Stack drift detection in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary purpose of AWS CloudFormation stack drift detection?

Choose the best description of what stack drift detection does in AWS CloudFormation.

A It identifies differences between the actual stack resources and the stack template's declared configuration.

B It automatically fixes any configuration differences found in the stack resources.

C It deletes resources that are not defined in the stack template.

D It backs up the stack resources before any update operation.

💡 Hint

Think about what 'drift' means in terms of configuration and actual state.

Stack drift detection checks if the real resources have changed outside of CloudFormation, but it does not fix or delete resources automatically.

❓ service_behavior

intermediate

What happens when you run drift detection on a stack with no changes outside CloudFormation?

You run drift detection on a CloudFormation stack that has not been modified outside of CloudFormation. What is the expected result?

A The stack is marked as DRIFTED, indicating changes were found.

B The stack update is automatically triggered to reapply the template.

C The stack is marked as IN_SYNC, indicating no drift detected.

D The stack is deleted and recreated to ensure consistency.

💡 Hint

Consider what it means if no changes were made outside CloudFormation.

If no changes are detected, the stack status after drift detection is IN_SYNC, meaning the actual resources match the template.

❓ Configuration

advanced

Which AWS CLI command correctly initiates drift detection on a stack named 'MyAppStack'?

Select the correct AWS CLI command to start drift detection on the stack named 'MyAppStack'.

A aws cloudformation initiate-drift-detection --stack-name MyAppStack

B aws cloudformation detect-stack-drift --stack-name MyAppStack

C aws cloudformation check-stack-drift --stack-name MyAppStack

D aws cloudformation start-drift-detection --stack-name MyAppStack

💡 Hint

Look for the exact AWS CLI command name for drift detection.

The correct command to start drift detection is detect-stack-drift. Other commands do not exist.

❓ security

advanced

What IAM permission is required to perform stack drift detection in AWS CloudFormation?

Identify the minimum IAM permission needed to run drift detection on a CloudFormation stack.

A cloudformation:CreateStack

B cloudformation:UpdateStack

C cloudformation:DeleteStack

D cloudformation:DetectStackDrift

💡 Hint

Think about the permission that allows checking for drift, not modifying the stack.

The cloudformation:DetectStackDrift permission allows users to initiate drift detection without changing the stack.

✅ Best Practice

expert

Which approach best ensures early detection of stack drift in a production environment?

Choose the best practice to detect stack drift early and maintain infrastructure consistency.

A Schedule automated drift detection runs regularly using AWS CloudWatch Events or EventBridge.

B Run drift detection only manually after a stack update is performed.

C Rely on CloudFormation stack update failures to detect drift.

D Ignore drift detection and rely on manual audits quarterly.

💡 Hint

Consider automation and frequency for early detection.

Automating drift detection regularly helps catch changes quickly and keeps infrastructure consistent.