How to detect manual changes to CloudFormation stack resources?
A company uses an AWS CloudFormation template to deploy and manage its AWS infrastructure. The CloudFormation template creates Amazon VPC security groups and Amazon EC2 security groups. A manager finds out that some engineers modified the security groups of a few EC2 instances for testing purposes. A developer needs to determine what modifications occurred. Which solution will meet this requirement?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests knowledge of CloudFormation drift detection, which identifies unmanaged configuration changes, while the trap is confusing this with change sets or monitoring tools like Amazon Detective.
To identify configuration changes made to CloudFormation-managed resources outside of the stack, AWS CloudFormation drift detection is the required solution. The community consensus confirms that drift detection compares the actual configuration with the expected template configuration.
Selecting 'Execute a change set' is a common mistake because change sets are for previewing and applying planned updates, not for detecting unauthorized manual modifications.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
CloudFormation drift detection is the specific feature designed to compare the actual state of stack resources with the expected state defined in the template. When engineers manually modify resources like security groups, the stack enters a 'drifted' state. Running drift detection on the stack identifies exactly which resources have changed and details the specific configuration differences. This directly addresses the manager's need to determine what modifications occurred.Why the Other Options Are Wrong
Adding a Conditions section (Option A) is used to control resource creation based on runtime parameters, not to audit past changes. Executing a change set (Option C) is a mechanism to deploy updates defined in the template, which would overwrite manual changes or fail, rather than reporting them. Amazon Detective (Option D) is a security service for analyzing logs and finding the root cause of security findings, not for comparing IaC template states against actual infrastructure.Community Comment Notes
The community comments strongly support Option B, citing the official AWS documentation on using CloudFormation stack drift. Users highlight that drift detection is specifically meant to identify resources where configuration changes have been made outside of CloudFormation management. There is no dissent in the provided comments, reinforcing that B is the definitive answer.Official Reference
Exam Strategy
When a question asks about identifying manual changes to infrastructure managed by IaC tools like CloudFormation, immediately look for 'drift detection.' Remember that change sets are for applying future changes, while drift detection is for auditing past discrepancies.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →