Someone changed a security group rule manually in the console, and the CloudFormation stack no longer matches its template. How does ops detect this kind of out-of-band change going forward?
A.Run drift detection on the stack
Correct. Drift detection is purpose-built for template-vs-reality divergence.
B.Delete and recreate the stack
Rebuilds cause downtime and are a fix, not detection.
C.Enable Termination Protection
Termination protection prevents stack deletion, not resource drift.
D.Export the template and diff manually
Manual diffing doesn't scale and can't see runtime state.
Why this answer
CloudFormation drift detection compares each stack resource's actual state against the expected template state and reports which resources drifted — the designed tool for spotting out-of-band changes.
Correct answer: A · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Deployment & Automation practice session.
Practice Deployment & Automation