A security group managed by CloudFormation may have been changed in the console.
Compare the live resource with its template-defined expected state.
Which feature is most appropriate?
Run CloudFormation drift detection to identify changes made outside the stack template.
Detailed explanation
S3 versioning does not detect drift in CloudFormation resources.
S3 versioning does not detect drift in CloudFormation resources.
DNS monitoring does not compare a resource with its template.
DNS monitoring does not compare a resource with its template.
Deleting audit records does not detect the current configuration difference.
Deleting audit records does not detect the current configuration difference.
Drift detection compares the current resource configuration with the stack's expected template state.
Drift detection compares the current resource configuration with the stack's expected template state.
Check official documentation
Compare the following points with the official documentation.
AWS CloudFormation drift detectionの公式説明を確認する。
What to confirm
スタックイベント、変更セット、ドリフト検出を区別できる。
Key points
- Drift detection
- CloudFormation
- Expected state
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Out-of-band change
Console or API edits outside the stack can create drift without changing the template.
Detection versus remediation
Drift detection reports differences; a separate update or manual action decides how to correct them.