Someone changed a security group in the cloud console for a city API. Automation must notice the live setup no longer matches the desired code. What capability is needed?
Select an answer to reveal the explanation.
Short Explanation
When someone edits the live security group by hand, the code and the real world start arguing. Drift detection is the smoke alarm that says these two no longer match.
Full Explanation
Drift detection compares live infrastructure against the coded desired state so out-of-band console changes—such as a security group edit on a city API—are noticed and remediated. Without it, automation and reality diverge until the next painful incident. Warm-site replication of only console screenshots fails as a detection mechanism. Certificate pinning for every YAML comment fails as unrelated. Manual deletion of all version control remotes after each hotfix fails and destroys the very source of desired state. Exam caveat: drift is the divergence problem; detection is the control that surfaces console and hot-fix changes against IaC. Operational check: enable provider drift tools or periodic plan refresh jobs, alert the municipal platform channel on non-empty diffs, and either import the change into code or revert live state per policy. In municipal platform operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand the failure modes avoided for citizen services. Re-check the decision after the next provider feature change or compliance update to ensure the same answer still holds for the city's estate. Confirm monitoring, access reviews, and backup coverage still align with the selected approach before closing the civic hypercare period.