---
title: "Detect drift every day · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/drift-detection
updated: 2026-10-20
licence: "All rights reserved"
---

# Detect drift every day

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Infrastructure as code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code)
- Rule: Run a plan against every state at least once a day. Open a ticket when it finds a change nobody made in code.
- How: Run a scheduled CI job with the read-only plan role. `plan -detailed-exitcode` exits with 0 for no changes, 1 for an error and 2 for changes. Treat 2 as drift. Within 2 working days, either write the change into code or apply the code to undo it. Tools such as Spacelift, Atlantis or HCP Terraform offer the same as a service.
- Check: The drift job ran in the last 24 hours for every state. Change a tag by hand on a staging resource, and a ticket opens within 24 hours.

Example:

```yaml
on:
  schedule: [{ cron: '17 5 * * *' }]
jobs:
  drift:
    runs-on: ubuntu-latest
    strategy:
      matrix: { stack: [staging/network, staging/app, production/network, production/app] }
    steps:
      - uses: actions/checkout@<commit-sha>
      - run: |
          cd infra/${{ matrix.stack }} && tofu init -lockfile=readonly
          tofu plan -detailed-exitcode -lock=false || { code=$?; [ $code -eq 2 ] && ./open-drift-ticket.sh "${{ matrix.stack }}"; exit $code; }
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/drift-detection`.

- Previous: [Reuse versioned modules](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/versioned-modules)
- Next: [Protect resources that hold data](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code/protect-stateful-resources)
- [Infrastructure as code](https://agentwranglers.se/playbook/infrastructure/infrastructure-as-code)