The Terraform plan showed nothing. The cloud told a different story. Something had changed, and no one had caught it in time. That’s the cost of missing Infrastructure as Code (IaC) drift.
IaC drift detection finds differences between your declared infrastructure state and what’s running. Left unchecked, drift leads to outages, misconfigurations, and security issues. For teams with strict compliance or uptime needs, running drift detection in a self-hosted setup is more than preference — it’s policy. A self-hosted IaC drift detection tool runs inside your environment, under your control, with no external dependencies. That means private code stays private, and sensitive data never leaves your network.
An effective self-hosted drift detection system integrates directly with your GitOps workflow. It scans cloud resources, compares them to your IaC repo, and alerts you to unauthorized changes. It should handle multi-cloud, support Terraform and other IaC frameworks, and detect both manual changes and automated ones made outside your pipelines. The best tools run on a schedule or trigger from events, store drift history, and support easy remediation.