Estate drift: the infrastructure code and the provider disagree
Run the commands below from the installation directory. See Run operator commands for how ./lens reaches the running installation and copies files into it.
Your estate is described twice. The infrastructure codeInfrastructure codeFiles that describe the computing resources an organisation intends to create and how they should be configured. says what the estate is meant to be. The provider’s own export says what it reports. Both are documents, and NovusLens holds both. Where they disagree, it says so.
Three findingsFindingA difference in the records that needs a decision. It includes its sources and can describe a slow handoff, disputed fact or missing owner., one for each way they can differ.
| Finding | What it means |
|---|---|
| In the cloud account, not in the infrastructure code | The provider reports a resource inside a containerContainerA running program with its own packaged software and isolated environment, managed by Docker on the host. that the same export says a tool manages. The code for that tool does not describe the resource. A console change made by hand looks like this |
| In the infrastructure code, not reported by the provider | The code declares a resource the provider’s export does not report. The code may be ahead of the estate, or the export may be partial |
| Infrastructure code and provider describe the resource differently | Both describe the same resource and disagree about it, for example its region |
Neither side is corrected. Both accounts stay on the record with their own source. NovusLens does not decide which is right, and changes nothing in your estate.
How the two are matched. The code records the name it deploys under. That name is matched against the resource the provider reports, within the same provider and the same business domainDomainA business area defined by the work it does, such as purchasing or customs. It may involve several teams, and one team may serve several areas.. Names are never matched loosely: a resource the code declares without recording a deployed name cannot be compared at all, and is counted rather than guessed at.
Read the coverage before you read the findings. Every estate-drift finding carries the population it was drawn from: how many declared resources could be compared, how many could not, and how many reported resources were in scope. A sweep that finds nothing may mean the two accounts agree. It may also mean nothing was comparable. The coverage tells you which.
What is out of scope. Only the providers and domains your infrastructure code covers are compared. A cloud account the code says nothing about is not drifting; it is simply unmanaged, and a resource in a container that claims no tool raises nothing.
To run it. The drift sweep runs as part of link, after every estate document is loaded. To re-check it on its own, without loading anything again:
./lens connectors drift --org <org>It re-reads the newest estate document of each kind that the installation already holds, so it can be run at any time.