What it means
Drift can result from emergency changes, manual administration, service updates, failed automation, inherited policy, or unauthorized activity.
Why it matters
Because cloud resources change rapidly, periodic review alone may leave insecure exposure in place for too long. Detection and correction should be continuous and risk based.
Practical focus
- Define authoritative configuration sources
- Detect changes through provider events and posture tools
- Separate approved exceptions from unknown drift
- Reconcile or replace drifted resources safely
Common mistakes
- Automatically reverting every difference without context
- Ignoring drift in identities and resource policies
- Using manual consoles as the normal deployment path
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: