Every cloud environment drifts. The question is whether you find the misconfiguration before an attacker.