How to detect manual changes to CloudFormation stack resources?
Short answer
B Perform a drift detection operation on the CloudFormation stack.
Question
Key Takeaways
This question tests knowledge of CloudFormation drift detection, which identifies unmanaged configuration changes, while the trap is confusing this with change sets or monitoring tools like Amazon Detective.
To identify configuration changes made to CloudFormation-managed resources outside of the stack, AWS CloudFormation drift detection is the required solution. The community consensus confirms that drift detection compares the actual configuration with the expected template configuration.
Common mistake: Selecting 'Execute a change set' is a common mistake because change sets are for previewing and applying planned updates, not for detecting unauthorized manual modifications.
Expert Analysis
Why the Answer Is Correct
CloudFormation drift detection is the specific feature designed to compare the actual state of stack resources with the expected state defined in the template. When engineers manually modify resources like security groups, the stack enters a 'drifted' state. Running drift detection on the stack identifies exactly which resources have changed and details the specific configuration differences. This directly addresses the manager's need to determine what modifications occurred.
Why the Other Options Are Wrong
Adding a Conditions section (Option A) is used to control resource creation based on runtime parameters, not to audit past changes. Executing a change set (Option C) is a mechanism to deploy updates defined in the template, which would overwrite manual changes or fail, rather than reporting them. Amazon Detective (Option D) is a security service for analyzing logs and finding the root cause of security findings, not for comparing IaC template states against actual infrastructure.
Community Comment Notes
The community comments strongly support Option B, citing the official AWS documentation on using CloudFormation stack drift. Users highlight that drift detection is specifically meant to identify resources where configuration changes have been made outside of CloudFormation management. There is no dissent in the provided comments, reinforcing that B is the definitive answer.
Official Reference
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a question asks about identifying manual changes to infrastructure managed by IaC tools like CloudFormation, immediately look for 'drift detection.' Remember that change sets are for applying future changes, while drift detection is for auditing past discrepancies.
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
Mo_1981 👍 3 Answered Bhttps://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html
-
preachr 👍 1 Answered BYou can use drift detection to identify stack resources to which configuration changes have been made outside of CloudFormation management.
-
albert_kuo 👍 2 Answered BDetect drift
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All DVA-C02 Questions
Access 100 questions with complete answers and detailed explanations.
View Full DVA-C02 Practice Test →