Drift detection

A drift check compares your infrastructure with your code on a schedule. It is a plan that only reports: it never applies, doesn't ask for approval and doesn't keep the plan file.

Set the interval

drift_interval_minutes is an inherited setting, like any other in the tree. It accepts 15 minutes to 7 days (10080 minutes), and 0 turns it off. It is off when no level defines it.

curl -s -X PUT -H "$H" $O/folders/$F/settings -d '{"drift_interval_minutes": 360}'

A PUT replaces what the level defines. Send the folder's other settings and variables along with it.

How it runs

The server creates a drift run when a check is due and the stack is free. Like any run, it takes its turn on the stack's lock.

The result stays on the stack and appears in the UI:

The stack's Resources tab also marks what the last check found, until an apply finishes after it.

Check now

Start a run of type drift:

curl -s -H "$H" $O/stacks/$ST/runs -d '{"type": "drift"}'

What counts as drift

Everything a plan would change. That includes changes made outside your code, and also commits on the branch that haven't been applied yet.

State during a drift check

The drift phase's credential can read and lock the state, but not write it. A drift check never changes state. See State backend.