Question

A team manages an S3 bucket, an IAM role, and a DynamoDB table through a single CloudFormation stack. An engineer, bypassing the pipeline, manually edited the S3 bucket policy and added a new lifecycle rule directly in the console during an incident. The next scheduled pipeline run deploys an unrelated change (adding a CloudWatch alarm) via a change set. The team wants to ensure the manual changes are reconciled to match the template AND wants ongoing visibility when future out-of-band changes occur, without deleting or recreating any resources. Which approach best meets these requirements?

Accepted Answer

Run CloudFormation drift detection on the stack to identify the divergence, then perform a normal stack update from the template so CloudFormation resets the drifted properties to the template-defined values; schedule periodic drift detection with EventBridge notifications for ongoing visibility.

Answer

Delete the stack with a Retain deletion policy on all resources, then re-import the resources into a fresh stack to guarantee the template and live state are identical.

Answer

Enable termination protection on the stack, which prevents any future manual modifications to the managed resources and automatically reverts unauthorized changes.

Answer

Add a stack policy that denies all Update actions on the S3 bucket, then rely on the next change set to overwrite the manual changes when the alarm is added.