AWS Certified DevOps Engineer – ProfessionalConfiguration Management and Infrastructure as CodeMedium
A DevOps team is managing several AWS accounts for different environments (dev, test, prod). They use AWS CloudFormation for provisioning resources. Over time, some resources in the 'test' account have been manually modified outside of CloudFormation, leading to configuration drift. The team wants to identify these deviations automatically and remediate them. Which AWS service combination would best help them detect and potentially revert these unauthorized changes?
- AAWS Systems Manager State Manager and AWS Lambda
- BAWS Config and AWS CloudFormation Drift Detection
- CAmazon EventBridge and Amazon SNS
- DAWS CloudTrail and Amazon CloudWatch Logs
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Config and AWS CloudFormation Drift Detection
AWS CloudFormation Drift Detection identifies when a stack's actual configuration differs from its CloudFormation template. AWS Config can continuously monitor resource configurations for compliance and trigger remediation actions, making this combination ideal for detecting and managing configuration drift.
Why the other options are wrong
- A. Systems Manager State Manager can maintain desired state, but AWS Config provides broader, continuous monitoring and drift detection capabilities for CloudFormation stacks.
- C. EventBridge and SNS are for event routing and notifications, useful for alerts but not for active drift detection and configuration comparison against IaC templates.
- D. CloudTrail logs API activity and CloudWatch Logs collects logs, which can help in auditing but are not designed for automatic drift detection and remediation.
Configuration Drift
The phenomenon where the actual state of an infrastructure resource deviates from its desired or defined state, often due to manual changes outside of an Infrastructure as Code (IaC) process.
- Leads to inconsistencies and unpredictable behavior.
- Makes troubleshooting difficult and compromises security.
- Can be detected using tools that compare actual vs. desired state.
Memory trick: Drift Detection finds the gap, Config keeps the state on the map.