A team manages a SageMaker real-time endpoint entirely through a CloudFormation stack that is deployed identically across dev, staging, and production. During an incident, an on-call engineer manually changed the production endpoint's instance count and instance type through the SageMaker console to handle a traffic surge. Later, the team wants to programmatically detect whether the running production resources still match what the CloudFormation template declares, before running their next stack update. Which approach lets them identify these out-of-band changes with the least custom effort?