Implement drift detection for deployed infrastructure
Implementation Effort: High – Standing up continuous drift monitoring, scheduled template-comparison jobs, and an ongoing investigate-and-remediate workflow is a sustained operational commitment. User Impact: Low – Comparing deployed infrastructure against its declared state and reverting unauthorized changes is an operations and security activity; end users are not affected. Lifecycle Stage: Run
Overview
Implement drift detection so you can continuously compare deployed resources against the state defined in infrastructure-as-code and remediate unauthorized changes.
Infrastructure as Code (IaC) establishes a desired state for cloud resources — network configurations, access policies, storage settings, compute sizing — in version-controlled templates such as Bicep, ARM, or Terraform files. But deploying infrastructure through IaC does not prevent someone from changing it afterward. Portal edits, CLI commands run during incident response, or direct API calls by compromised credentials can all modify production infrastructure in ways that diverge from the declared template. This divergence, called drift, means that the infrastructure you think you have and the infrastructure you actually have are no longer the same, and the security assumptions encoded in your templates may no longer hold.
Drift detection should combine three tool categories: continuous drift monitoring, template validation, and investigation with remediation.
For continuous drift monitoring, use Azure Policy and Azure Machine Configuration (formerly Guest Configuration) as complementary controls that audit selected platform and guest settings at scale between deployments.
For template validation, run recurring jobs that compare reviewed infrastructure-as-code with the live environment. For Terraform-managed environments, use scheduled validation pipelines such as daily GitHub Actions or Azure DevOps jobs that execute terraform plan against the current state and alert on unexpected changes. For ARM or Bicep-managed environments, use scheduled what-if runs to show how the reviewed template differs from the currently deployed resources before redeployment. These comparisons are point-in-time checks rather than continuous monitoring services.
For investigation and remediation, review every detected difference to determine whether the change was authorized, revert it if it was not, and update the IaC template if it was so the template always reflects reality.
Undetected drift is a serious security concern because it means threat actors — or careless administrators — can weaken security controls in production without any automated system noticing. A firewall rule opened during troubleshooting and never closed, a storage account changed from private to public, or a managed identity granted additional role assignments outside of code review all represent drift that silently expands the attack surface. Continuous comparison and investigated exceptions help keep reviewed infrastructure definitions aligned with what is actually deployed. By continuously comparing deployed resources against their declared state and investigating every unauthorized change, this task supports Assume breach.