IaC Drift Triage Playbook: Detect, Classify, and Reconcile Safely

Infrastructure drift is rarely a single event. It’s a pattern: manual console changes, automation side-effects, and configuration drift that accumulates until a “routine” rollout becomes an incident. For the definition, start with what infrastructure drift is. For the scan itself, see how to detect Terraform drift.

This playbook shows a repeatable approach for teams that want faster detection and safer reconciliation—without treating every diff as an emergency.

1) Make drift scanning operational, not occasional

Treat drift scanning like a control loop:

Schedule scans frequently enough to matter (for many teams: hourly for critical environments).
Refresh your declared state (Terraform/OpenTofu state) before comparing.
Produce a stable drift report that includes severity, affected resource types, and blast radius.

If drift is just a report, it will be ignored. If drift is a workflow, it becomes actionable.

2) Classify drift before deciding what to do

Teams get stuck when they classify drift too late. Classify early using a simple rubric:

Drift type	Example	Urgency
Security-critical	Public ingress or broken encryption	Act immediately
Reliability-critical	Load balancer or DNS change	Review within the hour
Hygiene	Missing tags or sizing drift	Track in the next sprint
Expected	Autoscaling or provider-managed fields	Document and skip

The output you want is not just “drift found,” but “drift found + what kind of attention it needs.”

3) Choose one of three actions for each finding

For each drift finding, require one decision:

Import: bring unmanaged resources under IaC control (where that’s the correct model).
Reconcile: run a governed apply that returns resources to the declared state.
Accept: allow a deviation temporarily with an expiry and justification.

A governed apply is the difference between fixing drift and accidentally creating new drift.

4) Build a reconciliation runbook reviewers can actually approve

Approval gates work only when reviewers receive the right context:

What drift was detected (resource + field-level summary).
Why it matters (severity + blast radius).
What remediation does (import vs reconcile vs accept).
What changes will be applied (plan summary).
Who approved it and when.

This is where OrchesTerra’s approval workflows become the control plane for reconciliation, not an afterthought.

Learn more about the approval pattern here: approval workflows.

Common pitfalls

Applying without a reviewed plan — always connect the remediation action to an auditable diff.
Treating all drift as urgent — noise kills review; classification reduces noise.
Fixing state only — update modules and guardrails so drift doesn’t recur.
No expiry for accepted drift — “temporary” drift becomes permanent.
Skipping post-remediation verification — reconcile plus verify closes the loop.

Recommended workflow for your next sprint

Triage drift report by severity.
For security-critical findings, open governed reconciliation work.
For unmanaged drift that should be managed, create an import plan.
For low-severity findings, track hygiene tasks or accept with expiry.

Start with a 14-day trial and connect your first cloud account—then iterate on the runbook with real drift signals.