Configuration Drift: The Problem We Declared Solved and Didn't

Infrastructure as Code solved configuration drift. Declare state, apply state, done. The talk from 2015 was convincing. It's 2026. Someone still clicked in the console last week. Your Terraform says one thing. AWS says another. The security group has a rule that nobody can explain. The network ACL was "temporarily" modified during an incident six months ago. Your IaC pipeline runs green because it's checking what it manages. It doesn't check what it doesn't know about. Drift is not just infrastructure. Security policies drift. Network configurations drift. Compliance settings drift. Each team detects their own domain. Nobody detects drift that crosses boundaries. The tooling exists. State comparison is automatable. The problem is organizational. DevOps detects infrastructure drift. SecOps detects security drift. NetOps detects network drift. The drift that causes incidents usually spans all three.

This session covers building unified drift detection across operational boundaries. We'll explore detection pipelines, spanning infrastructure, security, and network configurations, state comparison strategies beyond single-tool approaches, alert routing that reaches the right team without flooding everyone, remediation workflows that cross team boundaries, and governance for manual changes that maintain audit trails.