IaC drift detection tells you exactly when something in your live environment has changed outside your code. It closes the gap between what’s in your repository and what’s actually running. Without it, silent changes accumulate—config tweaks in production, hotfixes never merged back, unplanned resource edits. These break your immutability guarantees and make your infrastructure unpredictable, harder to audit, and easier to exploit.
Immutability in Infrastructure as Code means that deployments are the only way to change state. You define resources once, in code, and recreate them when you need changes. It’s clean, deterministic, and safe. Drift happens when reality diverges from that ideal—someone edits a setting in a cloud console, a script updates an instance directly, or an automated process modifies resources without updating the IaC source.
Drift detection runs regular checks against the actual environment. It compares current resource states with the source of truth in your repository or pipeline. Alerting on differences lets teams decide—redeploy to restore the declared state, or update the code to match the new real-world configuration. This keeps both the infrastructure and the IaC definitions in sync.