraform, Pulumi, AWS CDK—and the actual cloud state. Integrate the checks into your CI/CD process. Alert on mismatches. Enforce reconciliation before production changes go live. For social engineering vectors, pair drift detection with strict IAM policies, MFA, and enforced review workflows to make a one-click console change impossible without controlled approval.