What constitutes best practice for configuration drift detection and remediation?

What constitutes best practice for configuration drift detection and remediation?

• A. Periodic state comparison to desired IaC; automatically apply drift or alert for manual remediation.
• B. Ignore drift.
• C. Randomly change resources to match desired state.
• D. Only check logs.

Answer: (A)

Drift happens when the actual resources no longer match what’s declared in your IaC. The best practice is to regularly compare the live environment to the desired state defined in your infrastructure code, detect any differences, and address them promptly. This can be done automatically—remediating drift when it’s safe to do so—or by issuing an alert for manual remediation when human judgment is needed. This approach keeps environments consistent, improves reproducibility, and supports compliance and faster recovery from unintended changes. Ignoring drift leads to unseen divergences and unstable deployments. Randomly changing resources to align with the desired state is risky and can cause outages or data loss because changes aren’t carefully vetted. Checking only logs misses drift that isn’t reflected in log events and doesn’t enforce the desired state.

Drift happens when the actual resources no longer match what’s declared in your IaC. The best practice is to regularly compare the live environment to the desired state defined in your infrastructure code, detect any differences, and address them promptly. This can be done automatically—remediating drift when it’s safe to do so—or by issuing an alert for manual remediation when human judgment is needed. This approach keeps environments consistent, improves reproducibility, and supports compliance and faster recovery from unintended changes.

Ignoring drift leads to unseen divergences and unstable deployments. Randomly changing resources to align with the desired state is risky and can cause outages or data loss because changes aren’t carefully vetted. Checking only logs misses drift that isn’t reflected in log events and doesn’t enforce the desired state.