configuration-and-drift

Configuration and drift management

Learning objectives: keep deployed environments in the declared state — detect drift between desired and actual configuration, and manage configuration (parameters, secrets, policies) so environments stay reproducible.

Overview

IaC is only as good as its ability to hold the line. This module covers the two ends of the problem: configuration management — feeding runtime config (parameters, secrets from Azure Key Vault, App Configuration, policies) into deployments — and drift management — noticing and fixing when the live environment disagrees with the desired-state in code.

Units / lessons covered

• Parameters and parameter files per environment (dev/stage/prod) reused across a provisioning-pipeline
• Secrets & config from managed sources (Azure Key Vault, App Configuration) rather than baked into templates
• Azure Policy to enforce/comply desired state and block drift-causing misuse
• Drift detection: az deployment what-if, terraform plan, config-management agents (DSC/Ansible)
• Reconciling vs absorbing drift; immutable approach to prevent it

Concepts introduced (link to term notes)

• configuration-drift
• desired-state
• immutable-infrastructure
• provisioning-pipeline
• infrastructure-as-code

Key terms / commands

• az deployment group what-if · terraform plan · parameter files (.bicepparam / .parameters.json) · Key Vault references · App Configuration · Azure Policy deployIfNotExists · runtime parameter substitution

Hands-on / what to try

Deploy the same Bicep to dev/stage/prod with distinct parameter files; change a resource in the Portal and catch it with az deployment what-if; add an Azure Policy that re-asserts (or blocks) the desired SKU.

Exam focus

• Detect → decide: reconcile (re-apply desired) or absorb (promote the change into code) — pick by whether the change is wanted.
• Drift lives at both layers: resource template and inside-VM config.
• Immutability (replace, don’t patch) is the admission ticket to low-drift environments.

Related

Path MOC · intro-infrastructure-as-code · use-bicep-arm · terraform-in-azure