Control: CloudFormation stacks differ from the expected configuration

Description

Ensure that the actual configuration of a Cloud Formation stack differs, or has drifted, from the expected configuration, a stack is considered to have drifted if one or more of its resources differ from their expected configuration.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cloudformation_stack_drift_detection_check

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cloudformation_stack_drift_detection_check --share

SQL

This control uses a named query:

select
  id as resource,
  case
    when stack_drift_status = 'IN_SYNC' then 'ok'
    when stack_drift_status = 'DRIFTED' then 'alarm'
    else 'skip'
  end as status,
  case
    when stack_drift_status = 'IN_SYNC' then title || ' drift status is ' || stack_drift_status || '.'
    when stack_drift_status = 'DRIFTED' then title || ' drift status is ' || stack_drift_status || '.'
    else title || ' drift status is ' || stack_drift_status || '.'
  end as reason
  
  , region, account_id
from
  aws_cloudformation_stack;

Control: CloudFormation stacks differ from the expected configuration

Description

Usage

SQL

Tags