> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans.md).
# IaC Drift Detection scans
IaC drift detection identifies discrepancies between the desired state defined in your Infrastructure as Code (IaC) templates and the actual state of your deployed cloud resources. This allows you to spot unauthorized changes, manual overrides, and configuration drift before they introduce security vulnerabilities.
By correlating declared infrastructure templates with live cloud resources via Code to Cloud lineage, drift detection preserves Git as your single source of truth (SSOT). Cortex evaluates drift using a misconfiguration-based detection model. It surfaces discrepancies only when a runtime resource violates a security or compliance rule that its corresponding IaC definition does not. This ensures that flagged issues reflect genuine security risks rather than expected operational variances.
Closing the gap between code-defined infrastructure and runtime reality prevents untracked risks. Without drift detection, manual changes applied directly to cloud environments—such as relaxed security group rules, modified IAM policies, or disabled encryption—bypass your IaC-governed deployment pipelines and silently weaken your security posture.
**Scope**: The IaC Drift Detection page consolidates all drift issues across your monitored cloud accounts and repositories into a single view. The default **Issues** tab lists policy-evaluated drift issues. **Findings** lists raw scanner output, including results without a matching unified policy.
### Prerequisites
To enable drift detection, ensure your environment meets the following requirements:
| Prerequisite | Requirement |
| -------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **License** | An active Cortex Cloud license with Application Security add-on entitlements. |
| **RBAC role** | The AppSec Admin or SOC Analyst role. An equivalent custom role needs drift management permissions. |
| **Cloud service provider integration** | Target AWS, Azure, or GCP accounts must be onboarded and returning data. The integration must read the live infrastructure state. |
| **Version control system (VCS) integration** | The platform must read the intended infrastructure state from code repositories.
Repository integration: An active integration with a supported provider, such as GitHub, GitLab, Bitbucket, or Azure DevOps.
Supported formats: Valid Terraform (.tf) or CloudFormation (.yml/.json) templates.
File structure: Visibility into the root directory containing IaC templates.
|
| **IaC scanner** | Enable the IaC scanner for target repositories. See Supported frameworks for supported frameworks. |
| **Code-to-Cloud Mapping** | Active Code-to-Cloud traceability must link repository IaC templates to deployed resources. Drift detection uses this mapping to compare declared and runtime states. |
| **Resource tagging** | A common identifier must correlate the VCS code block with the live cloud resource.
Tagging Bot: Enable the Tagging Bot in Manage repository scan configurations.
yor trace tags: Configure tags manually. See the Yor documentation.
|
| **Rule mapping** **(Critical)** | Drift applies only to IaC rules mapped to a corresponding CSPM rule. Unmapped rules lack a runtime signal and cannot generate drift issues. Drift is not evaluated when the declared resource cannot resolve to a specific runtime resource. |
| **Periodic scan** | At least one completed periodic scan must include IaC drift detection results. |
### Core achievements and use cases
* **Detecting unauthorized changes and shadow modifications:** Drift detection identifies changes made directly to cloud resources outside the IaC deployment pipeline, such as console modifications, CLI overrides, or API calls, that bypass code review, policy evaluation, and audit controls. Detecting unauthorized changes prevents security-weakening modifications from persisting undetected in production environments
* **Maintaining IaC as the single source of truth:** Drift detection enforces the principle that all infrastructure changes must flow through the IaC pipeline. When drift is detected, Cortex Cloud surfaces the deviation and provides remediation paths to either revert the cloud resource to the IaC-defined state or update the IaC template to codify the change. Maintaining IaC as the authoritative configuration source ensures that security policies, compliance controls, and audit trails remain intact
* **Reducing configuration entropy:** Over time, manual changes accumulate across cloud environments, creating configuration entropy, a state where the actual infrastructure diverges significantly from the declared state. Drift detection quantifies configuration entropy by measuring the number and severity of drifted resources, enabling AppSec managers to track posture degradation and enforce remediation cadences
* **Establishing compliance evidence for audits:** Drift detection provides auditable evidence that deployed cloud resources conform to the configurations defined in IaC templates. Mapping drift issues to specific resources, properties, and timestamps creates a compliance trail that satisfies CIS Benchmarks, SOC 2, NIST SP 800-53 (CM-3 Configuration Change Control, CM-6 Configuration Settings), ISO 27001 (A.12.1.2 Change Management), and organizational security policy requirements
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/application-security/code-security/code-security-scanners/iac-drift-detection-scans.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.