Skip to main content
InfraAudit parses CloudFormation templates (YAML or JSON) and compares them against the live configuration of matched AWS resources. This surfaces cases where someone modified a resource directly in the AWS console without updating the CloudFormation stack.
InfraAudit does not interact with the CloudFormation service directly. It does not create, update, or delete stacks. Drift detection compares template-declared attributes against live resource configuration — this is separate from CloudFormation’s own stack drift detection feature.

​
Upload a CloudFormation template

1

Open the IaC section

In the sidebar, click IaC, then click Upload IaC definition.
2

Select CloudFormation as the type

Choose CloudFormation from the type selector.
3

Upload the template

Upload your .yaml or .json template file. Optionally add a name for the definition.
4

Review results

Click Upload. InfraAudit parses the template and runs a drift comparison immediately.

​
How resource matching works

InfraAudit matches Resources in your template to live AWS resources in your connected account. Matching uses the CloudFormation logical resource ID and, where resolvable, the physical resource ID.
CloudFormation resource typeMatched on
AWS::EC2::InstanceInstance ID
AWS::S3::BucketBucket name
AWS::RDS::DBInstanceDB identifier
AWS::Lambda::FunctionFunction name
AWS::EC2::SecurityGroupSecurity group ID

​
View drift results

After uploading, click the definition in the IaC list to see:
  • Parse status (success, or parse error with the line number)
  • Resources declared in the template
  • Resources matched to live inventory
  • Drift findings: declared attribute value versus the live value for each attribute that differs

​
Parameters and intrinsic functions

InfraAudit resolves CloudFormation intrinsic functions (!Ref, !Sub, !Join) where the values are static or can be inferred from the template. The following are not resolved and are excluded from drift comparison:
  • Cross-stack references using !ImportValue
  • Runtime parameters that require a deployed stack to evaluate
  • Dynamic resource attributes (e.g. Fn::GetAtt for values only known post-deployment)
Resources with unresolved identifiers appear as unmatched in the drift report.

​
Continuous monitoring with CI/CD

Upload updated templates as part of your deployment pipeline to keep drift detection current after every stack update: 
# Run after a stack deploy
infraudit iac upload \
  --provider cloudformation \
  --file template.yaml \
  --name "network-stack" \
  --wait
The --wait flag blocks until the drift comparison completes and exits with a non-zero code if any drift is found.