> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Detect IaC Drift with CloudFormation Templates

> Upload CloudFormation YAML or JSON templates to InfraAudit to compare declared stack resources against live AWS infrastructure and surface drift findings.

InfraAudit parses CloudFormation templates (YAML or JSON) and compares them against the live configuration of matched AWS resources. This surfaces cases where someone modified a resource directly in the AWS console without updating the CloudFormation stack.

<Note>
  InfraAudit does not interact with the CloudFormation service directly. It does not create, update, or delete stacks. Drift detection compares template-declared attributes against live resource configuration — this is separate from CloudFormation's own stack drift detection feature.
</Note>

## Upload a CloudFormation template

<Tabs>
  <Tab title="UI">
    <Steps>
      <Step title="Open the IaC section">
        In the sidebar, click **IaC**, then click **Upload IaC definition**.
      </Step>

      <Step title="Select CloudFormation as the type">
        Choose **CloudFormation** from the type selector.
      </Step>

      <Step title="Upload the template">
        Upload your `.yaml` or `.json` template file. Optionally add a name for the definition.
      </Step>

      <Step title="Review results">
        Click **Upload**. InfraAudit parses the template and runs a drift comparison immediately.
      </Step>
    </Steps>
  </Tab>

  <Tab title="CLI">
    ```bash theme={null}
    # Upload a YAML template
    infraudit iac upload --provider cloudformation --file template.yaml

    # Upload a JSON template with a name
    infraudit iac upload \
      --provider cloudformation \
      --file template.json \
      --name "network-stack"
    ```
  </Tab>

  <Tab title="API">
    ```bash theme={null}
    curl -X POST http://localhost:8080/api/v1/iac/upload \
      -H "Authorization: Bearer $TOKEN" \
      -F "file=@template.yaml" \
      -F "type=cloudformation" \
      -F "name=network-stack"
    ```
  </Tab>
</Tabs>

## How resource matching works

InfraAudit matches `Resources` in your template to live AWS resources in your connected account. Matching uses the CloudFormation logical resource ID and, where resolvable, the physical resource ID.

| CloudFormation resource type | Matched on        |
| ---------------------------- | ----------------- |
| `AWS::EC2::Instance`         | Instance ID       |
| `AWS::S3::Bucket`            | Bucket name       |
| `AWS::RDS::DBInstance`       | DB identifier     |
| `AWS::Lambda::Function`      | Function name     |
| `AWS::EC2::SecurityGroup`    | Security group ID |

## View drift results

After uploading, click the definition in the **IaC** list to see:

* Parse status (success, or parse error with the line number)
* Resources declared in the template
* Resources matched to live inventory
* Drift findings: declared attribute value versus the live value for each attribute that differs

## Parameters and intrinsic functions

InfraAudit resolves CloudFormation intrinsic functions (`!Ref`, `!Sub`, `!Join`) where the values are static or can be inferred from the template. The following are **not** resolved and are excluded from drift comparison:

* Cross-stack references using `!ImportValue`
* Runtime parameters that require a deployed stack to evaluate
* Dynamic resource attributes (e.g. `Fn::GetAtt` for values only known post-deployment)

Resources with unresolved identifiers appear as **unmatched** in the drift report.

## Continuous monitoring with CI/CD

Upload updated templates as part of your deployment pipeline to keep drift detection current after every stack update:

```bash theme={null}
# Run after a stack deploy
infraudit iac upload \
  --provider cloudformation \
  --file template.yaml \
  --name "network-stack" \
  --wait
```

The `--wait` flag blocks until the drift comparison completes and exits with a non-zero code if any drift is found.