CloudFormation Drift Detection: What It Is and When to Use It

Definition

AWS CloudFormation drift detection is a feature that identifies unmanaged configuration changes made to stack resources outside of CloudFormation's control. It solves the problem of "infrastructure drift," where the actual state of a resource diverges from the state defined in its CloudFormation template, helping to ensure configuration consistency and the integrity of your Infrastructure as Code (IaC). [1, 2, 6]

How It Works

CloudFormation drift detection works by comparing the current configuration of your stack's resources against the expected configuration defined in the CloudFormation template. [1, 2] The process is initiated on-demand by a user, either for an entire stack or for specific resources within a stack. [14, 15]

When a drift detection operation runs, CloudFormation performs the following steps:

1. Initiation: A user starts the process via the AWS Management Console, AWS Command Line Interface (CLI), or an AWS SDK. [10]
2. Comparison: For each resource in the stack that supports drift detection, CloudFormation reads its current property values. It then compares these actual values with the expected values derived from the template and any specified stack parameters. [2]
3. Status Reporting: After the comparison, CloudFormation assigns a drift status to each resource and a summary status to the overall stack. [1] The possible statuses are:
   • IN_SYNC: The resource's current configuration matches the template's definition. [1]
   • MODIFIED: The resource exists, but one or more of its properties have been changed, added, or removed. [14] CloudFormation provides a detailed report of which properties have been altered. [15]
   • DELETED: The resource, which was defined in the template, no longer exists in the AWS account. [1]
   • NOT_CHECKED: CloudFormation did not perform a drift check on this resource, typically because the resource type does not support drift detection. [2]

A stack is considered to have drifted if one or more of its resources are in a MODIFIED or DELETED state. [2, 7]

Key Features and Limits

• Broad Resource Support: Drift detection is supported for a wide range of AWS resources. As of 2020, all new provisionable resource types added to the CloudFormation Registry, including third-party and private types, automatically support drift detection. [5, 18] For a current list, always consult the official AWS documentation. [11]
• Granular Detection: You can run a drift detection operation on an entire CloudFormation stack or on individual resources within a stack. [14, 15]
• Detailed Differences: For resources with a MODIFIED status, CloudFormation provides a detailed view showing the expected and actual values for each drifted property. [15]
• Event-Driven Automation: CloudFormation publishes drift detection status change events to Amazon EventBridge. [3, 4] This allows you to build automated workflows, such as sending notifications via Amazon Simple Notification Service (SNS) or triggering an AWS Lambda function to create an alert or attempt remediation. [7]
• Concurrency Limit: You can only run one drift detection operation at a time on a specific stack. [15] The operation can take several minutes for stacks with a large number of resources.

Common Use Cases

• Auditing and Compliance: Regularly running drift detection helps ensure that your infrastructure remains in its intended, compliant state, as defined by your templates. This is crucial for security audits and maintaining governance. [6, 10]
• Enforcing IaC Best Practices: By identifying manual changes, drift detection encourages teams to adhere to IaC principles, where all changes are made through template updates. This prevents the template from becoming an outdated representation of the environment. [1, 12]
• Troubleshooting Operational Issues: When an application behaves unexpectedly, drift detection can quickly identify unauthorized or accidental configuration changes (e.g., a modified security group rule) that may be the root cause. [2, 16]
• Validating Pre-Deployment State: Before applying a stack update, running drift detection can identify out-of-band changes that might cause the update to fail or have unintended consequences.

Pricing Model

There is no direct charge for using the AWS CloudFormation service or its drift detection feature. You are billed for the AWS resources (like Amazon EC2 instances, Amazon S3 buckets, etc.) that you create and manage using CloudFormation stacks, based on the pricing for those specific resources. The use of drift detection operations does not incur any additional fees.

However, costs may be incurred by related services used for automation, such as Amazon EventBridge, AWS Lambda, and Amazon SNS, depending on your usage. Always refer to the AWS Pricing Calculator for the most accurate and up-to-date information.

