What is configuration drift?

Configuration Drift is the deviation of the actual state of a system's configuration (server, application, network) from the desired or baseline state.

Main causes:

• Manual changes: Making changes directly on the server without using automated tools and processes.
• Lack of automation: Absence or incomplete coverage of infrastructure with configuration management tools.
• Differences in environments: Lack of standards or unsynchronized changes between development, testing, and production environments.
• Deployment errors: Incorrectly executed deployment scripts or procedures.

Consequences of configuration drift:

• System instability: Unpredictable behavior, failures.
• Troubleshooting difficulties: Hard to identify the cause of problems due to configuration differences.
• Scaling and recovery issues: Impossible to quickly and reliably deploy new instances or recover the system after a failure.
• Security breaches: Outdated packages or incorrect security settings.

Overcoming configuration drift:

• Using IaC (Infrastructure as Code): Managing infrastructure and configuration with code.
• Configuration management tools: Puppet, Chef, Ansible, SaltStack.
• Automated deployment: CI/CD pipelines.
• Monitoring and auditing: Continuous control over configuration state and detection of deviations.

Example of IaC in Terraform to maintain the desired state of an EC2 instance:

// main.tf
resource "aws_instance" "web_server" {
  ami           = "ami-0abcdef1234567890" # Desired AMI
  instance_type = "t2.micro"           # Desired instance type
  tags = {
    Name = "WebServerProd"
  }
  // Additional settings to ensure the desired state
}

Terraform will strive to keep the instance in the specified state. If the instance type is changed manually, Terraform on the next terraform apply will attempt to revert it to t2.micro (or suggest a plan of changes to correct the drift).