Runbook: Respond to a Drift Incident

1 · Prerequisites

Confirm every item is in place before any state change.

• Detected drift via refresh-only plan
• Access to the production environment

2 · Pre-checks

Read-only diagnostic commands. If any of these don't match expected output, stop and investigate further.

• · Drift is verified
• · State is in the backend

3 · Procedure

Execute each step in order. Verify the expected output of a step before moving to the next.

1. 1Investigate the cause
2. 2Decide the remediation
3. 3Accept the drift or reconcile
4. 4Apply the change
5. 5Document the incident

4 · Verification

Confirm the procedure actually fixed the problem.

• ✓State is consistent with the desired state
• ✓Plan is empty
• ✓Incident is documented

5 · Rollback

If verification fails, undo the procedure in reverse order.

• ↶If the change is wrong, restore the previous state

6 · Escalation

When the runbook isn't enough, contact:

• · If the drift is from a security incident, escalate to the security team