Question

A financial services company deploys infrastructure to 40 accounts using AWS CloudFormation StackSets triggered from a central AWS CodePipeline. Recently, engineers have been manually modifying deployed resources in the console during incidents, causing configuration drift that later breaks automated deployments. The platform team wants to continuously detect drift, automatically alert the owning team, and block the pipeline from promoting new changes to any account currently in a drifted state — without manually inspecting each account. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Schedule an EventBridge rule that periodically invokes a Lambda function to call the CloudFormation DetectStackDrift API across accounts, publish drift status to a central store, notify owners via SNS, and add a pipeline stage that fails if any target stack reports DRIFTED before promotion.

Answer

Enable AWS Config in every account with the cloudformation-stack-drift-detection-check managed rule and rely on Config auto-remediation to revert drifted resources, allowing the pipeline to always deploy without additional gating.

Answer

Turn on CloudTrail in all accounts and create a metric filter that alerts whenever an UpdateStack or console modification event occurs, then require engineers to manually re-run drift detection before each release.

Answer

Replace CloudFormation StackSets with Terraform and run terraform plan in the pipeline, treating any non-empty plan as drift and stopping the deployment automatically.