aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[Feature Request] Drift detection - CloudTrail mapping for adding more information
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
## 1. Title
#### Drift detection - CloudTrail mapping for adding more information
## 2. Scope of request
[CloudFormation drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html) currently shows information regarding which changes and properties are drifted. This information is useful, nevertheless it does not tell anything regarding how that changed was introduced, IAM user, etc. For investigating how and who introduced this drift, CloudTrail must be used for tracing the API calls against the drifted resource.
## 3. Expected behavior
Even though is possible to get the information via CloudTrail, it would be nice to obtain this in a more automated and consistent manner, visible or accessible right next to the drifted changes themselves. The implementation for this, can be just a quick link to CloudTrail, specifying the exact queries and filters for retrieving the API calls that introduced that change.
I understand that the implementation may have some challenges, but it is possible to filter and prepare the exact query for retrieving the API calls performed against certain resource (discarding the ones executed by CloudFormation itself). At the most basic level, this can be implemented as a CloudTrail quick-link.
## 4. Suggest specific test cases
N / A
## 5. Helpful Links to speed up research and evaluation
N / A
## 6. Category (required) - Will help with tagging and be easier to find by other users to +1
CloudFormation / Console
## 7. Any additional context (optional)
Even though is possible to achieve this via CloudTrail directly, this will save time and effort. This can be an option that is disabled by default (in order to avoid unnecesary expensive queries to CloudTrail). This detailed auditing information, may be optionally enabled/disabled before performing the drift detection.
Contributor guide
Assessment
This issue has not been assessed yet.