---
title: Drift Setup
description: Configure real-time and scheduled compliance drift monitoring for your cloud infrastructure.
---

import { Tabs, TabItem, Aside } from '@astrojs/starlight/components';

ComplyForm monitors your infrastructure for compliance drift — changes that degrade your compliance posture after initial assessment.

## Monitoring Modes

| | Scheduled | Event-Driven |
|---|---|---|
| **Latency** | Minutes to hours (poll interval) | Seconds (near real-time) |
| **Setup** | One CLI command | Cloud-native event pipeline + CLI |
| **Tier** | All tiers | Team+ |
| **Cost** | Included | Cloud event service costs apply |
| **Best for** | Dev/staging, low-change environments | Production, audit-sensitive workloads |

Scheduled mode runs `complyform scan` on a cron interval you define. Event-driven mode reacts to infrastructure changes as they happen.

## Architecture

Event-driven drift monitoring follows this flow:

```
Cloud resource change
  → Cloud event service (CAI / EventBridge / Event Grid)
    → HTTPS webhook POST to api.complyform.dev/v1/drift/event
      → ComplyForm re-assesses affected resources
        → Alert (email / webhook / dashboard)
```

Each cloud provider has a native event service that forwards resource changes to the ComplyForm API. The API validates the event signature, identifies the affected project and framework controls, re-runs the relevant assessments, and fires alerts if the compliance posture has changed.

## Getting Started

Choose your cloud provider to set up the event pipeline:

- [GCP — Cloud Asset Inventory](../gcp/)
- [AWS — EventBridge](../aws/)
- [Azure — Event Grid](../azure/)

For scheduled-only monitoring, skip the cloud setup and go directly to the [Drift Monitoring guide](../../guides/drift-monitoring/).

## Alert Configuration

Configure drift alerts for your project:

```bash
complyform dashboard project configure \
  --drift-alerts=enabled \
  --alert-threshold=medium \
  --alert-email=security@example.com \
  --alert-webhook=https://hooks.slack.com/services/T00/B00/xxx
```

`--alert-threshold` controls the minimum severity that triggers a notification. Set it to `critical` for high-signal alerting or `low` to catch every change.

## Webhook Security

Every drift event POST includes an `X-Complyform-Signature` header containing an HMAC-SHA256 digest of the request body, signed with your per-project webhook secret. The secret is generated during `complyform dashboard project drift enable` and displayed once. Store it securely — you will need it when configuring your cloud event subscription.

ComplyForm verifies inbound events against this signature before processing. Requests with missing or invalid signatures are rejected with `401 Unauthorized`.

## Next Steps

- [GCP Drift Setup](../gcp/) — Cloud Asset Inventory real-time feeds
- [AWS Drift Setup](../aws/) — EventBridge with Config change events
- [Azure Drift Setup](../azure/) — Event Grid system topics
- [Drift Monitoring Guide](../../guides/drift-monitoring/) — dashboards, alert tuning, and triage workflows
