The alert came at midnight. Your infrastructure was no longer the same as the code in your repository. Someone had made a change in production. The code didn’t know. You didn’t know. Until drift detection told you.
Infrastructure as Code (IaC) drift happens when the live state diverges from the configuration files that are supposed to define it. It can break environments, cause outages, and create security risks. Without fast detection, drift can hide for weeks. By the time you find it, the damage is already done.
IaC drift detection continuously compares the state in your cloud provider with the version-controlled IaC templates. It flags any difference—configuration changes, missing resources, or new resources that were never declared. The goal is simple: know exactly when and what changed outside of your IaC process.
Role-Based Access Control (RBAC) is your second line of defense. Drift detection answers “what changed?” RBAC answers “who could have changed it?” By limiting permissions to only the people and services that need them, RBAC reduces the surface area for drift. Developers should not have production write permissions unless required. Service accounts should have narrowly scoped roles. The principle of least privilege is not just theory; it is the backbone of secure IaC.