Pros and Cons

Pros:

• Native Integration: It is a built-in feature of CloudFormation, requiring no third-party tools or complex setup.
• Improved Governance: Provides a clear mechanism for identifying unmanaged changes, strengthening control over your cloud environment. [1]
• Enhanced Security Posture: Helps detect unauthorized modifications to critical security configurations like IAM policies or security groups. [16]
• Increased Reliability: By ensuring configuration consistency, it reduces the risk of failures caused by unexpected changes. [7]

Cons:

• Detection, Not Prevention: Drift detection only reports on drift after it has occurred; it does not prevent users with sufficient permissions from making manual changes. [1]
• No Automatic Remediation: CloudFormation does not automatically revert drifted resources to their template configuration. Remediation must be handled as a separate process, either manually or through custom automation. [1, 17]
• Incomplete Coverage: Not all AWS resource types or all properties within a resource support drift detection. [12]
• Ignores Default Values: Drift is only detected on properties that are explicitly set in the template. If a property is using a service default and is later changed manually, drift detection will not flag it unless that property was explicitly defined in the template. [2, 12]

Comparison with Alternatives

CloudFormation Drift Detection vs. AWS Config

While both services address configuration management, they serve different primary purposes:

• Scope and Focus: CloudFormation Drift Detection is narrowly focused on comparing a stack's current state to its template. AWS Config is a much broader service that continuously monitors and records the configuration of AWS resources across an account, providing a detailed history of all changes. [9]
• Trigger: Drift detection is an on-demand operation that you must initiate. [15] AWS Config runs continuously, recording changes as they happen.
• Source of Truth: For drift detection, the source of truth is the CloudFormation template. For AWS Config, the source of truth is a set of configurable rules (AWS Managed and custom) that define your desired compliance state. [9]
• Integration: The two services can be used together. AWS Config has a managed rule, CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK, that can be used to proactively and continuously monitor the drift status of your CloudFormation stacks. [8, 13]

In short, use CloudFormation Drift Detection for on-demand checks against your IaC source of truth. Use AWS Config for continuous compliance monitoring, auditing, and tracking the configuration history of all resources, whether managed by CloudFormation or not.

Exam Relevance

CloudFormation Drift Detection is a relevant topic for several AWS certifications, particularly:

• AWS Certified DevOps Engineer - Professional (DOP-C02): Examinees should understand how to use drift detection as part of a governance and operational excellence strategy. Questions may focus on automating drift detection and notification.
• AWS Certified Solutions Architect - Associate (SAA-C03) & Professional (SAP-C02): Architects should know what drift is, why it's a problem, and how drift detection helps maintain the state and reliability of infrastructure deployed via CloudFormation. Understanding its limitations (e.g., detection vs. remediation) is key.

This concept aligns directly with the Operational Excellence Pillar of the AWS Well-Architected Framework, which emphasizes performing operations as code and anticipating failure.

Frequently Asked Questions

Q: Can CloudFormation Drift Detection automatically fix or remediate drift?

A: No, drift detection is strictly a reporting mechanism. [1] It identifies and details the differences between the template and the actual resource state but does not take corrective action. To remediate drift, you must either manually update the resource to match the template or update the CloudFormation stack to codify the change. [17]

Q: How can I be notified automatically when drift is detected in a stack?

A: You can use Amazon EventBridge to create a rule that listens for CloudFormation Drift Detection status change events. [3] This rule can then trigger a target, such as an Amazon SNS topic to send an email or SMS notification, or an AWS Lambda function for custom processing. [7]

Q: What does a resource drift status of NOT_CHECKED mean?

A: A NOT_CHECKED status indicates that CloudFormation did not perform a drift check on that specific resource. [1] This is typically because the resource type itself does not support drift detection. [2]

---

This article reflects AWS features and pricing as of 2026. AWS services evolve rapidly — always verify against the official AWS documentation before making production decisions.