Learn how to enforce CloudFormation stack drift detection at scale using AWS Config rules and Lambda-driven auto-remediation — a common architecture question in senior Cloud and DevOps interviews.
You'll learn:
- How AWS Config detects configuration drift against CloudFormation expected stack states using managed and custom rules
- Wiring an EventBridge rule to trigger a Lambda function when Config flags a stack as DRIFTED
- Lambda remediation patterns: re-running cloudformation detect-stack-drift vs. forcing a stack update to reconcile out-of-band changes
- Gotchas around drift detection cost, IAM permissions for the Config recorder, and distinguishing intentional changes from real drift
- How to scope remediation safely — alerting vs. hard auto-rollback and when each is appropriate in production
Keywords: CloudFormation drift detection, AWS Config auto-remediation, Lambda CloudFormation remediation, IaC drift enforcement, AWS Config rules interview
🎧 Listen, then go deeper — DevOps & Cloud interview-prep ebooks at DevOpsInterview.Cloud
