Skip to main content
This lesson demonstrates how to detect and resolve configuration drift in AWS CloudFormation. Drift detection compares the actual, deployed resource configuration against what your CloudFormation template defines. This example uses a simple stack that provisions an S3 bucket and applies a tag to it.

​
Example CloudFormation template

The stack in this demo uses the following CloudFormation template:
CloudFormation expects the S3 bucket to have the exact tag Author: Arno (case-sensitive). If the actual resource differs in any tracked property, drift detection will flag it.

​
How to run drift detection from the CloudFormation console

  1. Open the CloudFormation console and select the stack to check.
  2. From the Stack actions menu choose View drift results.
  3. On the Drifts page you can:
    • Review previous drift results, or
    • Click Detect stack drift to start a new check.
A screenshot of the AWS CloudFormation "Drifts" page for a stack showing the Stack drift status as NOT_CHECKED and a prominent "Detect stack drift" button. The Resource drift status section is visible below.
When you first open the Drifts page for a newly created stack, the stack drift status will usually be NOT_CHECKED and the “Last drift check” time will be blank. No resources appear under drift until a check has completed. Clicking Detect stack drift initiates the check. The console returns a confirmation similar to:
After the check completes, a stack with no differences will show IN_SYNC. You can expand the resource list to see the logical ID, physical ID, resource type, and each resource’s drift status.

​
Example: Create drift by editing the resource directly

To demonstrate drift detection, modify the provisioned S3 bucket outside of CloudFormation. In this demo we remove the Author: Arno tag via the S3 console. The console prompts you to confirm the deletion:
A screenshot of the AWS console showing a "Delete user-defined tags" confirmation dialog asking to permanently delete one tag. The dialog lists the tag Key "Author" with Value "Arno" and shows Cancel and Delete buttons.
After removing the tag, run drift detection again (Stack actions → View drift results → Detect stack drift). The initiation message will appear again:
When the check completes the stack or resource shows a drift status such as MODIFIED, indicating the live resource properties no longer match the template:
A screenshot of the AWS CloudFormation "Resource drift status" page for a DemoStack, showing an S3 resource named "MyBucket" with a drift status labeled "MODIFIED" and a timestamp.

​
Restore the stack to IN_SYNC

To resolve the drift, update the resource so it matches the template exactly. In this example, re-add the tag with the exact key and value: Author (capital A) and Arno. After saving the change in the S3 console, run drift detection again. Once the check finishes the stack and resource should return to IN_SYNC:
A screenshot of the AWS CloudFormation console showing the "DemoStack" Drifts page with drift status "IN_SYNC" and a listed resource "MyBucket" (AWS::S3::Bucket). The last drift check time is displayed along with buttons to view or detect drift details.
When restoring configuration, be precise: tag keys and values (including case) must match the template exactly. Also note that CloudFormation drift detection does not examine every property for every resource type—some properties are not tracked. Check the AWS documentation for limitations and the list of supported resources and properties: CloudFormation Stack Drift Detection

​
Quick reference: common drift statuses

​
Best practices

  • Run drift detection regularly (e.g., after manual changes, automated deployments, or as part of audits).
  • Avoid making manual changes to resources managed by CloudFormation. Prefer updates via CloudFormation stacks or change sets.
  • If you must make manual edits, document them and consider updating the template to reflect desired state.
  • Understand CloudFormation’s supported properties for drift detection. Not all resource attributes are tracked.
That covers the typical flow for CloudFormation drift detection: initiate a check, review reported discrepancies, fix the configuration, and re-run detection to confirm the stack is back in sync.

Watch Video