CloudFormation drift detection issues.

AWS CloudFormation drift detection allows you to detect and compare any differences between the desired (template) and actual (deployed resources) stack resources. Here are some common issues related to CloudFormation drift detection and how to address them:

1. Drift Detection Not Supported:
   • Issue: Drift detection is not available for certain resource types or stack configurations.
   • Solution:
     • Check AWS documentation to verify if drift detection is supported for the specific resource types in your stack.
2. Stack Update in Progress:
   • Issue: You're unable to perform drift detection because the stack is currently being updated.
   • Solution:
     • Wait until the stack update is complete before initiating drift detection.
3. Insufficient IAM Permissions:
   • Issue: The IAM user or role doesn't have the necessary permissions to perform drift detection.
   • Solution:
     • Ensure that the IAM entity performing the drift detection has the cloudformation:DetectStackDrift permission on the stack.
4. Stack Not in Usable State:
   • Issue: The stack is in a state that doesn't allow drift detection (e.g., DELETE_COMPLETE, ROLLBACK_COMPLETE).
   • Solution:
     • Ensure that the stack is in a usable state (e.g., CREATE_COMPLETE, UPDATE_COMPLETE) before attempting drift detection.
5. Resource Exclusion Issues:
   • Issue: You want to exclude specific resources from drift detection, but they're still being included.
   • Solution:
     • Verify that the resource exclusion is correctly specified in the drift detection request. Double-check the resource identifiers and types.
6. Drift Detection Timing Out:
   • Issue: Drift detection is timing out before completion.
   • Solution:
     • If your stack has a large number of resources, consider adjusting the timeout settings or breaking down the drift detection into smaller operations.
7. Stack Doesn't Have Drift Detection Enabled:
   • Issue: Drift detection was not enabled when the stack was created or updated.
   • Solution:
     • You can enable drift detection by updating the stack and setting EnableDriftDetection to true in the stack's AWS::CloudFormation::Stack resource.
8. Stack Drift Status Stale:
   • Issue: The drift status appears stale or incorrect.
   • Solution:
     • Try refreshing the drift status by using the describe-stack-resource-drifts command.
9. False Positives:
   • Issue: Drift detection is reporting differences that are not actually a problem.
   • Solution:
     • Review the reported drift results carefully. It's possible that some differences are expected due to resource dependencies or other factors.
10. Logs and Notifications:
    • Issue: Lack of logs and notifications makes it hard to identify drift detection issues.
    • Solution:
      • Monitor the CloudWatch Logs associated with CloudFormation for any drift detection-related events or errors.

Remember to review the AWS documentation for specific CloudFormation drift detection details and best practices. Additionally, using CloudWatch Logs and Metrics can help in troubleshooting drift detection issues.