10Drift Detection in Infrastructure-as-Code (DevOps Governance)
Role: Advisory Solution Engineer
Executive summary
Designed and implemented automated IaC drift detection that compares deployed Azure resources to Terraform/Bicep state and alerts on drift via Teams and email—improving the client's compliance posture.
- Terraform
- Bicep
- Azure Resource Graph
- Python
- Azure DevOps
- Azure Policy
A fintech running Azure wanted to ensure their Infrastructure-as-Code (Terraform, Bicep) stayed aligned with deployed resources. Configuration drift was a compliance risk and potential security exposure, so they needed automated detection and alerting.
- Identify tools/features to compare deployed resources vs IaC (Terraform plan in check mode, Azure Resource Graph vs desired state).
- Where no tool fits, design a custom script to parse IaC and cross-check Azure settings.
- Integrate drift detection into CI/CD to run regularly and alert via email/Teams.
- Document best practices to minimize drift (resource locks, policy).
I recommended Terraform's drift detection where possible and, for out-of-band resources, used Azure Resource Graph queries with Python scripts comparing against a baseline, integrated into a daily Azure DevOps pipeline that emits diffs and Teams/email alerts. A deliberate out-of-band tag change was caught on the next run. I refined scope with their DevOps engineers (some drift is acceptable) and packaged it into a maintainable internal tool.
The fintech now runs automated drift detection. Since rollout, they have caught manual portal-created resources and remediated them within a day, preventing configuration sprawl. Alerts integrated into their DevOps Teams channel made it part of normal workflow, improving compliance posture, with documentation for extending coverage and integrating Azure Policy.
Preventing drift via policy is ideal, but detection is an essential safety net. Tailoring to the client's stack—leveraging existing Terraform—beat introducing new tooling. Lightweight scripting and automation can solve critical business needs effectively.