# CloudFormation Resource Spec Drift Monitor (`defenestrator/cloudformation-resource-spec-drift-monitor`) Actor Monitor AWS CloudFormation resource specification JSON for resource/property drift, required-property changes, and replacement-risk updates. - **URL**: https://apify.com/defenestrator/cloudformation-resource-spec-drift-monitor.md - **Developed by:** [Defenestrator](https://apify.com/defenestrator) (community) - **Categories:** Developer tools, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $2.00 / 1,000 cloudformation resource spec rows This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## CloudFormation Resource Spec Drift Monitor Private Big One-style Apify Actor that monitors official AWS CloudFormation resource specification JSON for IaC schema drift. It is built for platform, DevOps, SRE, and cloud-governance teams who need to know when AWS changes the typed CloudFormation definition for resources they use: new or removed properties, newly required properties, update-behavior changes, and replacement-risk changes. This Actor is unofficial and is not affiliated with Amazon Web Services. It only reads public AWS documentation/specification endpoints. It does not log in to AWS, inspect customer stacks, or call account-specific AWS APIs. ### What it checks AWS documents the CloudFormation resource specification as a JSON-formatted, strongly typed file that defines the resources and properties CloudFormation supports. AWS also documents the `ResourceSpecificationVersion`, `ResourceTypes`, and `PropertyTypes` sections, plus property `Required` and `UpdateType` metadata. `UpdateType` is important because immutable properties can require resource replacement, while conditional properties can be mutable or immutable depending on other changes. This Actor fetches official regional specification files and emits one dataset row per selected region/resource type. Each row includes: - region and CloudFormation resource type - current `ResourceSpecificationVersion` - property, required-property, immutable-property, conditional-property, and attribute counts - canonical resource spec hash - added/removed properties compared with a previous run - newly required and newly immutable properties - update-type changes such as `Mutable -> Immutable` - alert reasons and recommended priority - source URL and AWS documentation URL ### Repeat-use loop Run it on a schedule and feed a previous run dataset or inline baseline rows into the next run. First run establishes a baseline. Later runs detect spec drift and produce alerts for changes that can affect IaC generators, validators, internal guardrails, and change-risk reviews. ### Input - `regions`: supported AWS regions to check. Defaults to `us-east-1`, `us-west-2`, and `eu-west-1`. - `watchedResourceTypes`: exact resource types such as `AWS::Lambda::Function`, `AWS::S3::Bucket`, or `AWS::RDS::DBInstance`. - `resourceTypePatterns`: optional wildcard patterns such as `AWS::Lambda::*`. - `criticalResourceTypes`: resource types where missing resources or high-risk changes get higher priority. - `baselineDataset`: previous run dataset selected through Apify's resource picker for limited-permission access. - `baselineRows`: inline previous rows for API-driven scheduled runs. The Actor intentionally does not fetch arbitrary user-provided URLs. It uses an internal allowlisted map of official AWS CloudFormation resource-specification endpoints for supported regions. ### Output The default dataset contains deterministic rows suitable for regression dashboards or scheduled monitors. The default key-value store contains an `OUTPUT` summary with counts, versions, source URLs, and a compact snapshot that can be passed back as `baselineRows`. ### Pricing from $2.00 / 1,000 CloudFormation resource specification rows This Actor uses Apify Pay per Event pricing with platform usage included. The row event is charged only for useful rows written to the default dataset. | Event | Price | Unit | |---|---:|---| | Actor start (`apify-actor-start`) | `$0.00005` | Once when the run starts. | | CloudFormation resource spec row (`apify-default-dataset-item`) | `$0.002` | Per CloudFormation resource specification row. | A row is one CloudFormation resource type/specification drift row. Apify plan discounts, user-configured max-charge limits, and any future Apify pricing UI changes may affect final charges. ### Limitations - This monitors AWS's public CloudFormation resource specification, not live customer AWS accounts or stack drift. - Region support is limited to the allowlisted public AWS specification endpoints embedded in this build. - A changed spec hash means AWS's machine-readable resource definition changed; users should verify the linked AWS documentation before taking production action. - First runs without a baseline are not considered drift alerts unless a watched resource is missing or the source fetch fails. ### Related Actors in this portfolio This Actor is part of the **Cloud platform drift monitors** group. These are narrow, source-specific Apify Actors intended for scheduled checks and repeatable dataset