> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Drift Detection in CloudFormation

> Guide demonstrating AWS CloudFormation drift detection using an S3 bucket tag change, showing detection, remediation, drift statuses, and best practices.

This lesson demonstrates how to detect and resolve configuration drift in AWS CloudFormation. Drift detection compares the actual, deployed resource configuration against what your CloudFormation template defines. This example uses a simple stack that provisions an S3 bucket and applies a tag to it.

## Example CloudFormation template

The stack in this demo uses the following CloudFormation template:

```yaml theme={null}
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      Tags:
        - Key: Author
          Value: Arno
```

CloudFormation expects the S3 bucket to have the exact tag `Author: Arno` (case-sensitive). If the actual resource differs in any tracked property, drift detection will flag it.

## How to run drift detection from the CloudFormation console

1. Open the CloudFormation console and select the stack to check.
2. From the **Stack actions** menu choose **View drift results**.
3. On the Drifts page you can:
   * Review previous drift results, or
   * Click **Detect stack drift** to start a new check.

![A screenshot of the AWS CloudFormation "Drifts" page for a stack showing the Stack drift status as NOT\_CHECKED and a prominent "Detect stack drift" button. The Resource drift status section is visible below.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Demo-Drift-Detection-in-CloudFormation/aws-cloudformation-drifts-not-checked-button.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=32c14a2e3432f55b50a5d784b3841f61)

When you first open the Drifts page for a newly created stack, the stack drift status will usually be `NOT_CHECKED` and the "Last drift check" time will be blank. No resources appear under drift until a check has completed.

Clicking **Detect stack drift** initiates the check. The console returns a confirmation similar to:

```bash theme={null}
Drift detection initiated for arn:aws:cloudformation:us-east-2:635573991785:stack/DemoStack/9a6c3970-9f2b-11f1-b291-0aa846e1932f
```

After the check completes, a stack with no differences will show `IN_SYNC`. You can expand the resource list to see the logical ID, physical ID, resource type, and each resource’s drift status.

## Example: Create drift by editing the resource directly

To demonstrate drift detection, modify the provisioned S3 bucket outside of CloudFormation. In this demo we remove the `Author: Arno` tag via the S3 console. The console prompts you to confirm the deletion:

![A screenshot of the AWS console showing a "Delete user-defined tags" confirmation dialog asking to permanently delete one tag. The dialog lists the tag Key "Author" with Value "Arno" and shows Cancel and Delete buttons.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Demo-Drift-Detection-in-CloudFormation/aws-delete-tag-author-arno.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=f605cb2802f463eec88b3971fc2833a8)

After removing the tag, run drift detection again (Stack actions → View drift results → Detect stack drift). The initiation message will appear again:

```bash theme={null}
Drift detection initiated for arn:aws:cloudformation:us-east-2:635573991785:stack/DemoStack/9a6c3970-9f2b-11f1-b291-0aa846e1932f
```

When the check completes the stack or resource shows a drift status such as `MODIFIED`, indicating the live resource properties no longer match the template:

![A screenshot of the AWS CloudFormation "Resource drift status" page for a DemoStack, showing an S3 resource named "MyBucket" with a drift status labeled "MODIFIED" and a timestamp.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Demo-Drift-Detection-in-CloudFormation/cloudformation-drift-demostack-mybucket-modified.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=e167f050bd2a3bacb8a505d328ac6607)

## Restore the stack to IN\_SYNC

To resolve the drift, update the resource so it matches the template exactly. In this example, re-add the tag with the exact key and value: `Author` (capital A) and `Arno`. After saving the change in the S3 console, run drift detection again. Once the check finishes the stack and resource should return to `IN_SYNC`:

![A screenshot of the AWS CloudFormation console showing the "DemoStack" Drifts page with drift status "IN\_SYNC" and a listed resource "MyBucket" (AWS::S3::Bucket). The last drift check time is displayed along with buttons to view or detect drift details.](https://mintcdn.com/kodekloud-c4ac6d9a/5BuH6-_lHDMy3nuh/images/AWS-Certified-DevOps-Engineer-Professional/Domain-2-Configuration-Management-and-IaC/Demo-Drift-Detection-in-CloudFormation/cloudformation-demo-stack-drifts-mybucket-insync.jpg?fit=max\&auto=format\&n=5BuH6-_lHDMy3nuh\&q=85\&s=3e7ce046c88c29202b589477a7beb350)

When restoring configuration, be precise: tag keys and values (including case) must match the template exactly. Also note that CloudFormation drift detection does not examine every property for every resource type—some properties are not tracked. Check the AWS documentation for limitations and the list of supported resources and properties: [CloudFormation Stack Drift Detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html)

## Quick reference: common drift statuses

| Drift status | Meaning | Recommended action |
| - | - | - |
| `NOT_CHECKED` | No drift detection has been performed for this stack. | Run drift detection to generate results. |
| `IN_SYNC` | Resource properties that are tracked by CloudFormation match the template. | No action required. |
| `MODIFIED` | A tracked property on the resource differs from the template. | Inspect the differences and update the resource or template. |
| `DELETED` | A resource that is defined in the template cannot be found in the account. | Recreate the resource or update the template to remove it. |

## Best practices

* Run drift detection regularly (e.g., after manual changes, automated deployments, or as part of audits).
* Avoid making manual changes to resources managed by CloudFormation. Prefer updates via CloudFormation stacks or change sets.
* If you must make manual edits, document them and consider updating the template to reflect desired state.
* Understand CloudFormation’s supported properties for drift detection. Not all resource attributes are tracked.

## Links and references

* [AWS CloudFormation drift detection documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html)
* [AWS CloudFormation console](https://console.aws.amazon.com/cloudformation)
* [Amazon S3 console](https://console.aws.amazon.com/s3)

That covers the typical flow for CloudFormation drift detection: initiate a check, review reported discrepancies, fix the configuration, and re-run detection to confirm the stack is back in sync.

> **[Watch Video](https://learn.kodekloud.com/user/courses/aws-certified-devops-engineer-professional/module/42510d3c-bacc-4a37-adb8-2cfea86f1a36/lesson/82e355fc-6c18-44db-a892-ee916648876f)**


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.