After a stack was deployed, an engineer changed a security group rule by hand in the console. Which CloudFormation feature reports that the live resource no longer matches the template?
Show answer and explanation
Answer: A
Drift detection compares each stack resource's current configuration against the values CloudFormation expects from the template and reports a drifted or in-sync status, plus the specific properties that differ.
It is a reporting mechanism only. Running detection does not put the resource back, so remediation means updating the template to match reality or updating the stack to overwrite the manual change.
Why the other options are wrong
- B. Template validation parses the template before deployment and catches syntax or schema problems, not live configuration differences.
- C. AWS Budgets tracks spend against thresholds and has no visibility into resource properties.
- D. Change sets preview what an upcoming stack update would do; they do not compare a running stack against its template.
Exam tip. Drift detection reports the mismatch; it never fixes it.