A developer deployed an infrastructure stack using AWS CloudFormation. Later, a system administrator manually modified the port settings of an Amazon EC2 Security Group directly in the Amazon VPC Console to troubleshoot a connection issue. The developer needs to identify which specific configurations in the deployed stack no longer match the CloudFormation template definition. Which CloudFormation feature should the developer use to achieve this?
- ACreate a Change Set to identify the differences between the current deployed state and the template.
- BConfigure AWS CloudTrail integration to automatically roll back the stack to its original state.
- Use CloudFormation drift detection to compare the stack's actual configuration with the expected template configuration.Answer
- DUse AWS Systems Manager Parameter Store to dynamically query the security group's live properties.
Answer
Use CloudFormation drift detection to compare the stack's actual configuration with the expected template configuration.
Drift detection is a native CloudFormation feature designed to identify stack resources that have been modified outside of CloudFormation management (out-of-band). It compares the actual state of the resource properties with the expected state defined in the template.
Step-by-Step Solution
Key Concept
CloudFormation Drift Detection
Estimated Time:45s