You are responsible for maintaining several AWS CloudFormation templates. Last month, there were two incidents that resources in existing CloudFormation stacks that someone has changed without any alerts or notifications. Because of that, the potential changes may have negative impacts on the stacks, and the changes may be lost if the stacks are re-deployed. This is not compliant with company policy. Your team lead asked you to warn the team whenever a drift in the CloudFormation stack appears. What is the best way to achieve that?

Answer options:

A.Use a Lambda function to check the drift status in each CloudFormation stack every 10 minutes. If there is a drift, send the team an email via AWS SES service.
B.Create a rule in AWS Config to evaluate if the stack is considered to have drifted for its resources. If the rule is NON_COMPLIANT, notify the team via an SNS notification.
C.Create a CloudWatch event rule for CloudFormation. If any event happens for CloudFormation, trigger an email notification by SNS.
D.Enable CloudTrail. Use a Lambda function to analyze the CloudTrail logs. Send an email if it is found that the resources in CloudFormation stacks are modified.

Correct Answer – B
In AWS Config, there is an AWS managed rule (cloudformation-stack-drift-detection-check
To check if there is a drift, refer to
https://docs.aws.amazon.com/config/latest/developerguide/cloudformation-stack-drift-detection-check.html
for details.
Option A is incorrect: Because this is not as straightforward as Option
B. And SES is unsuitable to be a notification service. It should be SNS.
Option B is CORRECT: Because it can quickly set up a rule to manage the drift status, and users can understand if the stacks are compliant or not.
Option C is incorrect: Because it should not be any event for the CloudWatch Event rule since the question only asks for the situation of stack drift.
Option D is incorrect: Extra efforts are required such as creating a Lambda function. Option B is much simpler as the AWS Config rule can easily identify a drift via an AWS managed rule.