From clickops to governed IaC: CloudFormation drift detection in practice

This article explains how to migrate from manual infrastructure changes (ClickOps) to governed Infrastructure as Code using CloudFormation's IaC Generator and drift detection.

• CloudFormation IaC Generator scans AWS accounts and produces templates from existing resources, establishing visibility into infrastructure.
• Teams must decide per-resource whether to import existing resources or recreate them based on criticality, downtime tolerance, and dependency complexity.
• Organize CloudFormation stacks by lifecycle, ownership, and change frequency to reduce operational risk and enable clear accountability.
• Automate drift detection using Amazon EventBridge to schedule detection runs and route alerts to appropriate teams.
• Implement deliberate remediation policies; automated rollbacks in production require caution as drift often reflects legitimate operational decisions.
• Use drift-aware change sets to evaluate actual resource state before deployments, preventing unintended overwrites of manual changes.
• Progress through four maturity levels: visibility, control, automation, and governance through ownership assignment, process enforcement, and feedback loops.

Successful IaC adoption requires organizational shifts in accountability, process discipline, and continuous drift awareness alongside technical tooling.