AWS CDKでドリフトの検出と確認ができるようになったのでClaude Codeと組み合わせてドリフトの解消までしてみた

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";

export class DriftTestStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    new cdk.aws_ec2.Vpc(this, "Vpc", {
      enableDnsHostnames: true,
      enableDnsSupport: true,
      natGateways: 0,
      maxAzs: 2,
      subnetConfiguration: [
        {
          name: "Public",
          subnetType: cdk.aws_ec2.SubnetType.PUBLIC,
          cidrMask: 27,
          mapPublicIpOnLaunch: true,
        },
        {
          name: "Isolated",
          subnetType: cdk.aws_ec2.SubnetType.PRIVATE_ISOLATED,
          cidrMask: 27,
        },
      ],
      gatewayEndpoints: {
        S3: {
          service: cdk.aws_ec2.GatewayVpcEndpointAwsService.S3,
        },
      },
    });
  }
}

>  cdk diff
start: Building DriftTestStack Template
success: Built DriftTestStack Template
start: Publishing DriftTestStack Template (<AWSアカウントID>-us-east-1)
success: Published DriftTestStack Template (<AWSアカウントID>-us-east-1)
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)

Stack DriftTestStack
There were no differences

✨  Number of stacks with differences: 0

>  cdk drift
✨  Synthesis time: 4.17s
Stack DriftTestStack
Modified Resources
[~] AWS::EC2::VPC Vpc Vpc8378EB38
 ├─ [~] /EnableDnsSupport
     ├─ [-] true
     └─ [+] false
 └─ [~] /EnableDnsHostnames
     ├─ [-] true
     └─ [+] false

1 resource has drifted from their expected configuration

✨  Number of resources with drift: 1 (7 unchecked)

## AWS Authentication

### Claude Code Session Limitations

- Each Bash command runs in isolated session
- Environment variables don't persist between commands

### Solution: Environment File Method

```bash
# Create .aws_env (NEVER commit)
eval $(aws configure export-credentials --format env) && \
echo "export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID" > .aws_env && \
echo "export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY" >> .aws_env && \
echo "export AWS_SESSION_TOKEN=$AWS_SESSION_TOKEN" >> .aws_env

# Add to .gitignore
echo ".aws_env" >> .gitignore

# Usage
source .aws_env && aws sts get-caller-identity

>  cdk drift
✨  Synthesis time: 4.19s
Stack DriftTestStack
Modified Resources
[~] AWS::EC2::VPC Vpc Vpc8378EB38
 ├─ [~] /EnableDnsSupport
     ├─ [-] true
     └─ [+] false
 └─ [~] /EnableDnsHostnames
     ├─ [-] true
     └─ [+] false
[~] AWS::EC2::Subnet Vpc/PublicSubnet1/Subnet VpcPublicSubnet1Subnet5C2D37C4
 └─ [~] /MapPublicIpOnLaunch
     ├─ [-] true
     └─ [+] false
Deleted Resources
[-] AWS::EC2::Subnet Vpc/IsolatedSubnet2/Subnet VpcIsolatedSubnet2Subnet16364B91

3 resources have drifted from their expected configuration

✨  Number of resources with drift: 3 (7 unchecked)

@drift.log に記載されているように、AWS CDKでデプロイしたリソースでドリフトが発生しています。
ドリフトの修正をしてください。

ドリフト修正の観点は以下のとおりです。

- 現在のAWS CDKのコードを正とし、実リソースの設定を変更する
- 実リソースが削除されている場合は、AWS CDKのコードを一時的に修正して、再度作成をしてください
- AWS CDKの操作は awslabs.cdk-mcp-server のMCPサーバーを使用する
    - cdk-nag など修正に直接的な関係がない操作を行なってはならない
- AWS CDKを介さずに実リソースの操作はする際にはAWS CLIを用いる

>  cdk drift
✨  Synthesis time: 4.09s
Stack DriftTestStack
No drift detected

✨  Number of resources with drift: 0 (7 unchecked)