Back to AWS CloudFormation

Drift Detection

5 minutes 5 Questions

Drift Detection is a feature in AWS CloudFormation that allows you to detect if the actual stack resources have drifted from the expected stack configuration, as defined by the stack template and applied parameters. Drift is any unintentional change in the stack resources made outside of CloudForma…

Test mode:
Start practice test
AWS Certified Solutions Architect - Drift Detection Example Questions

Test your knowledge of Drift Detection

Question 1

A company manages infrastructure with AWS CloudFormation, but some engineers occasionally modify resources directly in AWS, causing stack drift. Which approach most effectively prevents drift by ensuring that all changes go through CloudFormation?

Correct Answer: Restrict direct resource modifications using least-privilege IAM and Service Control Policies, and require all changes to flow through CloudFormation (for example, via a CI/CD pipeline and CloudFormation execution roles).

Drift occurs when resources managed by CloudFormation are changed outside of CloudFormation. The most effective way to minimize drift is to prevent out-of-band changes by enforcing least-privilege access: use IAM and Service Control Policies to block direct modifications and permit changes only through CloudFormation via controlled roles and a CI/CD pipeline. This makes CloudFormation the single path for updates. Manual monitoring, periodic reviews, or email reminders are reactive and unreliable; they do not prevent drift and are prone to human error.

Question 2

An organization is using AWS CloudFormation to create stacks for different environments such as development, staging, and production. They want to use Drift Detection to ensure that the stacks stay in-sync with the defined templates. They noticed some drifts in the development environment. What could be the next action?

Correct Answer: Detect the drift to get actionable insights and make sure the stacks are in-sync.

Detecting the drift will provide information on the differences between the actual infrastructure and the defined templates. By understanding these insights, one can implement the necessary actions to ensure the stacks are in-sync. Ignoring drifts, terminating the stack, enabling versioning, and other mentioned options do not provide actionable insights to make the stacks in-sync.

Question 3

An organization manages its AWS resources using AWS CloudFormation. They want to detect when stack resources drift from their templates and receive alerts (for example, via EventBridge and SNS). Which AWS capability should they use to detect the drift?

Correct Answer: AWS CloudFormation Drift Detection

AWS CloudFormation Drift Detection compares the live configuration of resources in a CloudFormation stack to what is defined in the template and flags any differences as drift. You can invoke drift detection via the console, CLI, or API and route status change events through Amazon EventBridge to Amazon SNS (or other targets) to notify teams when drift is detected. GuardDuty focuses on threat detection, Elastic Beanstalk is a PaaS for application deployment, and CloudWatch provides monitoring and alarms but does not detect CloudFormation template drift.

More Drift Detection questions
15 questions (total)
Start 15 question test