Question

A SysOps administrator manages production infrastructure using an AWS CloudFormation stack. During an incident, another engineer manually modified a security group's inbound rules directly in the EC2 console to restore service quickly. The administrator now needs to identify every resource in the stack whose live configuration no longer matches the template, without modifying or replacing any resources. Which approach accomplishes this?

Accepted Answer

Run drift detection on the stack and review the drift status and property differences for each resource.

Answer

Create a change set for the stack and inspect the proposed actions to see which resources differ.

Answer

Update the stack with the original template so CloudFormation reports which resources it changed.

Answer

Enable termination protection on the stack and review the CloudFormation event history for manual edits.