CDKのドリフト検出ツール「cdk-real-drift」を試してみた

npm install -D cdk-real-drift

const bucket = new s3.Bucket(this, "VerificationBucket", {
  removalPolicy: cdk.RemovalPolicy.DESTROY,
  autoDeleteObjects: true,
});

const role = new iam.Role(this, "HandlerRole", {
  assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
  managedPolicies: [
    iam.ManagedPolicy.fromManagedPolicyArn(
      this,
      "LambdaBasicExec",
      "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
    ),
  ],
});

bucket.grantRead(role);

new lambda.Function(this, "Handler", {
  runtime: lambda.Runtime.NODEJS_22_X,
  handler: "index.handler",
  code: lambda.Code.fromAsset("lambda"),
  role,
  memorySize: 1024,
  timeout: cdk.Duration.seconds(30),
});

=== check: CdkrdVerificationStack (ap-northeast-1) ===
[CFn-Declared Drift: 1] (declared in your CloudFormation template — the live value differs)
  Handler.MemorySize (AWS::Lambda::Function)
      desired=1024
      actual =512

───────────────────────────────
result: 1 drift(s) (declared=1)
───────────────────────────────
info:
  - atDefault=22 (undeclared values matching a known AWS default — not drift)
  - generated=4 (auto-generated identifiers not in your template, AWS-assigned at deploy — not drift)
  - skipped=1 — NOT checked (coverage incomplete: custom resource 1)
  run with --verbose for the list
note: CdkrdVerificationStack: no .cdkrd baseline yet — run `cdkrd record` to establish one (future out-of-band changes then report as drift).
note: drift found — exit 0 (report-only). Pass --fail to make drift fail this command.

Stack CdkrdVerificationStack
Modified Resources
[~] AWS::Lambda::Function Handler Handler886CB40B
 └─ [~] /MemorySize
     ├─ [-] 1024
     └─ [+] 512
1 resource has drifted from their expected configuration
✨  Number of resources with drift: 1 (3 unchecked)

=== check: CdkrdVerificationStack (ap-northeast-1) ===
No baseline yet — these live-only values can't be confirmed as drift. Record them right from this `cdkrd check` prompt, or run `cdkrd record`.

[CFn-Declared Drift: 1] (declared in your CloudFormation template — the live value differs)
  Handler.MemorySize (AWS::Lambda::Function)
      desired=1024
      actual =512

[Potential Drift: 1] (live-only and not yet in your .cdkrd baseline, so cdkrd can't tell whether it's intended or an out-of-band change — Record to accept it, or Revert to remove it)
  Handler ▸ NONE arn:aws:lambda:ap-northeast-1:123456789012:function:CdkrdVerificationStack-Handler886CB40B-XXXXX (AWS::Lambda::Url) — created out of band — not in your CloudFormation template
      actual ={"InvokeMode":"BUFFERED","AuthType":"NONE","TargetFunctionArn":"CdkrdVerificationStack-Handler886CB40B-XXXXX"}
  ↳ this tier is a best-effort guess and can include false positives — if a value here is really an AWS-managed default or noise, please report it: https://github.com/go-to-k/cdk-real-drift/issues

─────────────────────────────────────────────────────────────
result: 2 findings — 1 drift (declared=1) + 1 potential drift
─────────────────────────────────────────────────────────────
info:
  - atDefault=22 (undeclared values matching a known AWS default — not drift)
  - generated=4 (auto-generated identifiers not in your template, AWS-assigned at deploy — not drift)
  - skipped=1 — NOT checked (coverage incomplete: custom resource 1)
note: drift found — exit 0 (report-only). Pass --fail to make drift fail this command.

baseline written: .cdkrd/baselines/CdkrdVerificationStack.123456789012.ap-northeast-1.json (3 recorded entry(ies))
note: CdkrdVerificationStack: record snapshotted undeclared + added state into the baseline only — 1 declared/deleted drift NOT approved (it still reports as drift; resolve with cdkrd revert, cdkrd ignore, or cdk deploy).
commit the baseline file(s) so drift is detected against them going forward.

