grceng.academy
YAML lab 40 bonus XP

Specify a drift monitor someone can act on

Start labRead the room

Objectives

The current monitor pages on-call with 'drift detected in production (3 resources)' and nothing else. Last night that cost ninety minutes of manual diffing to find one security group open to the internet among two intentional changes.

Specify it properly: compare against version-controlled declared state, emit a diff, state the detection latency the control promises, route to an owner with a runbook, and make suppressions expire.

What exists today, and what the platform can provide

current alert: "drift detected in production (3 resources)"

available:
  terraform_state   : version-controlled declaration of intended configuration
  cloud_api         : live configuration, pollable
  cloud_audit_log   : event stream, seconds behind the change
  oncall_rotation   : platform-security
  runbooks          : runbook://drift/security-group

incident: a security group was opened at 09:10 and closed at 09:40;
          the 02:00 nightly poll saw nothing.

Checks the server runs (5)

  • Declared state comes from version control
  • The monitor emits a diff, not a boolean
  • Detection latency is tightened past a nightly poll
  • Alerts carry an owner and a runbook
  • Suppressions must expire

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Pick the two sides of the comparison

    One side must be the version-controlled declaration so intentional changes are distinguishable from unauthorised ones; the fixture names it.

    Then change what the monitor emits: the on-call engineer needs resource, attribute, declared value and observed value rather than a count.

    Declared state comes from version controlThe monitor emits a diff, not a boolean

  2. Step 2

    State the promise the control is making

    A nightly poll promises detection within a day, which the 09:10 incident shows is not enough. Reduce the latency figure to something the event stream in the fixture can support, and keep the poll as a completeness backstop.

    Detection latency is tightened past a nightly poll

  3. Step 3

    Finish the alert

    Name the rotation that owns the response and link the runbook the fixture already provides.

    Then turn on the rule that stops a suppression from outliving the migration it was created for.

    Alerts carry an owner and a runbookSuppressions must expire

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.