AWS CloudFormation Support
CloudFormation drift detection and remediation.
Drift is the gap between what your templates say and what exists in AWS after someone changed a resource by hand. It causes surprise rollbacks and outages on the next deploy. We detect it, decide for each change whether to revert or adopt it and close the gap that caused it.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Someone changed a security group, parameter or setting in the console
- A deployment overwrote a manual fix and caused an incident
- You are about to update an old stack and fear surprises
- Auditors require proof that infrastructure matches code
- Stacks have unexplained differences between environments
What you get
- A drift report listing each difference and the decision taken
- Templates updated or resources reverted
- Scheduled drift checks with notifications
- Access guardrails that discourage manual changes
How we do it
A clear, safe process you can follow along with.
1. Run drift detection
We start detection on the stack, individually or across a set of stacks, and read the per-resource status and the property-level differences, including expected and actual values.
2. Know what detection can miss
Not every resource type supports drift detection, and properties not defined in the template are not compared. We check supported types and use AWS Config for broader coverage.
3. Decide per difference
For each drift we ask whether the manual change was an urgent fix that should become code, or an error to revert. The owner of the workload decides, not the tooling.
4. Adopt the change into the template
If the manual change is right, we update the template to match so the next deploy keeps it, and confirm with a change set that nothing else moves.
5. Revert the drift
If the change is wrong, we deploy the template, ideally via a change set, which sets the resource back. We take care with replacements, because some property changes recreate a resource.
6. Prevent recurrence
We restrict console and API write access with IAM or SCPs for managed resources, route changes through pipelines and schedule regular drift checks with alerts.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Deploying over drift without looking
The update may revert a manual fix that production now depends on.
Assuming no drift means no manual change
Unsupported types and unmanaged properties are not covered.
Blaming people
Drift usually means the pipeline is too slow for urgent fixes. Fix the process.
Ignoring replacements
Reverting some properties replaces the resource and can lose data.
Frequently Asked Questions
What is CloudFormation drift?
Drift happens when a stack's actual resources differ from the template, usually because of manual changes made outside CloudFormation.
How do I fix drift in CloudFormation?
Decide whether to adopt the change by updating the template or revert it by redeploying, and preview the result with a change set first.
Does drift detection cover all resources?
No. Only supported resource types and properties defined in the template are compared, so unmanaged properties and unsupported types can still differ.
Want Help With CloudFormation drift detection and remediation?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required