Flash card
AWS CloudFormation drift detection: comparing deployed resource configuration against the stack's template.
- Reports each resource as IN_SYNC, MODIFIED, DELETED, or NOT_CHECKED, with a property-level diff of expected against actual.
- Not every resource type supports it, so NOT_CHECKED is a real result and not a failure.
- Detection is on demand, not continuous; keeping an eye on drift means scheduling it, typically via EventBridge and Systems Manager Automation.
- Detecting drift changes nothing by itself. Reconciling means updating the template to match reality or re-applying the template over the change.
- Works on StackSets too, reporting which stack instances have drifted.
Pick it when
Pick it when the scenario describes out-of-band changes: a console edit, a manual fix during an incident, a security group someone widened. It is the only mechanism that compares the template against what is actually deployed.
It's the wrong answer when
It is the wrong answer for preventing the change in the first place, and for continuous compliance. Stopping the edit is an SCP or an IAM policy; continuously evaluating configuration against rules across an organisation is AWS Config, which also remediates.