An administrator deployed an Amazon S3 bucket by using an AWS CloudFormation template. A developer subsequently modified the bucket's lifecycle policy directly in the Amazon S3 console. Which AWS CloudFormation feature should the administrator use to identify the discrepancy between the template definition and the current live configuration of the S3 bucket?
- AWS CloudFormation drift detectionAnswer
- BA Service Control Policy (SCP) attached to the organizational unit to grant the CloudFormation stack permission to automatically restore the bucket's lifecycle policy
- CAn AWS-managed KMS key (aws/s3) with an attached key policy that restricts bucket configuration changes to CloudFormation stack updates
- DA linear deployment strategy configured in AWS CodeDeploy to automatically rollback the live S3 bucket modifications when they occur
Answer
AWS CloudFormation drift detection
AWS CloudFormation drift detection allows you to compare the stack's current resource configuration against the template's specified properties. Running drift detection on the stack identifies that the S3 bucket's configuration has drifted due to the manual lifecycle policy modification, indicating the exact differences.
Step-by-Step Solution
Key Concept
Identifying configuration drift on resources managed by AWS CloudFormation.