Configuration drift detection mechanism

Configuration drift happens silently: a developer manually changes a production environment variable to debug an incident, forgets to revert it, and weeks later the application behaves differently in production than in staging with no explanation. NIST CM-3 requires controlled configuration change management. ISO 27001:2022 A.8.9 mandates configuration management. Without a drift detection mechanism, you cannot detect unauthorized configuration changes, reconcile environments after incidents, or demonstrate configuration control to auditors. The cost of undiscovered drift compounds: each subsequent change is made against an unknown baseline.

Version-control all configuration and use infrastructure tools that detect and report drift between desired and actual state. The simplest approach is YAML configuration files under git; the most robust is IaC with a plan step in CI.

Version-controlled config files:

config/
  development.yaml
  staging.yaml
  production.yaml

All changes go through pull request review. Production config changes require an approved PR — no manual edits on the server.

Terraform drift detection in CI:

# .github/workflows/drift.yml
- run: terraform plan -detailed-exitcode
  # exits 2 if drift detected; CI fails and alerts the team

Kubernetes: Use GitOps (Flux, ArgoCD) to continuously reconcile cluster state with git. Any manual kubectl edit is detected and reverted within minutes.