Stack drift detection in AWS - Step-by-Step Execution

Process Flow - Stack drift detection

Start Drift Detection

↓

Compare Stack Template

↓

Compare Stack Resources

↓

Check for Differences?

No→No Drift Detected

Yes↓

Report Drift Details

↓

End Drift Detection

The process starts by comparing the current stack template and resources with the deployed stack to find any differences, then reports if drift is detected.

Execution Sample

AWS

aws cloudformation detect-stack-drift --stack-name MyStack
aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id driftId
aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id driftId
aws cloudformation describe-stack-resource-drifts --stack-name MyStack

This sequence detects drift on a stack, checks detection status, and lists resource drifts.

Process Table

Step	Action	Evaluation	Result
1	Start drift detection on stack 'MyStack'	Send detect-stack-drift API call	Drift detection started, driftId received
2	Check drift detection status	Poll describe-stack-drift-detection-status with driftId	Status: IN_PROGRESS
3	Check drift detection status again	Poll describe-stack-drift-detection-status with driftId	Status: COMPLETED
4	Retrieve resource drift details	Call describe-stack-resource-drifts for 'MyStack'	List of resources with drift status
5	Analyze drift results	Compare resource drift statuses	Report drift found on some resources
6	End drift detection	No further action	Drift detection complete

💡 Drift detection completes when status is COMPLETED and resource drifts are reported.

Status Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	Final
driftId	null	abc123	abc123	abc123	abc123
detectionStatus	null	IN_PROGRESS	COMPLETED	COMPLETED	COMPLETED
resourceDrifts	empty	empty	empty	[Resource1: IN_SYNC, Resource2: MODIFIED]	[Resource1: IN_SYNC, Resource2: MODIFIED]

Key Moments - 3 Insights

Why does drift detection take time and show IN_PROGRESS status?

Because AWS CloudFormation compares all stack resources and templates, which can take time; see execution_table rows 2 and 3 showing status polling.

What does it mean if a resource shows MODIFIED in drift results?

It means the actual resource configuration differs from the stack template; see execution_table row 5 where drift is reported.

Can drift detection fix the drift automatically?

No, drift detection only reports differences; you must update or fix the stack manually.

Visual Quiz - 3 Questions

Look at the execution_table, what is the drift detection status at step 3?

A FAILED

B IN_PROGRESS

C COMPLETED

D NOT_STARTED

💡 Hint

Check the 'Evaluation' column at step 3 in execution_table.

At which step are the resource drift details retrieved?

A Step 2

B Step 4

C Step 3

D Step 5

💡 Hint

Look for the action 'Retrieve resource drift details' in execution_table.

If no differences are found, what would the result be at step 5?

A Report no drift detected

B Detection status IN_PROGRESS

C Report drift found on some resources

D Error retrieving drift details

💡 Hint

Refer to execution_table row 5 and the exit_note about drift reporting.

Concept Snapshot

Stack Drift Detection:
- Start detection with 'detect-stack-drift' command
- Poll status until COMPLETED
- Retrieve resource drift details
- Drift means actual differs from template
- Detection reports drift; manual fix needed

Full Transcript

Stack drift detection in AWS CloudFormation starts by sending a detect-stack-drift command for a stack. The system then compares the deployed stack's resources and template with the current template. This process takes time, so the status is polled until it shows COMPLETED. After completion, resource drift details are retrieved, showing which resources are in sync or modified. If differences exist, drift is reported. Drift detection only reports differences; it does not fix them automatically.