Configuration drift occurs when infrastructure’s actual state no longer matches its desired configuration. A manual console change can cause it even when the infrastructure code has not changed. The mismatch may remain unnoticed until an unexpected change becomes a breaking change. section 6.3.5
Treat drift detection as part of the infrastructure pipeline, not as a one-time deployment check. Tests can provide a smoke check after deployment and run nightly to catch later changes made outside the pipeline. Consistent provisioning across development, staging, and production also reduces differences between environments, but does not remove the need to check their actual state. section 6.3.3 section 6.3.5 section 10.3.1
Check a required cloud setting
Suppose an AWS IAM role must exist and have the AdministratorAccess policy. An Awspec test can assert both conditions against the deployed configuration. If someone changes the role outside the pipeline, a recurring check can expose the mismatch. Write such tests against the intended outcome before implementing the infrastructure code; a test written afterward may merely confirm an assumption built into the implementation. section 6.3.5
require 'awspec'
describe iam_role('AdminUsersRole') do #1
it { should exist } #2
it { should have_iam_policy('AdministratorAccess') } #3
end
The Awspec listing shows assertions for a role’s existence and required policy—the kind of deployed-state checks that can be run repeatedly to detect drift. section 6.3.5
