Safely handle configuration drift with AWS CloudFormation drift-aware change sets

AWS CloudFormation Drift-Aware Change Sets

AWS CloudFormation has introduced drift-aware change sets to compare an Infrastructure as Code (IaC) template with the actual state of infrastructure, allowing you to revert drifted resources to their template definitions. This feature helps prevent unexpected changes, improves security, and enhances reproducibility for testing and disaster recovery.

Key Features

• Three-Way Diff: Drift-aware change sets provide a comparison between a new template, the last-deployed template, and the actual infrastructure state.
• Preview Impact: You can preview the impact of deployments on drifted resources and prevent unintended overwrites.
• Resource Recreation: During change set execution, CloudFormation matches resource properties with template values and recreates resources deleted outside of IaC.
• Error Handling: If a provisioning error occurs, CloudFormation restores infrastructure to its actual state before deployment.

What to do

• Create a drift-aware change set from the CloudFormation Console by selecting “Drift-aware” as the change set type.
• Use the --deployment-mode REVERT_DRIFT parameter with the CreateChangeSet API from the AWS CLI or SDK.
• Refer to the CloudFormation User Guide for more information.

Drift-aware change sets are available in all AWS Regions where CloudFormation is supported. For more details, refer to the AWS Region table.

Source: AWS release notes

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.