IaC drift detection in IaaS is the difference between your declared infrastructure state in code and what actually runs in your cloud. It is caused by untracked changes — manual tweaks in the console, scripts run outside CI/CD, or automation with missing guardrails. These changes bypass Infrastructure as Code workflows, leaving resources misaligned with your source of truth.
In IaaS, drift is dangerous because scale magnifies error. One EC2 instance with a security group change might not seem critical. Hundreds of instances with inconsistent rules become a failure pattern. IaC drift means tests pass against stale definitions while production behaves differently.
A strong IaC drift detection strategy starts with version-controlled infrastructure definitions. Continuous reconciliation scans — scheduled or event-driven — compare live infrastructure against the Git repo. Discrepancies must be surfaced fast, with context and change metadata. Immutable deployments reduce drift risk, but they require blocking direct console edits and preventing ad-hoc API changes.