Watch for drift

Drift is a configuration change made outside StackTakt that weakens a control your compliance posture depends on. StackTakt detects it by re-reading resource configurations during a compliance scan and comparing each against its accepted baseline.

How detection works

Detection runs the same control evaluators the compliance matrix uses, against both the baseline and the observed configuration. A finding opens when a control’s verdict weakens (for example, satisfied to partial, or partial to not satisfied). This means drift respects your framework parameters: a log-retention drop only counts as a regression if it falls below the floor your adopted framework actually requires.

Baselines start automatically. The first capture of a resource becomes its baseline; a resource that came from a deployment you approved is accepted by construction, while one that came from discovery is flagged for review, because nobody has yet agreed the account’s contents are correct.

When it runs

Drift detection is a pass inside the compliance scan. Scans run when you select Run compliance scan on the Compliance page, and automatically when a framework is adopted. There is no background schedule: findings appear when a scan runs, and drift never disappears by itself.

Reading a finding

Findings surface on the Compliance page (and as an Open Findings count on the tenant Overview). Each finding names the control key, the resource, and one plain sentence: what weakened, from what to what, since the baseline accepted on which date. A requirement whose control has an open finding shows the drift beside its status, downgraded until the finding is fixed or acknowledged.

Responding

Two honest options:

• Fix the resource in AWS, then run a scan. The evaluators see the restored configuration and the finding resolves.
• Acknowledge the finding (operators only) when the change was intentional. Acknowledging promotes the observed configuration to the new accepted baseline, records who acknowledged it and when, and writes a drift.acknowledged audit event.

Repeated scans update an open finding rather than stacking duplicates, so one real change is one finding.