Safely Handle Configuration Drift with CloudFormation Drift-Aware Change Sets

This article explains CloudFormation drift-aware change sets, a new feature that safely handles configuration drift by showing three-way comparisons before deployment.

• Drift-aware change sets compare new template, actual resource state, and previous template
• Prevents dangerous overwrites like accidental Lambda memory reduction during updates
• Systematically remediates unauthorized changes like forgotten security group rules
• Recreates accidentally deleted resources while maintaining infrastructure dependencies
• Use REVERT_DRIFT deployment mode to bring resources back to template compliance
• Available via CloudFormation Console or AWS CLI with --deployment-mode REVERT_DRIFT parameter
• Best practice: always review three-way comparisons before executing change sets

Drift-aware change sets enable safe infrastructure automation by preventing unexpected resource modifications and maintaining compliance with approved templates.