CloudFormation Resource Spec Drift Monitor

Private Big One-style Apify Actor that monitors official AWS CloudFormation resource specification JSON for IaC schema drift.

It is built for platform, DevOps, SRE, and cloud-governance teams who need to know when AWS changes the typed CloudFormation definition for resources they use: new or removed properties, newly required properties, update-behavior changes, and replacement-risk changes.

This Actor is unofficial and is not affiliated with Amazon Web Services. It only reads public AWS documentation/specification endpoints. It does not log in to AWS, inspect customer stacks, or call account-specific AWS APIs.

What it checks

AWS documents the CloudFormation resource specification as a JSON-formatted, strongly typed file that defines the resources and properties CloudFormation supports. AWS also documents the ResourceSpecificationVersion, ResourceTypes, and PropertyTypes sections, plus property Required and UpdateType metadata. UpdateType is important because immutable properties can require resource replacement, while conditional properties can be mutable or immutable depending on other changes.

This Actor fetches official regional specification files and emits one dataset row per selected region/resource type.

Each row includes:

• region and CloudFormation resource type
• current ResourceSpecificationVersion
• property, required-property, immutable-property, conditional-property, and attribute counts
• canonical resource spec hash
• added/removed properties compared with a previous run
• newly required and newly immutable properties
• update-type changes such as Mutable -> Immutable
• alert reasons and recommended priority
• source URL and AWS documentation URL

Repeat-use loop

Run it on a schedule and feed a previous run dataset or inline baseline rows into the next run. First run establishes a baseline. Later runs detect spec drift and produce alerts for changes that can affect IaC generators, validators, internal guardrails, and change-risk reviews.

Input

• regions: supported AWS regions to check. Defaults to us-east-1, us-west-2, and eu-west-1.
• watchedResourceTypes: exact resource types such as AWS::Lambda::Function, AWS::S3::Bucket, or AWS::RDS::DBInstance.
• resourceTypePatterns: optional wildcard patterns such as AWS::Lambda::*.
• criticalResourceTypes: resource types where missing resources or high-risk changes get higher priority.
• baselineDataset: previous run dataset selected through Apify's resource picker for limited-permission access.
• baselineRows: inline previous rows for API-driven scheduled runs.

The Actor intentionally does not fetch arbitrary user-provided URLs. It uses an internal allowlisted map of official AWS CloudFormation resource-specification endpoints for supported regions.

Output

The default dataset contains deterministic rows suitable for regression dashboards or scheduled monitors. The default key-value store contains an OUTPUT summary with counts, versions, source URLs, and a compact snapshot that can be passed back as baselineRows.

Pricing

from $2.00 / 1,000 CloudFormation resource specification rows

This Actor uses Apify Pay per Event pricing with platform usage included. The row event is charged only for useful rows written to the default dataset.

Event	Price	Unit
Actor start (apify-actor-start)	$0.00005	Once when the run starts.
CloudFormation resource spec row (apify-default-dataset-item)	$0.002	Per CloudFormation resource specification row.

A row is one CloudFormation resource type/specification drift row. Apify plan discounts, user-configured max-charge limits, and any future Apify pricing UI changes may affect final charges.

Limitations

• This monitors AWS's public CloudFormation resource specification, not live customer AWS accounts or stack drift.
• Region support is limited to the allowlisted public AWS specification endpoints embedded in this build.
• A changed spec hash means AWS's machine-readable resource definition changed; users should verify the linked AWS documentation before taking production action.
• First runs without a baseline are not considered drift alerts unless a watched resource is missing or the source fetch fails.

Related Actors in this portfolio

This Actor is part of the Cloud platform drift monitors group. These are narrow, source-specific Apify Actors intended for scheduled checks and repeatable dataset exports — not broad scraped-content feeds.

• FedRAMP Marketplace Authorization Monitor — FedRAMP Marketplace authorization/status monitoring for vendor-risk workflows.
• AWS IAM Service Authorization Drift Monitor — AWS IAM Service Authorization Reference drift checks for cloud-security reviews.
• CloudFormation Resource Spec Drift Monitor — CloudFormation resource-spec drift checks for replacement-risk and required-property changes.

Each listing includes its own source notes, limits, pricing, and responsible-use caveats. Use the official source links in each Actor when decisions require verification.