I need drift detection for cloud infrastructure changes

Sure — drift detection is the process of identifying when your actual cloud resources no longer match the desired state defined in code or configuration.

What you can use

1) Infrastructure as Code tools

If you use IaC, drift detection is usually built in or available through a provider:

• Terraform

  • terraform plan compares desired vs actual state
  • terraform refresh / newer workflows detect changes from the cloud
  • Terraform Cloud/Enterprise has drift detection for scheduled runs

• AWS CloudFormation

  • Drift detection for stacks and resources

• Azure

  • Azure Policy for compliance drift
  • ARM/Bicep with deployment what-if checks

• GCP

  • Config Connector, Terraform, or asset inventory/compliance tools

2) Cloud-native configuration/compliance tools

These are useful if you want continuous monitoring:

• AWS Config
• Azure Policy / Azure Resource Graph
• Google Cloud Asset Inventory / Security Command Center
• Third-party tools:
  • Checkov
  • OPA / Conftest
  • Prowler (AWS-focused)
  • Cloud Custodian

3) Practical drift detection patterns

A solid setup usually includes:

• Scheduled scans of infrastructure state
• Policy checks for insecure or noncompliant changes
• Alerting when manual changes happen in the console
• CI/CD gate checks before applying changes
• Immutable infrastructure where possible to reduce drift

Recommended approach

If you’re already using Terraform:

1. Store all infra in Git
2. Run terraform plan on a schedule
3. Compare against the latest approved state
4. Alert on any unexpected diff
5. Optionally auto-remediate or require approval

If you’re on AWS and want stronger native detection:

1. Enable AWS Config
2. Define rules for critical resources
3. Use CloudFormation drift detection where applicable
4. Route findings to SNS/Slack/SIEM

Key things drift detection should catch

• Manual edits in the cloud console
• Changed security groups/firewall rules
• Modified IAM roles/policies
• Updated instance sizes or autoscaling settings
• Deleted or added resources
• Tag changes and config divergence

If you want, I can help you with one of these next:

1. a Terraform drift detection setup
2. an AWS-native drift detection design
3. a generic architecture for multi-cloud drift detection
4. a sample script or CI pipeline for drift checks