Drift Detection and Repair

About Drift

When you set up a landing zone, all the accounts, OUs, and resources will be compliant with the rules enforced by the governance policies applied. When you and your organization members use the landing zone, you can access the organization and manage SCPs via either RGC or Organizations. Operations performed on the two portals may result in changes to the compliance status of resources governed in the landing zone. If the resources do not comply with the governance policies, the following types of drift will occur:

• SCPs

  The SCPs configured for each OU in RGC are inconsistent with those configured in Organizations, or they are absent from Organizations.

• Organizational structure

  The OUs and accounts governed in RGC are different from those in Organizations.

When any of these inconsistencies arises, the current landing zone becomes non-compliant, which may result in unexpected consequences.

In such cases, RGC allows you to trigger periodic drift detection for accounts, OUs, and SCPs, and receive alerts when drift is detected. If any drift is identified, you can eliminate it by updating the landing zone or repairing the drift.

When the core OU or core accounts are in a drifted state, you are not allowed to create accounts in RGC.

Detecting Drift

RGC detects drift automatically. To detect drift, the RGCServiceExecutionAgency agency requires persistent access to your management account so that RGC can make read-only API calls to Organizations. These API calls will be recorded in CTS traces.

Drift messages are aggregated by Simple Message Notification (SMN). The management account can subscribe to SMN notifications. For details, see Publishing a JSON Message Using SMN. This way, you can receive drift notifications and repair drift in a timely manner. In RGC, you can detect the following types of governance drift:

• Organizational structure drift
  • SCPs have been updated.
  • SCPs have been deleted.
  • SCPs have been attached to OUs.
  • SCPs have been attached to accounts.
  • SCPs have been detached from OUs.
  • SCPs have been detached from accounts.
• Account drift
  • Accounts have been moved to another OU.
  • Accounts have been closed.
  • Accounts have been removed from an organization.

NOTE:

• If the same type of drift occurs on the same group of resources multiple times, RGC will only send an SMN notification for the first resource that drifts.
• If drift for a resource has been repaired, RGC will only send another SMN notification if drift recurs for that resource.

Examples:

• If you modify an SCP multiple times, you will receive an SMN notification for the first time you modify it.
• If you modify an SCP, then repair drift, then modify it again, and then the drift recurs, you will receive two SMN notifications.

Types of Drift to Repair Right Away

You can ensure your landing zone is compliant by updating settings or repairing drift. Although drift detection is automatic, the steps to repair drift must be done on the RGC console.

Most types of drift can be repaired by administrators. A few types of drift must be repaired immediately, including deletion of an OU required by the RGC landing zone. The following are some examples of how to avoid drift that requires immediate repair:

• Do not delete the core OU. The core OU originally named "Security" during landing zone setup should not be deleted. If you delete it, there will be drift. You will see an error message on the RGC console, instructing you to update or repair your landing zone immediately. You will not be able to perform any other operations in RGC until the update or repair is complete.
• Do not delete core accounts. If you delete a core account from a core OU, for example, deleting the log archive account from the core OU, your landing zone will be in a drifted state. You must update or repair the landing zone before you can continue using the RGC console.

Repairing Drift

If there is drift, you will see an error message on the RGC console, instructing you to update or repair your landing zone immediately. You only need to repair drift by clicking update the landing zone, repair the landing zone, or re-register the new OU as instructed.

If you have performed as instructed but drift persists, you can submit a service ticket for technical support.