Drift Awareness and Operational Implications
Explore the concept of drift in AWS CloudFormation, where manual changes create differences between the template and actual infrastructure. Learn to detect drift, understand its operational risks, and apply practical responses like reconciling templates or reverting changes to maintain deployment reliability and compliance.
Every infrastructure-as-code system runs on a quiet assumption: the template describes what's actually running. That assumption holds until someone changes a live resource by hand, in the console or through a stray CLI call, and now two versions of the truth exist at once. CloudFormation still believes the template describes reality. The resource itself tells a different story.
That mismatch has a name. Drift is the gap between the expected properties in the template and the actual properties on the deployed resources. It matters because the next stack update is computed from the expected state, so a harmless-looking manual tweak can turn into a surprise during deployment, rollback, or replacement.
To make this concrete, imagine a security group in a stack where the template allows inbound 443 only from a corporate CIDR. Someone temporarily opens 443 to 0.0.0.0/0 to debug a partner integration and forgets to revert it. The application might keep working, but the next update can fail if the update tries to tighten rules, triggers a replacement, or hits an organizational compliance check that blocks broad ingress.
The diagram below shows one resource's expected versus actual properties side by side, worth inspecting ...