The Drift Problem
You used CloudFormation to deploy a Security Group allowing only port 80 inbound. Two weeks later, a developer manually logs into the AWS Console and opens port 22 to the world to "debug something quickly." They forget to close it.
Your Infrastructure as Code (the template) says: Secure.
Your actual AWS resource says: Wide open.
This gap between declared state and actual state is called Drift. It is one of the most common causes of security incidents in AWS environments — not because someone attacked you, but because someone made a "temporary" change that became permanent.
Drift Detection
CloudFormation Drift Detection compares your stack's current live resources against the template that created them. It produces a report showing exactly which properties changed and what their current values are.
The workflow is three async calls: kick off detection on a stack, poll until the detection job finishes, then list the resources that came back MODIFIED or DELETED.
Governance Rule: Run Drift Detection on a schedule (e.g., daily via EventBridge + Lambda). If drift is detected, alert the security team. This creates accountability — developers know that manual changes will be caught.
Important limitation: Drift Detection finds the problem but does not fix it. To remediate, you either re-deploy the stack (which overwrites the manual change) or update the template to legitimize the change. AWS Config (covered next) is the service that can automatically remediate.
StackSets: Multi-Account, Multi-Region Deployment
Standard CloudFormation deploys a stack to one account in one region. StackSets extend this to deploy the same template across multiple accounts and regions simultaneously.
How it works: You designate an Administrator Account (typically your AWS Organizations management account) and Target Accounts. StackSets uses a service-linked role to assume a role in each target account and deploy the stack there.
Real-world use cases:
- Deploy a standard IAM role for your security audit team to all 50 accounts in your organization.
- Enforce a CloudTrail trail in every account and every region.
- Deploy a baseline VPC configuration to every new account automatically when it's created (using automatic deployment with AWS Organizations integration).