Exercise 3: Why to Think Twice Before a Manual Console Fix on IaC-Managed Infrastructure — Possible Solution ==================================================================== Why to think twice: Per the chapter, if infrastructure is managed by an IaC tool, that tool maintains a state file recording what it believes currently exists, and compares that against the config's desired state every time it runs. A manual change made directly in the console -- however well-intentioned, and however urgently needed in the moment -- is INVISIBLE to the IaC tool. The tool's state file isn't automatically updated to reflect it. The real risk this creates: the NEXT time the IaC tool runs (whether as part of a scheduled process, a teammate's routine deployment, or any other trigger), it will compare its OWN stale, out-of-date understanding of reality against the config file -- and since it has no record of the manual fix, it may treat that fix as an unexpected deviation from the desired state and REVERT it automatically, silently undoing the very fix that was just made to resolve the incident. Worse, this could happen without the person who made the manual fix even being aware it was reverted, potentially causing the original problem to resurface unexpectedly, at a confusing and unpredictable later time. The better alternative practice: Per the chapter: make the fix AND update the IaC config to match it, not just the console alone. This keeps the tool's own tracked understanding of the infrastructure consistent with what's actually deployed, so the fix persists reliably rather than being silently undone the next time the tool runs -- treating the emergency fix as a genuine, permanent update to the desired state, not just a one-off manual patch that only the console remembers. WHY THIS WORKS AS AN ANSWER ------------------------------ This traces the exact mechanism by which a console-only fix gets undone -- the tool reconciling its stale state against the config on its next run -- directly from the chapter's own plan/apply workflow and state-file material, and gives the chapter's own stated fix ("update the IaC config to match it, not just the console") as the concrete alternative, rather than a vague "be careful" answer.