‫So we've seen that CloudFormation
‫is great to create infrastructure.
‫But we are not protected by CloudFormation
‫against manual changes in the configuration
‫of what we create with CloudFormation.
‫So to make it clear, someone that is not you
‫could go into the console
‫and change the configuration of some resources
‫that were indeed created with CloudFormation.
‫So this is called a drift.
‫And to detect the drift,
‫we can use the feature called CloudFormation drift.
‫So not all resources are supported
‫but you can go to this URL to check it out.
‫But I found that the coverage
‫is already pretty, pretty good.
‫So let's go in the hands-on to get a demo
‫of how CloudFormation drift works.
‫So let's go ahead and practice drift by creating a stack
‫the template is ready, I'm going to upload it
‫and we'll choose 3-drift-security-group.yaml.
‫We can view this template in the designer
‫just to have a look
‫and if you look at the template itself
‫which is not very handy here
‫we have two security groups, one and two
‫and if we look at them, there's an SSHSecurityGroup
‫and an HTTPSecurityGroup,
‫as well as a VPC parameter
‫to link it to the security groups.
‫And so what we want to do is to ensure
‫that the configuration of the security groups
‫has not changed over time.
‫So let's go ahead and first create the template.
‫So I've clicked on the cloud upload button
‫which is going to make me click on next
‫and then I'll call it DemoDriftSG,
‫we need to specify a VPCid
‫so I will use the drop down and specify my default one.
‫Click on next,
‫scroll down and click on create stack.
‫So the effect of this is that this is going to create
‫two security groups for me
‫and as you can expect, I'm going to change manually
‫the security group configuration.
‫So they should be very quick,
‫the security groups are in create in progress
‫and they're now both completed.
‫So if I've got a resources
‫I have a link to my both security groups.
‫So if I go to my HTTPSecurityGroup, under inbound rule,
‫I can edit it.
‫And for example, I can change this rule to say
‫that I want a different Cidrip and I can add a description.
‫So Foobar, and then this one,
‫maybe I want to add HTTPS as well
‫in this Security Group from anywhere.
‫Okay, click on save rule.
‫And in terms of the other Security Group
‫which is right here, this one, I can go
‫into inbound rule and I can edit them
‫and just delete this rule overall and click on save.
‫So obviously the configuration
‫of our security groups have changed,
‫and so therefore I'm going to have to detect the drift
‫but right now CloudFormation
‫is not aware that anything has changed.
‫So to make it aware, we can click on stack actions
‫and then click on detect drift.
‫And this is going to start a drift detection mechanism
‫and then under stack action view drift results.
‫We can look at the results and as you can see,
‫it's already finished.
‫The drift status is drifted.
‫And so there are two modified Security Groups
‫and we can click on one for example
‫and click on view drift detail.
‫So it is saying that's the Cidrip IP is not equal
‫and there's been one rule added.
‫So there's two differences
‫and it shows us what the expected configuration is
‫and what the actual configuration is.
‫So as we can see here, well, they're not equal
‫and so we can go ahead and either update our templates
‫to match the actual configuration,
‫because maybe this is something we want to include
‫in our templates
‫or we want to revert our stack
‫by making sure that this is applied instead.
‫And we could go, for example into cloud trial
‫to understand who has changed our security group and when
‫to really understand the root cause of this.
‫And so for the SSHSecurityGroup,
‫again I can click on view drift details, and it's modified
‫and we can see here there's a change.
‫This rule has been removed
‫and so the expected is this and the actual is that.
‫So it's really, really cool to see really the drift
‫because they're really helpful to know
‫if your CloudFormation templates
‫have drifted once in a while.
‫So I would recommend for you to run the drifts quite often
‫if you can, you can also access the drift menu
‫from the left hand side on the drifts
‫and this will take you to the drift menu, but that's it.
‫And when you're done just delete this templates
‫and you're good to go.
‫I will see you in the next lecture.