Stack drift detection in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to start drift detection on a CloudFormation stack.

AWS

aws cloudformation detect-stack-drift --stack-name [1]

Drag options to blanks, or click blank then click option'

AStackName

BMyStack

CStackId

DDriftStack

Attempts:

3 left

💡 Hint

Common Mistakes

Using generic terms like 'StackName' instead of the actual stack name.

Confusing stack ID with stack name.

You need to specify the exact stack name to detect drift on that stack.

2fill in blank

medium

Complete the command to check the drift detection status for a stack.

AWS

aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id [1]

Drag options to blanks, or click blank then click option'

AdetectionId

BstackName

CdriftId

DstackId

Attempts:

3 left

💡 Hint

Common Mistakes

Using the stack name instead of the drift detection ID.

Confusing drift detection ID with stack ID.

The command requires the drift detection ID returned when drift detection started.

3fill in blank

hard

Fix the error in the command to list all resources with drift information for a stack.

AWS

aws cloudformation [1] --stack-name MyStack --query 'StackResourceDrifts[?[2]==`MODIFIED`]'

Drag options to blanks, or click blank then click option'

Adescribe-stack-resource-drifts

BResourceDriftStatus

CStackResourceStatus

DResourceStatus

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'list-stack-resources' instead of 'describe-stack-resource-drifts'.

Using incorrect property names like 'DriftStatus' or 'ResourceStatus'.

Not quoting the filter value correctly.

Use 'describe-stack-resource-drifts' and filter on the 'ResourceDriftStatus' property where the value is 'MODIFIED'.

4fill in blank

hard

Fill both blanks to create a command that detects drift and waits until detection completes.

AWS

aws cloudformation detect-stack-drift --stack-name [1] && aws cloudformation wait stack-drift-detection-complete --stack-drift-detection-id [2]

Drag options to blanks, or click blank then click option'

AMyAppStack

BdetectionId

CstackId

DStackName

Attempts:

3 left

💡 Hint

Common Mistakes

Using stack ID instead of detection ID in the wait command.

Using generic names instead of actual stack name.

You start drift detection on 'MyAppStack' and then wait using the returned 'detectionId'.

5fill in blank

hard

Fill all three blanks to create a script snippet that detects drift, waits for completion, and then lists modified resources.

AWS

detection_id=$(aws cloudformation detect-stack-drift --stack-name [1] --query 'StackDriftDetectionId' --output text)
aws cloudformation wait stack-drift-detection-complete --stack-drift-detection-id [2]
aws cloudformation describe-stack-resource-drifts --stack-name [3] --query 'StackResourceDrifts[?ResourceDriftStatus==`MODIFIED`]'

Drag options to blanks, or click blank then click option'

AMyProdStack

Bdetection_id

DStackDriftId

Attempts:

3 left

💡 Hint

Common Mistakes

Using different stack names in different commands.

Using incorrect variable names for detection ID.

The script uses 'MyProdStack' as the stack name, stores the detection ID in 'detection_id', and uses the same stack name to list modified resources.

Practice

1.

What is the main purpose of stack drift detection in AWS CloudFormation?

easy

A. To find manual changes made outside of CloudFormation templates

B. To automatically fix errors in CloudFormation templates

C. To create new stacks from existing templates

D. To monitor network traffic between AWS resources

Solution

1. Step 1: Understand stack drift detection concept

   Stack drift detection checks if resources in a stack have been changed manually or outside CloudFormation management.

2. Step 2: Identify the main purpose

   The main goal is to find these manual or unexpected changes to keep infrastructure consistent.

3. Final Answer:

   To find manual changes made outside of CloudFormation templates -> Option A

4. Quick Check:

   Stack drift detection = find manual changes [OK]

Hint: Stack drift detection finds changes outside CloudFormation [OK]

Common Mistakes:

• Thinking it fixes errors automatically
• Confusing it with stack creation
• Assuming it monitors network traffic

2.

