# Measure how long important drift remains unexplained

A count of differences mixes harmless metadata with serious exposure. Track ownership, consequence and resolution time to understand whether the process works.

By Cobnex editorial. Published 2026-09-10. Updated 2026-09-11.

## Classify by operational meaning

Separate changes that affect access, availability, data protection and cost from low-impact metadata differences. Use the service context rather than a universal severity assigned to a field name.

A network rule change may be urgent, but narrowing it during incident containment is different from unexpectedly broadening it. Investigation determines the correct response.

Keep the classification and decision owner visible in the record.

## Measure detection and decision delay

Record when the live change occurred when reliable evidence exists, when it was detected and when an owner established the intended state.

A quick alert followed by several weeks without review is not effective control. Track the oldest unresolved high-impact finding and the number without an accountable owner.

Avoid making teams close findings merely to improve a target. A temporary acceptance needs a reason and review condition, not a status change that hides the remaining difference.

## Check reconciliation quality

Count findings resolved through code adoption, deliberate reversal or documented external ownership. Verify that the next deployment behaves as intended.

Measure recurrence of the same difference. Repeated drift can indicate two controllers fighting over a value or an emergency procedure that never feeds changes back into code.

Also record corrections that caused incidents. A low drift count achieved through unsafe automatic reversal is a poor result.

## Report coverage honestly

List the managed scopes and the detector's known resource or property limitations. A clean report should not imply that untracked infrastructure has been assessed.

Use periodic inventory comparison to find resources outside the maintained definitions where appropriate. Treat that as a related coverage problem rather than forcing it into the same metric.

Acceptance should show that consequential differences reach an owner quickly, receive a reasoned decision and remain resolved after deployment. The purpose is an explainable environment, not a dashboard with the smallest possible number.

## Sources

- [AWS CloudFormation: drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html)