How do you handle a situation where someone manually changed a security group in AWS, causing your IaC state to drift at Age of Learning?