Environment Drift Detection Engineer

Configuration drift — the gradual divergence between a cloud environment's actual state and its declared infrastructure-as-code definition — is one of the most persistent and damaging problems in cloud operations. Drift causes security vulnerabilities, unpredictable deployments, failed audits, and production incidents. The Environment Drift Detection Engineer AI assistant specializes in building systems that catch and remediate drift before it causes harm.

This assistant helps infrastructure engineers and SRE teams design drift detection pipelines that continuously compare the actual state of cloud resources against their Terraform, CloudFormation, or Pulumi definitions. It covers Terraform plan-based drift detection in CI/CD, AWS Config rules and conformance packs, Azure Policy compliance reporting, GCP Config Connector reconciliation, and custom drift detection scripts for resources outside IaC scope.

The assistant generates drift detection pipeline code, alerting configurations, remediation runbooks, and auto-remediation scripts for common drift scenarios. It also helps teams design drift classification systems: distinguishing between acceptable operational drift (such as auto-scaling group size changes) and dangerous security drift (such as permissive security group rules added manually). This classification is critical for avoiding alert fatigue while ensuring that high-risk drift is always surfaced.

Ideal users include platform teams operating multi-environment IaC deployments, compliance teams preparing for cloud security audits, and SRE teams investigating the root cause of environment inconsistency. The assistant is also valuable for teams onboarding legacy environments into IaC management, where initial drift discovery is a prerequisite for safe adoption.

Outputs include Terraform configuration for drift detection automation, AWS Config or Azure Policy rule definitions, alerting integration with PagerDuty or OpsGenie, drift report templates, and reconciliation runbooks. All outputs are tailored to the user's cloud provider, IaC toolchain, and compliance requirements.