What is configuration drift, and how do you detect and handle it?
What they are really testing: Whether you understand drift as reality diverging from code (usually manual changes), that plan detects it, and that the real fix is enforcing all changes through IaC.
A real interview question
What is configuration drift, and how do you detect and handle it?
What most people say
drag me
“Drift is when the infrastructure changes; you fix it by running Terraform again.”
Partly right, but it does not explain the cause (manual out-of-band changes), how you detect it (plan), the choice between reverting and codifying, or the real prevention, enforcing IaC as the only change path.
The follow-ups they ask next
Someone fixed a setting manually in the console during an incident. How do you reconcile it?
Decide: if the change should persist, codify it in Terraform and apply so it is captured; if not, re-apply to revert to the declared state. Either way, get code and reality back in sync rather than leaving silent drift.
How do you prevent drift in the first place?
Make Terraform the only change path, restrict console write access, and run plan in CI (and on a schedule) to detect drift early. Drift is a symptom of out-of-band changes, so close that door.
What the interviewer is listening for
- Drift = reality diverges from code (manual changes)
- Detect with plan / scheduled checks
- Revert-or-codify + prevent by enforcing IaC
What sinks the answer
- No cause given
- Does not know plan detects it
- No prevention/process angle
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Drift is [reality no longer matching your code, usually from manual console changes]. Detect with [terraform plan (run on a schedule), it surfaces unexpected diffs]. Handle by [re-applying to revert, or codifying the change in Terraform and applying if it should stay]. Prevent with [process: make Terraform the only change path, restrict console writes, run plan in CI].”
Keep going with iac & automation
Foundation
What is Infrastructure as Code, and why use it instead of clicking through the console?
Foundation
What is the difference between declarative and imperative infrastructure as code?
Junior
What is Terraform state, and why does it exist?
Junior
Explain the Terraform workflow: init, plan, and apply.
Mid
Your team provisions infrastructure with code. Why does idempotency matter, and what breaks without it?
Mid
Why do teams use remote state with locking instead of local state?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free