From clickops to governed IaC: CloudFormation drift detection in practice
Most AWS environments start clean. You provision a VPC, spin up an EC2 instance or two, maybe add a database. But six months later, after late-night hotfixes, quick security patches, and those “temporary” changes that never got reverted, your infrastructure has drifted far from your original templates. A security group rule got added manually. An RDS parameter was tweaked through the console. Suddenly, you’re not sure what your actual infrastructure looks like anymore—and neither is your IaC template. This is ClickOps: infrastructure changes made outside of version control, and it’s one of the most common pain points teams face at scale.
CloudFormation drift detection solves this problem by comparing your actual AWS resources against your templates to identify what’s changed. Here’s how it works technically: you run a drift detection scan on a stack, and CloudFormation systematically checks each resource’s current configuration against the template definition. For every mismatched property—whether it’s a security group rule, an environment variable, or an IAM policy—CloudFormation flags it as “MODIFIED” and provides details about the difference. You can see drifts at the stack level (showing which resources have drifted) or dive deeper to understand exactly which attributes changed. The service even supports different resource types with varying degrees of coverage, so you know where detection is reliable and where manual verification might be needed. Once you understand what’s drifted, you have options: update your template to match reality, remediate the resources back to the template specification, or investigate why the change happened in the first place.
Why does this matter? Consider a real scenario: a compliance audit discovers that a production database subnet doesn’t have encryption enabled—but your template explicitly requires it. Without drift detection, you’d spend hours comparing templates against the console. With it, you get a clear inventory of non-compliance in minutes. More broadly, drift detection is your bridge out of ClickOps. It lets you document the current state of legacy environments, enforce governance going forward, and build confidence in your IaC adoption. Teams use it to audit multi-environment deployments, catch accidental misconfigurations before they cause incidents, and create accountability around infrastructure changes. The process becomes: detect drifts, address them, lock down change procedures through change sets and approval workflows, then use drift detection regularly to keep everything honest. It’s not about punishing teams for manual changes—it’s about creating visibility and control in environments that have grown organically.