BaselineSentinel — Drift Detection GuideStart Free Trial
Drift Detection

How AWS Drift Detection Works

BaselineSentinel automatically detects when your AWS infrastructure changes — whether resources are modified, added, deleted, or fall out of monitoring coverage. No Terraform state files required.

The Problem Every Engineer Faces

AWS environments change constantly

Someone resizes an instance through the console. A colleague launches a new RDS database without telling the team. A security group gets modified during a late-night incident. Infrastructure drifts from what you expect — silently.

Most teams find out too late

Without automated drift detection, changes go unnoticed until something breaks — a security audit fails, a backup is missing, or a bill spikes. Manual checks don't scale, and Terraform state alone only catches drift within its own scope.

Two-Module Architecture

BaselineSentinel uses two complementary modules to give you complete visibility into what changed and what's no longer covered.

Infrastructure Drift

Module 1

Compares consecutive inventory scans of your AWS account. Detects three types of changes:

  • Modified — config changed (security groups, instance type, encryption)
  • Added — new resource appeared
  • Deleted — resource no longer exists

Coverage Drift

Module 2 — Monitoring & Backup

What it means: When you use the dashboard to generate Monitoring or Backup Terraform, you choose which AWS resources to include (e.g. which EC2 instances get CloudWatch alarms, which RDS instances get backup plans). BaselineSentinel saves that "snapshot" of your choices. Coverage drift is when the real world no longer matches that snapshot — for example a resource you selected is gone, or a new resource appeared that you never chose to monitor or back up.

On each inventory scan, we compare current AWS resources against the last snapshot. That gives you two event types:

  • Coverage Gap — You had selected this resource for monitoring or backup in your last generated Terraform (e.g. you included it in the Monitoring or Backup page and clicked Generate). Now that resource no longer exists in AWS (terminated, deleted, etc.). So you thought it was covered, but it's gone — a "gap" in your coverage.
  • Untracked — A resource that exists in AWS now but was not in your inventory when you last generated monitoring or backup Terraform. Someone (or some pipeline) deployed it outside BaselineSentinel, so it was never part of your "selected" or "excluded" list. It's new to the system — worth reviewing so you can add it to monitoring/backup if needed.

How a Drift Scan Works

Drift detection is built into every inventory scan. Here's what happens behind the scenes.

1

Load Previous Inventory

BaselineSentinel loads all resources from the previous scan for this AWS account — types, IDs, configuration hashes, and tags.

2

Scan AWS via IAM Role

Using the read-only IAM role you configured, BaselineSentinel scans 20+ AWS services across all selected regions. EC2, RDS, S3, EBS, ALB, Lambda, ECS, VPN, and more.

3

Compare Previous vs. Current

Each resource is compared by its configuration hash. Resources in both scans with different hashes → Modified. Resources only in the new scan → Added. Resources only in the previous scan → Deleted.

4

Check Coverage Snapshots

If you've generated monitoring or backup Terraform, the system also compares current inventory against your last selection: selected resources that disappeared → Coverage Gap, new resources not in any selection → Untracked.

5

Create Events & Alert

Drift events are recorded in the timeline with severity classification. If you have alerts configured, notifications fire immediately (real-time) or accumulate for a daily digest.

Five Drift Event Types

Every detected change is classified into one of five types. You can toggle which types to detect in your drift settings.

Modified

Infrastructure

A resource exists in both the previous and current scan, but its configuration changed — security groups modified, instance type resized, encryption toggled, tags removed.

Example: EC2 security group changed from sg-abc to sg-xyzSeverity: Varies (Critical for security, Medium for tags)

Added

Infrastructure

A resource appeared in the latest scan that was not present in the previous scan. Someone launched a new EC2 instance, created an RDS database, or deployed a Lambda function.

Example: New EC2 instance i-0a1b2c3d launchedSeverity: Medium

Deleted

Infrastructure

A resource that existed in the previous scan is no longer present. An instance was terminated, a database was deleted, or a load balancer was removed.

