Configuration Drift
Configuration drift is the gradual divergence of a system's actual running configuration from its intended, documented, or version-controlled state, usually caused by ad hoc manual changes made outside of a controlled deployment process.
Definition
Configuration drift is the gradual divergence of a system's actual running configuration from its intended, documented, or version-controlled state, usually caused by ad hoc manual changes made outside of a controlled deployment process.
Overview
Drift happens quietly: an engineer SSHes into a server to apply an emergency fix, tweaks a setting through a cloud console instead of updating a Terraform file, or a hotfix never gets backported into the source of truth. Individually these changes seem harmless, but over months, servers that were originally identical copies of the same image slowly become subtly different from each other and from what's documented — making bugs harder to reproduce and outages harder to diagnose. The standard defense against drift is Infrastructure as Code (IaC): defining servers, networking, and configuration entirely in version-controlled files and applying changes only through an automated pipeline, so the deployed state can be continuously reconciled against the declared state and any manual deviation is either detected or automatically overwritten. This approach pairs naturally with immutable infrastructure, where instead of patching a running server in place, teams replace it entirely with a freshly built one from a known-good image, eliminating the opportunity for drift to accumulate at all. Drift is a common root cause investigated during incident management — 'it works on the other three servers but not this one' is a classic drift symptom — and detecting it is a common use case for configuration management and observability tooling that continuously compares live system state against a declared baseline.
Key Concepts
- Caused by ad hoc manual changes made outside a controlled deployment pipeline
- Accumulates gradually, making individual instances of the same service inconsistent
- Makes bugs and incidents harder to reproduce and diagnose
- Directly countered by Infrastructure as Code and automated reconciliation
- Eliminated most completely by immutable infrastructure practices
- Detectable via configuration management tools that continuously audit live state
Use Cases
Frequently Asked Questions
From the Blog
Spring Boot Explained: Beans, Auto-Configuration, Starters
Spring Boot is dependency injection plus conditional defaults. Learn how the application context builds beans, how starters bring opinionated configuration you can override, and how to read the startup report so bean resolution failures and unexpected defaults become quick fixes rather than mysteries.
Read More Cloud & CybersecurityManaging configuration with Kubernetes ConfigMaps and Secrets
Externalise config safely: env vars versus mounted files, what a Secret does and does not protect, triggering rolls on change and keeping config out of images.
Read More Cloud & CybersecuritySecure session cookie configuration: flags that actually matter
Set session cookies correctly: what HttpOnly, Secure, SameSite, Domain and Path each block, plus session rotation, expiry and server-side invalidation.
Read More Cloud & CybersecurityTerraform drift detection and importing existing resources
Bring hand-made infrastructure under Terraform and keep it there: importing resources, reading refresh output and running scheduled drift checks.
Read More