The port I opened "just for a minute" and drift detection found weeks later

For a cloud computing assignment we deployed a small web stack with CloudFormation. At about 1 a.m. the night it was due, my app wasn't reachable, and to test it quickly I added an inbound rule for port 8080 from anywhere directly in the console. It worked, I submitted, I went to bed. I completely forgot the rule existed.

A few weeks later I was reading about drift detection  for a different reason and ran it on that stack just to see what it looked like.

The stack came back as DRIFTED. The security group was MODIFIED, and the drift details showed the difference between the ingress rules in my template and the ones actually in the account. The extra one was my 1 a.m. rule, still open to 0.0.0.0/0.

There were two ways to fix it: remove the rule in the console so the resource matches the template again, or, if the rule was actually needed, add it to the template and update the stack so the change is tracked. I didn't need the port anymore, so I removed it and ran drift detection again until the stack came back IN_SYNC.

Drift detection has limits worth knowing. It only runs when you ask it to, and it only compares properties CloudFormation knows about for supported resource types. It won't tell you about resources someone created outside the stack entirely.

The bigger thing for me wasn't the tool, though. A console change is invisible to the template, and a month later nobody remembers why that port is open, including the person who opened it. Now when I change something by hand to debug, I write it in the README right away and check drift before I call the work done.