After a weekend emergency, a county engineer discovers undocumented console changes on the permits firewall. How should the team treat the IaC repository going forward?
Select an answer to reveal the explanation.
Short Explanation
When the repo and the console disagree, pick the blueprint—not the scribbles on the whiteboard. The IaC repository is that blueprint for municipal firewalls. Console clicks without a PR are just drift waiting to surprise the next change window.
Full Explanation
After undocumented console changes appear on a permits firewall, the IaC repository must remain the source of truth. Treat live console edits as drift to be investigated and reconciled back to the repository—either by reverting the firewall to the declared ruleset or by capturing intentional emergency changes as reviewed pull requests that update the repo and then re-apply cleanly. Municipal change control and audit expectations both assume a versioned blueprint, not an unreproducible appliance UI.
Treating the live console as authoritative and updating the repo only when convenient inverts that model: every emergency weekend creates a new undocumented baseline, and the next automated apply may wipe “fixes” nobody recorded. Disabling the repo and managing all firewall rules through emergency tickets abandons reproducibility and peer review. Forking a private wiki dump of screenshots as the new baseline of record cannot be applied, diffed, or tested the way IaC can.
Exam caveat: source-of-truth does not mean “blindly overwrite production without reading the emergency change.” First understand why the console was touched (outage, vendor TAC, temporary ACL). Then either reverse the drift or promote the change into code with the same rigor as any other PR. Temporary break-glass access should have a time-boxed exception and a forced reconciliation ticket.
Operational check: export or query the live permits firewall ruleset, diff it against the last applied IaC plan, open a reconciliation PR for intentional deltas, apply from the repository, and confirm subsequent plans show no unexpected drift. Log who made the console change and close the emergency ticket only after repo and live state match.