💾 Archived View for cfdocs.wetterberg.nu › stacksets-drift.gemini captured on 2021-12-04 at 18:04:22. Gemini links have been rewritten to link to archived content

-=-=-=-=-=-=-

Detecting unmanaged configuration changes in stack sets

Even as you manage your stacks and the resources they contain through CloudFormation, users can change those resources outside of CloudFormation. Users can edit resources directly by using the underlying service that created the resource. By performing drift detection on a stack set, you can determine if any of the stack instances belonging to that stack set differ, or have *drifted*, from their expected configuration.

How CloudFormation performs drift detection on a stack set

When CloudFormation performs drift detection on a stack set, it performs drift detection on the stack associated with each stack instance in the stack set. To do this, CloudFormation compares the current state of each resource in the stack with the expected state of that resource, as defined in the stack's template and and any specified input parameters. If the current state of a resource varies from its expected state, that resource is considered to have drifted. If one or more resources in a stack have drifted, then the stack itself is considered to have drifted, and the stack instances that the stack is associated with is considered to have drifted as well. If one or more stack instances in a stack set have drifted, the stack set itself is considered to have drifted.

Drift detection identifies unmanaged changes; that is, changes made to stacks outside of CloudFormation. Changes made through CloudFormation to a stack directly, rather than at the stack-set level, are not considered drift. For example, suppose you have a stack that is associated with a stack instance of a stack set. If you use CloudFormation to update that stack to use a different template, that is not considered drift, even though that stack now has a different template than any other stacks belonging to the stack set. This is because the stack still matches its expected template and parameter configuration in CloudFormation.

For detailed information on how CloudFormation performs drift detection on a stack, see Detecting unmanaged configuration changes to stacks and resources.

Detecting unmanaged configuration changes to stacks and resources

Because CloudFormation performs drift detection on each stack individually, it takes any overridden parameter values into account when determining whether a stack has drifted. For more information on overriding template parameters in stack instances, see Override parameters on stack instances.

Override parameters on stack instances

If you perform drift detection directly on a stack that is associated with a stack instance, those drift results are not available from the *StackSets* console page.

directly on a stack

To detect drift on a stack set using the AWS Management Console*

Open the AWS CloudFormation console at https://console.aws.amazon.com/cloudformation.
On the StackSets page, select the stack set on which you want to perform drift detection.
From the Actions menu, select Detect drifts.CloudFormation displays an information bar stating that drift detection has been initiated for the selected stack set.
Optional: To monitor the progress of the drift detection operation:Click the stack set name to display the Stackset details page.Select the Operations tab, select the drift detection operation, and then select View drift details.CloudFormation displays the Operation details dialog box.
Wait until CloudFormation completes the drift detection operation. When the drift detection operation completes, CloudFormation updates Drift status and Last drift check time for your stack set. These fields are listed on the Overview tab of the StackSet details page for the selected stack set.The drift detection operation may take some time, depending on the number of stack instances included in the stack set, as well as the number of resources included in the stack set. You can only run a single drift detection operation on a given stack set at one time. CloudFormation continues the drift detection operation even after you dismiss the information bar.
To review the drift detection results for the stack instances in a stack set, select the Stack instances tab.The Stack name column lists the name of the stack associated with each stack instance, and the Drift status column lists the drift status of that stack. A stack is considered to have drifted if one or more of its resources have drifted.
To review the drift detection results for the stack associated with a specific stack instances:Note the AWS account, Stack name, and AWS region for the stack instance.Open the AWS CloudFormation console at https://console.aws.amazon.com/cloudformation.Log into the AWS account containing the stack instance.Select the AWS region containing the stack instance.From the left-hand navigation pane, select Stacks.Select the stack you wish to view, and then select Drifts.CloudFormation displays the Drifts page for the stack associated with the specified stack instance.In the Resource drift status section, CloudFormation lists each stack resource, its drift status, and the last time drift detection was initiated on the resource. The logical ID and physical ID of each resource is displayed to help you identify them. In addition, for resources with a status of MODIFIED, CloudFormation displays resource drift details.You can sort the resources based on their drift status using the Drift status column.To view the details on a modified resource.With the modified resource selected, select View drift details.

https://console.aws.amazon.com/cloudformation

{P Image}

To detect drift on a stack set using the AWS CLI*

To detect drift on an entire stack using the AWS CLI, use the following `aws cloudformation` commands:

[detect-stack-set-drift](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/detect-stack-set-drift.html) to initiate a drift detection operation on a stack.
[describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) to monitor the status of the stack drift detection operation.
Once the drift detection operation has completed, use the following commands to return drift information you want:Use [describe-stack-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set.html) to return detailed information about the stack set, including detailed information about the last completed drift operation performed on the stack set. (Information about drift operations that are in progress is not included.)Use [list-stackinstances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-stack-instances.html) to return a list of stack instances belonging to the stack set, including the drift status and last drift time checked of each instance.Use [describe-stack-instance](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-instance.html) to return detailed information about a specific stack instance, including its drift status and last drift time checked.
Use detect-stack-set-drift to detect drift on an entire stack set and its associated stack instances.The following example initiates drift detection on the stack set stack-set-drift-example.
Because stack set drift detection operations can be a long-running operation, use describe-stack-set-operation to monitor the status of drift operation. This command takes the stack set operation ID returned by the detect-stack-set-drift command.The following examples uses the operation ID from the previous example to return information on the stack set drift detection operation. In this example, the operation is still running. Of the seven stack instances associated with this stack set, one stack instance has already been found to have drifted, two instances are in synch, and drift detection for the remaining four stack instances is still in progress. Since one instance has drifted, the drift status of the stack set itself is now DRIFTED.Performing the same command later, this example shows the information returned once the drift detection operation has completed. Two of the seven total stack instances associated with this stack set have drifted, rendering the drift status of the stack set itself as DRIFTED.
When the stack set drift detection operation is complete, use the describe-stack-set, list-stackinstances, and describe-stack-instance commands to review the results.The describe-stack-set command includes the same detailed drift information returned by the describe-stack-set-operation command.You can use the list-stack-instances command to return summary information about the stack instances associated with a stack set, including the drift status of each stack instance.In this example, executing list-stack-instances on the example stack set enables us to identify which two stack instances have a drift status of DRIFTED.The describe-stack-instance command also returns this information, but for a single stack instance, as in the example below.
Once you've identified which stack instances have drifted, you can use the information about the stack instances that is returned by the list-stack-instances or describe-stack-instance commands to execute the describe-stack-resource-drifts. This command returns detailed information about which resources in the stack have drifted.The following example uses the stack ID of one of the drifted stacks, returned by the list-stack-instances command in the example above, to return detailed information about the resources that have been modified or deleted outside of CloudFormation. In this stack, two properties on an AWS::SQS::Queue resource, DelaySeconds and maxReceiveCount, have been modified.

describe-stack-resource-drifts

Stopping drift detection on a stack set

Because drift detection on a stack set can be a long-running operation, there may be instances when you want to stop a drift detection operation that is currently running on a stack set.

To stop drift detection on a stack set using the AWS Management Console*

Open the AWS CloudFormation console at https://console.aws.amazon.com/cloudformation.
On the StackSets page, select the name of the stack set.CloudFormation displays the StackSets details page for the selected stack set.
On the StackSets details page, select the Operations tab, and then select the drift detection operation.
Select Stop operation.

https://console.aws.amazon.com/cloudformation

To stop drift detection on a stack set using the the AWS CLI*

Use the [stop-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/stop-stack-set-operation.html) command. You must supply both the stack set name and the operation ID of the drift detection stack set operation.