CloudFormation Stack Status Showing drifted after we trigger an update to it

Question

Hello,
I need your help to find out the potential reason why my cloudformation stack shows me drifted if i try to trigger an update on the cloudformation template. Basically i have a cloudformation template which is configuring few aws services like lambda function, api gateway , dynamo db , cognito user pool client. So what i am trying to do it i am trying to create a new user pool client and add that client to the api gateway as a trigger to lambda function but with this update my cloudformation stack starts showing drifted ?

As per my understanding, after the update the cloudformation template and resources should be aligned and it should not show drifted status ?

Can someone help to fix and identify the issue over here ?

Thanks

Template after update -

"Authorizer": {
      "Type": "AWS::ApiGatewayV2::Authorizer",
      "Properties": {
        "ApiId": { "Ref": "HttpApi" },
        "Name": { "Fn::Sub": "ABC-${StackName}" },
        "AuthorizerType": "JWT",
        "IdentitySource": ["$request.header.Authorization"],
        "AuthorizerUri": {
          "Fn::Sub": "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${LambdaFunction.Arn}/invocations"
        },
        "JwtConfiguration": {
          "Audience": [
            { "Ref": "CognitoUserPoolClient8adb06df1504462ba54116be1d33f30a" },
            { "Ref": "CognitoUserPoolClient7977a5a1837c41c9866d5ed814d14670" }
          ],
          "Issuer": {
            "Fn::Sub": "https://cognito-idp.${AWS::Region}.amazonaws.com/${CognitoUserPool}"
          }
        }
      }
    },

![CloudFormation Stack Drift Status](/media/postImages/original/IMAFW6hFDoT5CyVjJlPex03g)
![Resource Image](/media/postImages/original/IMSCWIIUBeS5mF1vl4SOfANA)
![Drift Details AWS](/media/postImages/original/IMgys0XqjDQWG31Rghs9Sw3w)

Regards,
Shubhanshu

Answer

Updating the template will compare deployed version with new template and do updated of what has changed between template versions. It won't automatically correct drifted configurations back to what is defined in template. There are basicly 2 ways to correct the drift. First is modify drifted resources back to what is defined in template. This doesn't require stack update but you can simply rerun drift detection again after modifying the resources. Second way is to modify the template to match with drifted configuration. This won't change drifted resources (as they already match the template) but it can cause some other resources to be updated/replaced if they depend on drifted ones. I would recommend using the first method as it would get you back to original configuration before the drift and then it would be more predictable to continue updating the stack.

Here are the instructions how to find what is actually drifted https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/detect-drift-stack.html

CloudFormation Stack Status Showing drifted after we trigger an update to it

Relevant content