Question

A CloudOps engineer manages production infrastructure using an AWS CloudFormation stack. During a recent incident, another team member modified a security group's inbound rules directly in the EC2 console instead of updating the template. The engineer needs to identify all resources in the stack whose actual configuration no longer matches the template definition, without modifying or redeploying any resources. Which action should the engineer take?

Accepted Answer

Run drift detection on the stack and review the drift status of each resource in the results

Answer

Perform a stack update with the original template to reset all resources to their defined state

Answer

Enable termination protection on the stack to prevent further manual changes

Answer

Create a change set from the current template and review the proposed changes