Which AWS CLI command starts drift detection for a CloudFormation stack named MyAppStack?

easy

A. aws cloudformation begin-drift-check --name MyAppStack

B. aws cloudformation detect-stack-drift --stack-name MyAppStack

C. aws cloudformation start-drift-detection --stack MyAppStack

D. aws cloudformation check-drift --stack-name MyAppStack

Solution

1. Step 1: Recall AWS CLI syntax for drift detection

   The correct command to start drift detection is detect-stack-drift with the --stack-name option.

2. Step 2: Match the command with the stack name

   aws cloudformation detect-stack-drift --stack-name MyAppStack uses the exact syntax and correct parameter for the stack name.

3. Final Answer:

   aws cloudformation detect-stack-drift --stack-name MyAppStack -> Option B

4. Quick Check:

   Detect drift command = detect-stack-drift [OK]

Hint: Use 'detect-stack-drift' with '--stack-name' to start detection [OK]

Common Mistakes:

• Using incorrect command verbs like start or begin
• Wrong parameter names like --stack or --name
• Mixing up command order or syntax

3.

After running aws cloudformation detect-stack-drift --stack-name MyStack, which command shows the drift detection status and results?

medium

A. aws cloudformation show-drift-results --stack-name MyStack

B. aws cloudformation get-stack-drift-status --stack-name MyStack

C. aws cloudformation list-stack-drift-detection --stack-name MyStack

D. aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id

Solution

1. Step 1: Identify the command to check drift detection status

   The AWS CLI command to check drift detection status is describe-stack-drift-detection-status.

2. Step 2: Confirm the correct parameter usage

   It requires the --stack-drift-detection-id parameter to specify the detection ID, not --stack-name.

3. Final Answer:

   aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id <detection-id> -> Option D

4. Quick Check:

   Check drift status = describe-stack-drift-detection-status [OK]

Hint: Use 'describe-stack-drift-detection-status' with detection ID to get drift results [OK]

Common Mistakes:

• Using non-existent commands like get-stack-drift-status
• Confusing list commands with status commands
• Wrong parameter names

4.

You ran aws cloudformation detect-stack-drift --stack-name TestStack but got an error: Stack with id TestStack does not exist. What is the most likely cause?

medium

A. The stack name is misspelled or the stack does not exist

B. Drift detection is not supported for this stack type

C. You need to add --region parameter to the command

D. The AWS CLI version is outdated and cannot run drift detection

Solution

1. Step 1: Analyze the error message

   The error says the stack with the given name does not exist, indicating a wrong name or missing stack.

2. Step 2: Consider other causes

   While region or CLI version issues can cause errors, this specific message points to a missing or misspelled stack name.

3. Final Answer:

   The stack name is misspelled or the stack does not exist -> Option A

4. Quick Check:

   Error about stack id means wrong or missing stack [OK]

Hint: Check stack name spelling and existence first [OK]

Common Mistakes:

• Assuming region parameter is always required
• Blaming CLI version without checking stack
• Ignoring the exact error message

5.

You want to ensure your CloudFormation stack stays consistent with its template. Which approach best uses stack drift detection to maintain this?

A) Run drift detection regularly and update stack if drift is detected.
B) Disable drift detection and manually check resources.
C) Use drift detection only after stack deletion.
D) Ignore drift detection and rely on CloudWatch alarms.

hard

A. Use drift detection only after stack deletion

B. Disable drift detection and manually check resources

C. Run drift detection regularly and update stack if drift is detected

D. Ignore drift detection and rely on CloudWatch alarms

Solution

1. Step 1: Understand drift detection best practice

   Regularly running drift detection helps find manual changes early and keeps the stack consistent.

2. Step 2: Evaluate options

   Run drift detection regularly and update stack if drift is detected uses drift detection proactively. Options B, C, and D either ignore drift detection or use it incorrectly.

3. Final Answer:

   Run drift detection regularly and update stack if drift is detected -> Option C

4. Quick Check:

   Regular drift detection = best practice [OK]

Hint: Run drift detection regularly to catch changes early [OK]

Common Mistakes:

• Ignoring drift detection completely
• Checking drift only after deletion
• Relying solely on CloudWatch for drift