An admin suspects someone manually modified resources that a CloudFormation stack manages, so the stack no longer matches its template. What's the correct way to identify exactly which resources changed?
A.Delete and recreate the stack
Recreating is destructive and doesn't identify what changed.
B.Run CloudFormation drift detection on the stack
Correct. Per-resource drift status vs the template.
C.Check CloudTrail for all API calls in the region
CloudTrail shows API calls, not a resource-vs-template diff.
D.Compare the template to the AWS Config timeline manually
Config shows change history but not template drift directly.
Why this answer
Drift detection compares each stack resource's actual configuration against the expected template and reports DRIFTED / IN_SYNC / NOT_CHECKED per resource — precisely the tool for detecting out-of-band manual changes. CloudTrail shows who did it afterward, but drift detection is the designed mechanism.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Deployment & Automation practice session.
Practice Deployment & Automation