Skip to main content

AWS CloudFormation Should Enable Drift Detection

More Info:​

Your AWS CloudFormation stacks should not be drifted from their expected template configuration. A CloudFormation stack is considered to have drifted from its configuration if one or more of its resources have been drifted.

Risk Level​

Medium

Address​

Operational Maturity, Reliability

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • StateRAMP
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate AWS CloudFormation Drift Detection, follow these steps:

  1. Log in to the AWS Management Console.
  2. Navigate to the CloudFormation service.
  3. Click on the stack that has drift detection enabled.
  4. Click on the "Drift" tab.
  5. Review the drift detection results to identify the resources that have drifted.
  6. Click on the "Resources" tab to see the current state of the resources.
  7. Select the resources that have drifted and click on the "Detect Drift" button.
  8. Wait for the drift detection process to complete.
  9. Review the drift detection results to confirm that the resources have been remediated.
  10. If necessary, make changes to the stack to remediate the drift.
  11. Update the stack to apply the changes.
  12. Repeat the drift detection process to confirm that the resources are no longer drifting.

Using CLI

AWS CloudFormation Drift Detection is a feature that helps you identify resources that have drifted away from their expected configurations. Once you have identified the resources that have drifted, you can use the AWS CLI to remediate the drift.

Here are the steps to remediate AWS CloudFormation Drift Detection using AWS CLI:

  1. Identify the stack that has drifted by running the following command:
aws cloudformation detect-stack-drift --stack-name <stack-name>
  1. Once you have identified the resources that have drifted, you can generate a drift report by running the following command:
aws cloudformation describe-stack-resource-drifts --stack-name <stack-name>

  1. Review the drift report to identify the resources that have drifted and the expected and actual configurations.

  2. To remediate the drift, update the stack with the expected configuration by running the following command:

aws cloudformation update-stack --stack-name <stack-name> --template-body file://<path-to-template> --parameters file://<path-to-parameters>

Replace <path-to-template> and <path-to-parameters> with the file paths to the updated CloudFormation template and parameters file.

  1. Wait for the stack update to complete by running the following command:
aws cloudformation wait stack-update-complete --stack-name <stack-name>
  1. Verify that the stack has been remediated by running the following command:
aws cloudformation describe-stack-resources --stack-name <stack-name>

This will show you the current configuration of the resources in the stack. If the resources have been remediated, the expected and actual configurations should match.

Using Python

To remediate AWS CloudFormation drift detection using Python, follow these steps:

  1. Import the required libraries: boto3, json
import boto3
import json
  1. Create a boto3 client for AWS CloudFormation:
client = boto3.client('cloudformation')
  1. Get the list of stacks:
stacks = client.list_stacks(StackStatusFilter=['CREATE_COMPLETE', 'UPDATE_COMPLETE'])['StackSummaries']
  1. Loop through the stacks and check for drift:
for stack in stacks:
    stack_drift = client.detect_stack_drift(StackName=stack['StackName'])
    if stack_drift['StackDriftStatus'] == 'DRIFTED':
        print('Stack {} has drifted'.format(stack['StackName']))
  1. If a stack has drifted, remediate it by updating the stack:
response = client.update_stack(StackName=stack['StackName'], UsePreviousTemplate=True)
print('Stack {} has been remediated'.format(stack['StackName']))

Note: Make sure to test the script thoroughly before running it in a production environment.

Using Terraform

Terraform and the AWS provider do not expose any resource or argument to initiate CloudFormation drift detection; it is a runtime operation that must be done via CLI/Console and cannot be modeled declaratively.

To remediate, run the same commands outside Terraform (manually or via CI/CD):

# Start drift detection
aws cloudformation detect-stack-drift \
  --stack-name STACK_NAME_HERE \
  --region AWS_REGION_HERE

# (Optionally) poll status until detection completes
aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id STACK_DRIFT_DETECTION_ID_HERE

# View drifted resources
aws cloudformation describe-stack-resource-drifts \
  --stack-name STACK_NAME_HERE \
  --region AWS_REGION_HERE

Any actual fix for drift is also manual: either revert changes to match the template (e.g., via aws cloudformation update-stack) or update the template/stack to match the intentional configuration. This process will not be reflected in terraform plan because Terraform has no resource for CloudFormation drift detection.

Additional Reading:​