Skip to main content

atmos aws cloudformation drift detect

Trigger a fresh CloudFormation drift detection (DetectStackDrift) against the deployed stack and poll until it completes, then render the overall drift status and drifted-resource count. Use drift describe afterward to see per-resource results.

Experimental
atmos aws cloudformation drift detect --help

Usage​

atmos aws cloudformation drift detect <component> --stack <stack> [options]
atmos aws cloudformation drift detect vpc -s plat-ue2-dev

Fail the command (non-zero exit) when drift is found, for CI:

atmos aws cloudformation drift detect vpc -s plat-ue2-dev --fail-on-drift

Run drift detection for all or affected components in dependency order:

atmos aws cloudformation drift detect --all -s plat-ue2-dev --fail-on-drift
atmos aws cloudformation drift detect --affected --base origin/main --fail-on-drift

Flags​

--stack, -s (required for a single component)
Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with --all/--affected.
--fail-on-drift (optional)
Exit non-zero if drift is detected. Useful for CI drift-detection jobs.
--all (optional)
Run drift detection for all aws/cloudformation components in dependency order.
--affected (optional)
Run drift detection for affected aws/cloudformation components and their dependencies.
--include-dependents (optional)
With --affected, include dependent aws/cloudformation components.
--tags (optional)
Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.
--labels (optional)
Filter by labels (comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.

Behavior​

drift detect polls CloudFormation every 3 seconds until the detection operation completes, and gives up after 15 minutes if it hasn't. A detection that itself fails (DETECTION_FAILED) is always an error, independent of --fail-on-drift.

note

drift detect does not fire before/after hook events — only apply, diff, and delete do.