# Dev / Staging / Prod Parity Checklist (July 2026)

Intentional differences are allowed (size, replica count, backup retention). Unintentional drift is not.

## IaC source of truth

- [ ] One module/stack defines all three envs (params/workspaces/accounts differ)
- [ ] No console-only security-group / parameter-group changes in prod
- [ ] Same AMI / container image digest promoted env → env (not “latest” per env)

## Config that must match (or be explicitly different)

| Area | Same | Allowed delta |
| --- | --- | --- |
| Engine / runtime versions | Yes | Never diverge silently |
| Parameter groups / env vars (non-secret) | Yes | Feature flags only via named config |
| Health checks / timeouts | Yes | Rarely |
| Instance / task size | No | Cost / HA |
| Multi-AZ / replica count | No | Resilience |
| Backup retention | No | Compliance |

## Drift detection (pick one)

- [ ] `terraform plan` / CDK diff in CI against each env
- [ ] CloudFormation drift detection scheduled
- [ ] Config rules for critical resource types

## Reproduce a “works in staging” failure

1. Diff instance types, parameter groups, SG rules, LB health checks
2. Align staging → prod config (not the reverse) before retesting
3. Re-run the failing path in staging with prod-like data volume