=== check: CdkrdVerificationStack (ap-northeast-1) ===
[CFn-Declared Drift: 1] (declared in your CloudFormation template — the live value differs)
  Handler.MemorySize (AWS::Lambda::Function)
      desired=1024
      actual =512

[Added Resource: 1] (a WHOLE live resource not in your CloudFormation template (the resource-level counterpart of CFn-Undeclared) — created out of band under a declared parent, changed from your .cdkrd baseline (an unrecorded one is Potential Drift, not confirmed drift))
  Handler ▸ NONE arn:aws:lambda:ap-northeast-1:123456789012:function:CdkrdVerificationStack-Handler886CB40B-XXXXX (AWS::Lambda::Url) — created out of band — not in your CloudFormation template; changed since record
      ~ InvokeMode
          baseline="BUFFERED"
          actual  ="RESPONSE_STREAM"

───────────────────────────────────────
result: 2 drift(s) (declared=1 added=1)
───────────────────────────────────────
info:
  - atDefault=22
  - generated=2
  - skipped=1 (custom resource 1)
note: drift found — exit 0 (report-only). Pass --fail to make drift fail this command.

=== revert: CdkrdVerificationStack (ap-northeast-1) ===

  Handler (AWS::Lambda::Function)
    - MemorySize -> deployed-template value

  NOT revertable: 1 (recorded added resource changed since record — reverting DELETES the whole resource; re-record if the change is right, or --remove-unrecorded to delete it)
  reverted: Handler

verifying convergence (re-reading 1 resource(s))...
CdkrdVerificationStack: 1 drift(s) remain.
  - Handler ▸ NONE arn:aws:lambda:ap-northeast-1:123456789012:function:CdkrdVerificationStack-Handler886CB40B-XXXXX (added)

=== revert: CdkrdVerificationStack (ap-northeast-1) ===

  Handler ▸ NONE arn:aws:lambda:ap-northeast-1:123456789012:function:CdkrdVerificationStack-Handler886CB40B-XXXXX (AWS::Lambda::Url)
    - DELETE out-of-band AWS::Lambda::Url (not in your template)
  reverted: Handler ▸ NONE arn:aws:lambda:ap-northeast-1:123456789012:function:CdkrdVerificationStack-Handler886CB40B-XXXXX

verifying convergence (re-reading 1 resource(s))...
CdkrdVerificationStack: 1 drift(s) remain.
  - Handler886CB40B/arn:aws:lambda:ap-northeast-1:123456789012:function:CdkrdVerificationStack-Handler886CB40B-XXXXX (deleted)

baseline written: .cdkrd/baselines/CdkrdVerificationStack.123456789012.ap-northeast-1.json (2 recorded entry(ies))

=== check: CdkrdVerificationStack (ap-northeast-1) ===
result: CLEAN
info:
  - atDefault=22
  - generated=2
  - skipped=1 (custom resource 1)

=== check: CdkrdVerificationStack (ap-northeast-1) ===
[CFn-Declared Drift: 1] (declared in your CloudFormation template — the live value differs)
  Handler.MemorySize (AWS::Lambda::Function)
      desired=1024
      actual =2048

───────────────────────────────
result: 1 drift(s) (declared=1)
───────────────────────────────

# cdkrd ignore rules — properties cdkrd should stop reporting as drift.
# Each rule: { path, stack?, account?, region? }; `path` is a
# "<constructPath|logicalId>.<property>" glob, the scopes narrow WHERE it applies.
# Add a comment above a rule to record WHY it is ignored.
ignore:
  # インシデント対応のホットフィックス。CDKコードへの反映は次スプリントで対応予定
  - path: Handler.MemorySize
    stack: CdkrdVerificationStack
    account: "123456789012"
    region: ap-northeast-1

=== check: CdkrdVerificationStack (ap-northeast-1) ===
result: CLEAN
info:
  - atDefault=22
  - generated=2
  - ignored=1 ("Handler.MemorySize (stack:CdkrdVerificationStack, account:123456789012, region:ap-northeast-1)" 1)
  - skipped=1 (custom resource 1)

(--pre-deploy) comparing live state against the LOCAL synth template
note: CdkrdVerificationStack: --pre-deploy reports declared drift only (undeclared tiers are evaluated against the deployed template — run check without --pre-deploy)
=== check: CdkrdVerificationStack (ap-northeast-1) ===
[CFn-Declared Drift: 1] (declared in your CloudFormation template — the live value differs)
  Handler.MemorySize (AWS::Lambda::Function)
      desired=1024
      actual =2048

───────────────────────────────
result: 1 drift(s) (declared=1)
───────────────────────────────
info: skipped=1 — NOT checked (coverage incomplete: custom resource 1)
note: drift found — exit 0 (report-only). Pass --fail to make drift fail this command.