Question

A CloudOps engineer manages a security baseline (AWS Config rules, IAM roles, and CloudTrail configuration) deployed to 40 member accounts using a CloudFormation StackSet with service-managed permissions across an AWS Organization. Compliance auditors report that some member accounts have had resources manually modified outside of CloudFormation. The engineer needs to identify which stack instances no longer match the StackSet template's expected configuration, with the least operational effort. What should the engineer do?

Accepted Answer

Run drift detection on the StackSet, which evaluates each stack instance and reports instances with a DRIFTED status.

Answer

Log in to each member account and run drift detection on the individual CloudFormation stack, then manually compile the results.

Answer

Enable AWS Config aggregation in the management account and create a custom Config rule to compare resources against the template.

Answer

Re-deploy the StackSet to all accounts with an updated template to overwrite any manual changes and restore the baseline.