Question

A network operations team manages all VPC security groups, route tables, and NACLs through a CloudFormation stack to enforce a consistent baseline. During an incident, an engineer manually added an inbound rule to a security group via the console to restore service quickly. Weeks later, the team wants to programmatically identify every resource in the stack whose live configuration no longer matches the template, without disrupting running resources. Which approach meets this requirement with the least operational effort?

Accepted Answer

Run CloudFormation drift detection on the stack and review the drift status for each resource to identify configuration differences.

Answer

Delete and recreate the stack so all resources are reprovisioned exactly as defined in the template.

Answer

Enable AWS Config with a custom rule that compares each resource against the raw CloudFormation template stored in S3.

Answer

Use VPC Flow Logs and CloudWatch Logs Insights to detect traffic that violates the intended security group baseline.