# atmos aws cloudformation drift detect

Trigger a fresh CloudFormation drift detection (`DetectStackDrift`) against
the deployed stack and poll until it completes, then render the overall
drift status and drifted-resource count. Use
[`drift describe`](/cli/commands/aws/cloudformation/drift/describe)
afterward to see per-resource results.

> ⚠️ Experimental

## Usage

```shell
atmos aws cloudformation drift detect <component> --stack <stack> [options]
```

```shell
atmos aws cloudformation drift detect vpc -s plat-ue2-dev
```

Fail the command (non-zero exit) when drift is found, for CI:

```shell
atmos aws cloudformation drift detect vpc -s plat-ue2-dev --fail-on-drift
```

Run drift detection for all or affected components in dependency order:

```shell
atmos aws cloudformation drift detect --all -s plat-ue2-dev --fail-on-drift
atmos aws cloudformation drift detect --affected --base origin/main --fail-on-drift
```

## Flags

- **`--stack`, `-s` (required for a single component)**
  Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with 
  `--all`
  /
  `--affected`
  .
- **`--fail-on-drift` (optional)**
  Exit non-zero if drift is detected. Useful for CI drift-detection jobs.
- **`--all` (optional)**
  Run drift detection for all 
  `aws/cloudformation`
   components in dependency order.
- **`--affected` (optional)**
  Run drift detection for affected 
  `aws/cloudformation`
   components and their dependencies.
- **`--include-dependents` (optional)**
  With 
  `--affected`
  , include dependent 
  `aws/cloudformation`
   components.
- **`--tags` (optional)**
  Filter by tags (comma-separated, matches any): 
  `--tags=production,tier-1`
  . Composes with 
  `--all`
  /
  `--affected`
   to narrow the selected set further; cannot be combined with a single component argument.
- **`--labels` (optional)**
  Filter by labels (comma-separated 
  `key=value`
   or 
  `key:value`
   pairs, matches all): 
  `--labels=cost-center=platform,compliance=sox`
  . Composes with 
  `--all`
  /
  `--affected`
  /
  `--tags`
  ; cannot be combined with a single component argument.

## Behavior

`drift detect` polls CloudFormation every 3 seconds until the detection
operation completes, and gives up after 15 minutes if it hasn't. A detection
that itself fails (`DETECTION_FAILED`) is always an error, independent of
`--fail-on-drift`.

:::note
`drift detect` does not fire `before`/`after` hook events — only
[`apply`](/cli/commands/aws/cloudformation/apply),
[`diff`](/cli/commands/aws/cloudformation/diff), and
[`delete`](/cli/commands/aws/cloudformation/delete) do.
:::