Instructor: So we've seen that CloudFormation
is great to create infrastructure.
But we are not protected by CloudFormation
against manual changes in the configuration
of what we create with CloudFormation.
So to make it clear, someone that is not you
could go into the console
and change the configuration of some resources
that were indeed created with CloudFormation.
So this is called a drift.
And to detect the drift,
we can use the feature called CloudFormation drift.
So not all resources are supported
but you can go to this URL to check it out.
But I found that the coverage
is already pretty, pretty good.
So let's go in the hands-on to get a demo
of how CloudFormation drift works.
So let's go ahead and practice drift by creating a stack
the template is ready, I'm going to upload it
and we'll choose 3-drift-security-group.yaml.
We can view this template in the designer
just to have a look
and if you look at the template itself
which is not very handy here
we have two security groups, one and two
and if we look at them, there's an SSHSecurityGroup
and an HTTPSecurityGroup,
as well as a VPC parameter
to link it to the security groups.
And so what we want to do is to ensure
that the configuration of the security groups
has not changed over time.
So let's go ahead and first create the template.
So I've clicked on the cloud upload button
which is going to make me click on next
and then I'll call it DemoDriftSG,
we need to specify a VPCid
so I will use the drop down and specify my default one.
Click on next,
scroll down and click on create stack.
So the effect of this is that this is going to create
two security groups for me
and as you can expect, I'm going to change manually
the security group configuration.
So they should be very quick,
the security groups are in create in progress
and they're now both completed.
So if I've got a resources
I have a link to my both security groups.
So if I go to my HTTPSecurityGroup, under inbound rule,
I can edit it.
And for example, I can change this rule to say
that I want a different Cidrip and I can add a description.
So Foobar, and then this one,
maybe I want to add HTTPS as well
in this Security Group from anywhere.
Okay, click on save rule.
And in terms of the other Security Group
which is right here, this one, I can go
into inbound rule and I can edit them
and just delete this rule overall and click on save.
So obviously the configuration
of our security groups have changed,
and so therefore I'm going to have to detect the drift
but right now CloudFormation
is not aware that anything has changed.
So to make it aware, we can click on stack actions
and then click on detect drift.
And this is going to start a drift detection mechanism
and then under stack action view drift results.
We can look at the results and as you can see,
it's already finished.
The drift status is drifted.
And so there are two modified Security Groups
and we can click on one for example
and click on view drift detail.
So it is saying that's the Cidrip IP is not equal
and there's been one rule added.
So there's two differences
and it shows us what the expected configuration is
and what the actual configuration is.
So as we can see here, well, they're not equal
and so we can go ahead and either update our templates
to match the actual configuration,
because maybe this is something we want to include
in our templates
or we want to revert our stack
by making sure that this is applied instead.
And we could go, for example into cloud trial
to understand who has changed our security group and when
to really understand the root cause of this.
And so for the SSHSecurityGroup,
again I can click on view drift details, and it's modified
and we can see here there's a change.
This rule has been removed
and so the expected is this and the actual is that.
So it's really, really cool to see really the drift
because they're really helpful to know
if your CloudFormation templates
have drifted once in a while.
So I would recommend for you to run the drifts quite often
if you can, you can also access the drift menu
from the left hand side on the drifts
and this will take you to the drift menu, but that's it.
And when you're done just delete this templates
and you're good to go.
I will see you in the next lecture.