Question

A team manages its production infrastructure with an AWS CloudFormation stack. An engineer reports that a security group rule was manually modified in the AWS Management Console outside of CloudFormation, and the team wants to identify which stack resources no longer match their template definitions before the next deployment. Which CloudFormation capability should they use?

Accepted Answer

Run drift detection on the stack to compare the actual resource configurations against the expected template values.

Answer

Enable a stack policy to prevent any future manual changes to the security group resource.

Answer

Create a change set to preview the differences between the current template and the deployed resources.

Answer

Use the continue-update-rollback command to restore the stack to its last known good state.