Example: RDS instance prod-db-01 no longer existsSeverity: High

Coverage Gap

Monitoring / Backup

You had selected this resource for monitoring or backup in your last generated Terraform (e.g. you included it on the Monitoring or Backup page and clicked Generate). That resource no longer exists in AWS (terminated, deleted). So your "coverage" has a gap — something you intended to monitor or back up is gone.

Example: EC2 i-0a1b2c3d was in your monitoring Terraform but is now terminatedSeverity: High

Untracked

Monitoring / Backup

A resource that exists in AWS now but was not in your inventory when you last generated monitoring or backup Terraform. It was deployed outside BaselineSentinel (console, CLI, another tool), so it was never in your "selected" or "excluded" list. Worth reviewing so you can add it to monitoring or backup if needed.

Example: New RDS instance staging-db appeared — not in any previous TF selectionSeverity: Medium

Configurable Alerts

Get notified the way you prefer — immediately, once a day, or both.

Real-time

Alert fires immediately after each scan that detects drift. Best for critical environments.

Daily Digest

One summary per day with all unacknowledged events grouped by module and type. Only sends when events exist.

Channels

Email, Slack, Microsoft Teams, PagerDuty, Telegram, and AWS SNS. Configure multiple channels per org.

What You Don't Need

  • No Terraform state files — drift detection compares live AWS inventory, not .tfstate
  • No agents or sidecars — uses the same read-only IAM role you already set up
  • No AWS Config rules — BaselineSentinel handles scanning independently
  • No EventBridge setup — polling-based, not event-driven
  • No IaC expertise — works regardless of how infrastructure was deployed
  • No S3 bucket for state — optional convenience, not a requirement

Known Limitations

  • •Polling-based, not real-time event-driven. Drift is detected when a scan runs, not the instant a change occurs. The minimum scan interval is configurable (default: 24 hours, minimum practical: ~30 minutes).
  • •Covers 20+ AWS services, not all. BaselineSentinel scans EC2, RDS, S3, EBS, ALB, Lambda, ECS, VPN, and more. Niche or newer services may not be covered yet.
  • •First scan has no baseline. The very first inventory scan creates the baseline — no drift events are emitted until the second scan has something to compare against.
  • •Coverage drift requires TF generation. Coverage Gap and Untracked events only appear after you've generated monitoring or backup Terraform at least once (which creates the coverage snapshot).
  • •Intentional changes also trigger events. If you deliberately terminate an instance, it still shows as "Deleted". You can acknowledge it to clear it, or disable deleted-resource detection in settings.

Frequently Asked Questions

Does drift detection require Terraform state files?
No. BaselineSentinel detects drift by comparing consecutive AWS inventory scans — it reads live resource configurations directly from your AWS account via the IAM role. Terraform state is irrelevant. The optional S3 state setting is purely for Terraform's own state management convenience.
What happens if someone intentionally deletes an instance?
It appears as a "Deleted" drift event. You can acknowledge it to clear it from unacknowledged counts. If intentional deletions are common in your workflow, you can disable deleted-resource detection entirely in Settings → Detection Preferences.
How often does drift scanning run?
By default, every 24 hours per AWS account. You can configure the interval per account (drift_interval_minutes). Manual scans can be triggered anytime from the Drift Detection dashboard.
What's the difference between Infrastructure Drift and Coverage Drift?
Infrastructure Drift compares two inventory scans to find resource changes (modified, added, deleted). Coverage Drift compares your current inventory against the resources you selected when you last generated monitoring or backup Terraform — finding gaps where selected resources disappeared, or new resources that aren't covered.
Can I choose which drift types to detect?
Yes. In Drift Settings → Detection Preferences, you can independently toggle detection for Modified, Added, and Deleted resources. Coverage Drift (Coverage Gap and Untracked) is automatic when you've generated Terraform.
Does this work with multiple AWS accounts?
Yes. Each AWS account is scanned independently on its own interval. Drift events are tagged with the account ID and shown in a unified timeline.

Stop Finding Out About Changes After They Break Things

Automated drift detection for modified, added, deleted, and untracked AWS resources — with alerts on your terms.

Start Free TrialAWS Setup Guide