Question

A SysOps administrator manages a standardized VPC baseline deployed to 40 accounts across an organization using a CloudFormation StackSet. During a security audit, the administrator discovers that in several member accounts, engineers manually modified security group rules and NACLs that were originally provisioned by the StackSet. The administrator needs to identify which stack instances no longer match their template configuration and then bring them back into compliance with the intended baseline. Which approach accomplishes this with the least manual effort?

Accepted Answer

Run drift detection on the stack set to identify stack instances that have drifted, then perform a stack set operation to re-deploy the template and overwrite the manual changes.

Answer

Delete the stack set entirely and recreate it in all 40 accounts to guarantee that resources match the template.

Answer

Enable AWS Config in each member account and create a custom rule that reverts security group changes automatically.

Answer

Log in to each member account, manually compare the security group rules against the baseline document, and correct any differences by hand.