How to fix a drifted AWS CloudFormation stack?
System Design practice on Codemia
Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.
When managing AWS infrastructure using CloudFormation, one key issue organizations may face is stack drift. Stack drift occurs when the actual state of resources in a stack changes independently of the stack's template. Addressing drift swiftly and accurately is imperative to maintain infrastructure alignment with organizational requirements. This article will guide you through identifying, troubleshooting, and fixing drifted CloudFormation stacks.
Understanding Stack Drift in AWS CloudFormation
What is Stack Drift?
Stack drift refers to any change in AWS resources that deviate from the configuration defined by your CloudFormation template. This deviation can occur due to manual modifications outside of CloudFormation, automated scripts altering resources, or differences in dynamic configurations.
Why is Drift Detection Important?
- Consistency: Ensuring resources match the expected configuration.
- Compliance: Adhering to internal and external policies and regulations.
- Security: Preventing unauthorized changes that could expose vulnerabilities.
- Cost Management: Detecting and rectifying unintended resource scaling.
Identifying Stack Drift
AWS provides built-in drift detection functionality, allowing you to ascertain differences between the current state and template-defined resources.
Drift Detection Process
- Run Drift Detection:
- Navigate to the CloudFormation console.
- Select your stack and click on "Detect Drift".
- AWS will then proceed to analyze the stack, comparing the actual state with the template.
- Review Results:
- Post-analysis, AWS provides a report highlighting resources that have drifted.
API and CLI Options
For automation or integration into CI/CD pipelines, AWS CLI or SDKs can be used:
- IN_SYNC: Configuration matches the template.
- DRIFTED: Configuration differs from the template.
- NOT_CHECKED: Resource drift status not assessed.
- DELETED: Resource deleted post-drift assessment.
- Regular Drift Detection: Schedule periodic drift checks.
- Maintain Accurate Documentation: Templates should reflect any manual changes promptly.
- Establish IAM Policies: Restrict manual changes to resources.
- Leverage Stack Sets: For multi-region and multi-account deployments, use Stack Sets to ensure consistency across environments.
Related reading
- How to fix 'Access Denied' while deleting empty S3 Elastic Beanstalk?
- How to fix apt-get command not found on AWS EC2?
- How to force https on elastic beanstalk?
- How to force SSL for Kubernetes Ingress on GKE
- How to fix NoHttpResponseException when running Wiremock on jenkins?
- How to force a redeploy with HELM
- How to fix 'Object arrays cannot be loaded when allow_pickleFalse' in the sketch_rnn algorithm
- how to fix There is at least 1 reference to internal data in the interpreter in the form of a numpy array or slice and run inference on tf.lite
System Design Fundamentals
Build a strong foundation in designing scalable, reliable distributed systems.
View the courseTrack what you have practised
A free account saves your progress, solutions and study plan across every problem on Codemia.
System Design practice on Codemia
Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.