Drift detection

When reality diverges from the template.

Drift is when the real configuration of a stack’s resources no longer matches the template — almost always because someone changed something by hand in the console or CLI to fix an incident, and never put it back in code. Drift is dangerous precisely because it is invisible until the next stack update, which may revert the manual fix or fail unexpectedly. Drift detection makes it visible.

$ aws cloudformation detect-stack-drift --stack-name payments-network
$ aws cloudformation describe-stack-resource-drifts \
    --stack-name payments-network --output table
| LogicalResourceId | DriftStatus |
| AppSecurityGroup  | MODIFIED    |   <- a rule was added by hand in the console

Fixing drift

Once detected, you reconcile: either update the template to match the intended real state (adopting the manual change into code), or update the stack to push the template’s state back onto the resource (discarding the manual change). The right choice depends on whether the drift was a good fix that belongs in code or an unauthorized change that should be reverted — but either way the resolution is to make code and reality agree again.