Drift Detection
Open Operations → Drift Detection to see whether live cloud infrastructure still matches what you declared in code. Axio runs non-destructive IaC plans or previews on your stack’s assigned runner and surfaces differences as drift.
Access requires the operations platform entitlement (Professional and Enterprise) and organization permission drift:read. Creating watches, running checks, pausing monitors, and org drift settings require drift:manage. Applying remediation requires drift:remediate.
Infrastructure can change outside of your pipelines — manual console edits, emergency fixes, or external tools. Drift detection identifies those differences early so you can investigate, acknowledge, or remediate before environments become unreliable.
Supported engines
Drift monitors work with Terraform, OpenTofu, and Pulumi stacks that have deployed infrastructure:
| Engine | Check method |
|---|---|
| Terraform | Non-destructive terraform plan -refresh-only on the runner |
| OpenTofu | Non-destructive tofu plan -refresh-only on the runner |
| Pulumi | Non-destructive Pulumi preview on the runner |
Other IaC engines may appear in inventory but are not yet supported for Operations monitors.
CloudFormation stacks appear under All sources for visibility, but scheduled Operations monitors apply to IaC workspace watches only. CloudFormation drift uses stack deployment workflows with a DRIFT_DETECTION operation instead (open CloudFormation from the hub list).
How it works
Axio compares desired state (from your stack workspace or Git repository) with actual state in the cloud.
Git repository
in your cloud
preview and compares
Drift Detection dashboard
The page has four tabs:
| Tab | Purpose |
|---|---|
| Watched | Monitors you configured with schedules or manual checks |
| All sources | CloudFormation visibility, watched workspace summary, and inventory for ad hoc checks |
| Governance | Production SLO, posture reports, retention settings, MSP rollups, and auditor exports |
| External inventory | Discovered cloud resources with management, drift, and governance classification |
A status banner on Watched and All sources summarizes workspaces that need attention, failed checks, drift that is acknowledged or snoozed, or monitors waiting for a first check. The list auto-refreshes about every 30 seconds.
Watched
The Watched tab lists IaC workspaces under active drift monitors.
| Field | Description |
|---|---|
| Stack | Stack being monitored |
| Workspace | Workspace (environment) within the stack; shows Paused when the monitor is disabled |
| Engine | IaC engine — Terraform, OpenTofu, or Pulumi |
| Level | Stack (workspace desired state vs live) or Repository (Git vs state vs live) |
| Status | Result of the latest check (see statuses below) |
| Last checked | When the most recent check completed |
| Duration | How long the last check took |
| Schedule | Check frequency, Manual checks, or Paused |
| Actions | Run check, fix drift (when attention needed), stop watching (icon buttons) |
When check history exists, use Show trends & analytics for drift rate charts and scoreboard metrics.
Drift check statuses
| Status | Meaning |
|---|---|
| In sync | Live infrastructure matches declared configuration |
| Drift detected | Plan or preview found create, update, or destroy changes |
| Acknowledged | Display label when drift is detected but temporarily suppressed via acknowledge/snooze (underlying status remains drift detected) |
| Check failed | The check could not complete (generic error) |
| Plan failed | The IaC plan or preview failed on the runner |
| Runner unavailable | No runner was available to execute the check |
| Not checked yet | Monitor created but no check has run |
All sources
The All sources tab provides a hub view:
- CloudFormation stacks — Drift status from workflow-based CFN checks (not Operations monitors); rows open CloudFormation
- Watched IaC workspaces — Summary of monitored stacks with status and schedule
- Inventory (not watched) — Deployed stacks and workspaces eligible for drift checks; use Ad hoc check to run once without creating a schedule (requires
drift:manageand a supported engine)
After an ad hoc check, you can save the workspace as a watch for ongoing monitoring.
External inventory
The External inventory tab shows cloud resources discovered outside your declared stacks, with filters for management source (Axio-managed, external, unmanaged, and related states), reconciliation coverage, and per-resource drift/governance displays. Use it to find unmanaged or externally changed assets that will not appear on IaC workspace monitors alone.
Watch a stack
Use Watch stack to add a stack workspace to Drift Detection (drift:manage).
- Select the stack and workspace (one monitor per workspace — e.g. dev, stage, prod).
- Choose Drift comparison level:
- Stack workspace — Compare workspace desired configuration to live infrastructure
- Git repository — Sync from Git, then compare Git, state, and live cloud (three-way)
- Optionally enable scheduled drift detection and pick a frequency (continuous interval on the runner).
- Optionally run the first check immediately.
- Under Notification settings, configure ChatOps/email toggles, and optionally auto-remediate (apply when drift is detected).
Once watched, the workspace appears on the Watched tab with its current status and schedule.
The stack must have deployed infrastructure and a supported IaC engine (Terraform, OpenTofu, or Pulumi). Checks run on the stack's assigned runner policy.
Check outcomes
Each watched workspace displays the result of its most recent check.
The latest check completed successfully and live infrastructure matches the declared configuration.
The plan or preview found differences. Open the monitor detail view to review resource changes, severity, and remediation options.
The IaC plan or preview could not complete on the runner. This does not necessarily mean infrastructure drifted — investigate runner availability and workspace configuration first.
Check schedule
When you enable scheduled drift detection on a watch, choose from:
Leave scheduling off for Manual checks only. The Schedule column shows the configured frequency, or Paused when the monitor is disabled.
In-app drift notifications are always enabled for watches. Configure ChatOps (Slack, Teams, webhook) and email under Notificationsettings when creating or editing a watch. Subscribe integrations to the Driftdetected event under Administration → Integrations → ChatOps.
Manage watched stacks
The Actions column on the Watched tab provides:
- Run check now — Trigger an immediate drift check (
drift:manage) - Preview and fix drift — Shown when the workspace needs attention; opens remediation preview (
drift:remediate) - Stop watching — Remove the monitor and stop scheduled checks (
drift:manage)
Click a row to open the monitor detail dialog for check history, resource diffs, plan output, readiness checks, insights, acknowledge/snooze controls, and watch settings (schedule, auto-remediate, pause).
Acknowledge drift to suppress alerts temporarily while you investigate. Snooze pauses alerting for a period. Fix drift runs guided or apply remediation when permitted by stack policy (including optional require acknowledgment before remediate and block stack apply while unacknowledged drift settings).
Permissions
| Permission | Capability |
|---|---|
drift:read | View monitors, check history, hub/inventory, reports, and SLO status (Operations Drift UI) |
drift:manage | Create watches, run checks, ad hoc checks, pause/stop monitors, configure org drift settings |
drift:remediate | Preview and apply drift remediation (terraform apply, tofu apply, or pulumi up on the runner) |
The operations platform entitlement (Professional and Enterprise plans) gates Drift Detection APIs and the Operations UI.
Governance
The Governance tab includes:
- Production check SLO — Target percentage of production stacks checked within a rolling window. Production stacks are identified from deployment context linked to environments with catalog type PRODUCTION (not name patterns).
- Posture report — Markdown summary of drift health (downloadable); optional Email + ChatOps delivery
- Operations drift auditor pack — ZIP export of posture and evidence artifacts
- Check history retention — How long check records are kept (plus configurable prod SLO target and window)
- MSP rollup — Parent organizations can view child-tenant SLO and open drift episodes
A failed drift check does not necessarily mean infrastructure has drifted. The check itself may have failed because the IaC plan or preview could not complete on the runner. Only Drift detected status confirms a difference between declared and live state.