How to Explain a Config Drift Issue in English
Learn how to explain in English that production configuration has drifted from its declared, infrastructure-as-code state — clearly enough for both engineers and non-technical stakeholders to understand the risk.
Config drift is a hard bug to explain because nothing is technically “broken” — the system is running, requests are succeeding, and the problem only becomes visible when someone tries to reason about the system using the declared configuration and gets a different answer than reality gives them. The English challenge is making an invisible mismatch feel concrete and urgent, without sounding like you’re describing a hypothetical.
Key Vocabulary
Declared state — the configuration that’s defined in code, version control, or an infrastructure-as-code tool, which is supposed to be the single source of truth for what the system should look like. “According to the declared state in our Terraform files, this security group only allows traffic from the internal VPC — that’s what anyone reading the repository would reasonably assume is true.”
Drift — any difference between the declared state and the actual running state, regardless of how it happened, which is the core concept that needs to be named explicitly rather than described vaguely as “something’s off.” “We found drift on twelve resources this week alone. Someone made a manual change through the console during an incident three months ago, and it was never reconciled back into the Terraform state.”
Out-of-band change — a modification made directly to a live system, outside the normal deployment or infrastructure-as-code pipeline, which is the most common cause of drift and worth naming specifically because it points at a process gap, not just a technical one. “This wasn’t a tooling failure — it was an out-of-band change made directly in the console during a 2am incident, which is exactly the kind of change our current process doesn’t have a safety net for.”
Reconciliation — the process of comparing declared and actual state and resolving the difference, either by updating the code to match reality or by reverting reality to match the code. “Reconciliation here means deciding, resource by resource, whether the manual change was actually correct and should be codified, or whether it was a mistake that should be rolled back to match the original declared state.”
Common Phrases
- “There’s drift between our declared state and what’s actually running in production — here’s specifically where they diverge.”
- “This appears to be the result of an out-of-band change, which means our infrastructure-as-code no longer reflects reality.”
- “Before we can safely change this further, we need to reconcile the drift so we’re working from an accurate picture.”
- “The risk with unreconciled drift is that the next deploy could silently revert this change, since our tooling doesn’t know about it.”
- “I’d like to run a drift detection pass on the rest of this environment before we assume anything else is in sync.”
Example Sentences
Explaining the discovery of drift without alarming people unnecessarily: “While investigating the incident, we found that this load balancer’s timeout setting doesn’t match what’s declared in our infrastructure code. It’s not currently causing a problem, but it means our documentation and our production environment disagree.”
Naming the root cause honestly, even when it points at a process gap: “This drifted because someone applied an emergency fix directly in the console during last month’s outage, which was the right call in the moment, but it was never reconciled back into our Terraform afterward.”
Proposing reconciliation as the concrete next step: “I’d like to reconcile this drift by codifying the manual change, since testing confirmed it was actually a necessary fix — then I’ll audit the rest of this environment for anything similar.”
Professional Tips
- Always specify which side is authoritative when describing the declared state — say explicitly whether the code or the running system is currently wrong, since “they don’t match” alone leaves the reader unsure what to trust.
- Quantify drift wherever you can, even roughly — “drift on twelve resources” is far more actionable than “some things have drifted,” and gives stakeholders a sense of scope.
- Name an out-of-band change honestly, without framing it as blame — most out-of-band changes happen during incidents under time pressure, and the useful takeaway is a process gap, not an individual’s mistake.
- Present reconciliation as a decision with two possible outcomes — codify the drifted state, or revert to the declared one — rather than assuming the fix is always to roll back.
- Follow up drift incidents with a proposal for drift detection tooling or a periodic audit, since a one-time fix without prevention just delays the next occurrence of the same issue.
Practice Exercise
- Write a sentence describing drift between a declared and actual state for a hypothetical database configuration.
- Explain, in two sentences, an out-of-band change and why it happened without assigning blame to an individual.
- Propose a reconciliation plan sentence that names both possible outcomes: codify or revert.