atmos aws cloudformation drift describe

Show the per-resource results of the most recently completed drift detection (DescribeStackResourceDrifts) without triggering a new one. Run drift detect first — this command only reads existing results.

Experimental

atmos aws cloudformation drift describe --help

Usage

atmos aws cloudformation drift describe <component> --stack <stack> [options]

atmos aws cloudformation drift describe vpc -s plat-ue2-dev

Flags

--stack, -s (required for a single component)

Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with --all/--affected.

--all (optional)

Process all aws/cloudformation components in dependency order.

--affected (optional)

Process affected aws/cloudformation components and their dependencies. Compares the working tree against a base: see --base and the Git flags below.

--include-dependents (optional)

With --affected, include dependent aws/cloudformation components.

--base (optional)

Git base ref or SHA to compare against for affected detection: --base=origin/main. A value that looks like a commit SHA is treated as --sha, anything else as --ref. Used with --affected.

--tags (optional)

Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.

--labels (optional)

Filter by labels (repeatable and/or comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.

--ci (optional)

Enable native CI integration (requires ci.enabled): writes the job summary and output variables for the operation. Also enabled by the CI and ATMOS_CI environment variables.

--ref (optional)

Git ref to compare against for affected detection. Used with --affected.

--sha (optional)

Git SHA to compare against for affected detection. Used with --affected.

--repo-path (optional)

Path to an already cloned target repository to use as the affected baseline. Used with --affected.

--clone-target-ref (optional)

Clone the target ref instead of checking it out in the current repository for affected detection. Used with --affected.

--ssh-key (optional)

Path to the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.

--ssh-key-password (optional)

Password for the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.

--skip-hooks (optional)

Skip lifecycle hooks for this invocation. --skip-hooks with no value skips every hook; --skip-hooks=name1,name2 skips only the named hooks. Equivalent to the ATMOS_SKIP_HOOKS environment variable.

Output

Only resources that are not IN_SYNC are printed. Each MODIFIED resource is followed by one line per property difference, with the property path, the expected value from the template, the actual value in the deployed resource, and the difference type:

  MODIFIED   AWS::SSM::Parameter          Param
    /Value: expected v2, actual v1 (NOT_EQUAL)

If the stack has no drift results at all (no detection has ever run), drift describe says so and suggests running drift detect first.

note

drift describe fires before.aws/cloudformation.drift-describe and after.aws/cloudformation.drift-describe hooks. The command-name hyphen is part of each event.