CloudFormation Drift Remediation
Installation
This package is available on pypi, you can for example use on of these commands (pipx is recommended)
pipx install cfn-drift-remediation
pip install cfn-drift-remediation
Usage
- Run drift detection on a stack, and verify that you want to remediate it by changing the provisioned resource (using the stack as the source of truth).
- run one of the commands below
- Run drift detection again to verify that everything is in sync again.
# Default usage
cfn-drift-remediation stack_name
# Using a different profile
AWS_DEFAULT_PROFILE=profile-name cfn-drift-remediation stack_name
# Using a third party tool like aws-vault
aws-vault exec profile-name -- cfn-drift-remediation stack_name
How this works
This tool will read the existing drift of a stack, iterate through the drifted resources and construct a patch document to change the actual (detected) property values to the expected (stack) values.
Caveats
- Changes are done with CloudControl API. This does mean that if the drifted resources do not support Cloud Control API, they will be skipped.
- For some resources the order in a list does not matter, this might lead to a failure to apply changes, because Cloud Control API will assume the resource is not in the drifted state it expects.
- We do not support creating resources that were completely deleted from the stack. The drift detection api does not return enough information to construct the replacement resource.
Development
We use poetry to manage this project
- Clone this repository
- Run
poetry install - Activate the virtualenvironment with
poetry shell(you can also usepoetry run $command)
Releasing a new version to pypi
- Edit pyproject.toml to update the version number
- Edit cfn_drift_remediation/_init.py to update the version number
- Commit the version number bump
- Run tests
poetry run pytest(you might have to install dependencies withpoetry install --dev) - Run
poetry publish --build - Push to GitHub
- Create a new release in GitHub
Using poetry in Visual Studio Code
If you want to use poetry in Visual Studio Code, it works best if the virtual environment is created inside the project folder. Once the virtual environment is created, you can run the "Python: Select interpreter" command in Visual Studio Code, and point to the .venv folder.
poetry config virtualenvs.in-project true
If you already created the virtual environment, you have to recreate it
# from within the project folder
poetry env remove $(poetry env list)
poetry install
20 Jun 18, 2022
10 Aug 18, 2022
6 Mar 31, 2022
16 Nov 24, 2022
11 Dec 17, 2022
31 Nov 21, 2022
7 Feb 15, 2022
51 Dec 10, 2022
2 Jan 25, 2022
18 Dec 14, 2022
3 Jan 25, 2022
16.3k Dec 31, 2022
2 Dec 14, 2021
4 Sep 09, 2021
3 Dec 21, 2021
1.1k Jan 04, 2023
1 Oct 27, 2021
17 Nov 13, 2022
2 Dec 22, 2022
3 Feb 27, 2022
2 Feb 16, 2022
1 Dec 26, 2021
3.9k Jan 01, 2023
677 Dec 21, 2022
1 Nov 21, 2021
17 Dec 07, 2022
71 Jul 19, 2022
9 Jun 01, 2022
17 Dec 11, 2022