exports — not broad scraped-content feeds. - [FedRAMP Marketplace Authorization Monitor](https://apify.com/defenestrator/fedramp-marketplace-authorization-monitor) — FedRAMP Marketplace authorization/status monitoring for vendor-risk workflows. - [AWS IAM Service Authorization Drift Monitor](https://apify.com/defenestrator/aws-iam-service-authorization-drift-monitor) — AWS IAM Service Authorization Reference drift checks for cloud-security reviews. - [CloudFormation Resource Spec Drift Monitor](https://apify.com/defenestrator/cloudformation-resource-spec-drift-monitor) — CloudFormation resource-spec drift checks for replacement-risk and required-property changes. Each listing includes its own source notes, limits, pricing, and responsible-use caveats. Use the official source links in each Actor when decisions require verification. # Actor input Schema ## `regions` (type: `array`): AWS regions whose official CloudFormation resource specification files should be checked. Unsupported regions produce clear error rows instead of fetching arbitrary URLs. ## `watchedResourceTypes` (type: `array`): Exact CloudFormation resource type names to inspect, such as AWS::Lambda::Function or AWS::S3::Bucket. Leave empty only if resourceTypePatterns are provided. ## `resourceTypePatterns` (type: `array`): Optional wildcard patterns for resource types, for example AWS::Lambda::* or AWS::ECS::*. Matching resources are checked in addition to exact watchedResourceTypes. ## `criticalResourceTypes` (type: `array`): Resource types where source errors, missing resources, required-property changes, or replacement-risk changes should be promoted to high priority. ## `baselineDataset` (type: `string`): Optional previous run dataset for drift comparison. Use the picker so this limited-permission Actor receives READ access to the selected private dataset. ## `baselineDatasetId` (type: `string`): Advanced/API fallback for a previous dataset ID. Prefer the picker under limited permissions. ## `baselineRows` (type: `array`): Optional rows copied from a previous run. Rows with rowKey, region, resourceType, resourceSpecHash, propertyNames, requiredProperties, immutableProperties, conditionalProperties, and updateTypeMap are used for drift comparison. ## `maxBaselineRows` (type: `integer`): Maximum rows to read from the selected baseline dataset. ## `includeUnchangedRows` (type: `boolean`): If false, only alert, changed, or error rows are pushed to the dataset. OUTPUT.snapshot still includes every checked resource row. ## `alertOnSpecHashDrift` (type: `boolean`): If true, a changed canonical resource specification fingerprint compared with baseline creates an alert. ## `alertOnRequiredPropertyChanges` (type: `boolean`): If true, newly required or no-longer-required properties compared with baseline create alerts. ## `alertOnReplacementRiskChanges` (type: `boolean`): If true, newly Immutable or Conditional properties compared with baseline create alerts because CloudFormation updates may replace resources or depend on other changed properties. ## `expectedSpecVersion` (type: `string`): Optional exact ResourceSpecificationVersion expected across fetched regions. A mismatch creates a warning row. ## `maxResourceRows` (type: `integer`): Maximum region/resource rows to emit after exact and wildcard selection. ## `maxBytesPerSpec` (type: `integer`): Maximum CloudFormation specification response size after HTTP decoding. ## `requestTimeoutSecs` (type: `integer`): Timeout for each official public AWS CloudFormation resource specification request. ## Actor input object example ```json { "regions": [ "us-east-1", "us-west-2", "eu-west-1" ], "watchedResourceTypes": [ "AWS::Lambda::Function", "AWS::S3::Bucket", "AWS::ECS::Service", "AWS::DynamoDB::Table", "AWS::RDS::DBInstance" ], "resourceTypePatterns": [], "criticalResourceTypes": [ "AWS::Lambda::Function", "AWS::RDS::DBInstance", "AWS::DynamoDB::Table", "AWS::ECS::Service" ], "baselineRows": [], "maxBaselineRows": 5000, "includeUnchangedRows": true, "alertOnSpecHashDrift": true, "alertOnRequiredPropertyChanges": true, "alertOnReplacementRiskChanges": true, "maxResourceRows": 200, "maxBytesPerSpec": 25000000, "requestTimeoutSecs": 30 } ```` # Actor output Schema ## `datasetItems` (type: `string`): No description ## `summary` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "regions": [ "us-east-1", "us-west-2", "eu-west-1" ], "watchedResourceTypes": [ "AWS::Lambda::Function", "AWS::S3::Bucket", "AWS::ECS::Service", "AWS::DynamoDB::Table", "AWS::RDS::DBInstance" ] }; // Run the Actor and wait for it to finish const run = await client.actor("defenestrator/cloudformation-resource-spec-drift-monitor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "regions": [ "us-east-1", "us-west-2", "eu-west-1", ], "watchedResourceTypes": [ "AWS::Lambda::Function", "AWS::S3::Bucket", "AWS::ECS::Service", "AWS::DynamoDB::Table", "AWS::RDS::DBInstance", ], } # Run the Actor and wait for it to finish run = client.actor("defenestrator/cloudformation-resource-spec-drift-monitor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "regions": [ "us-east-1", "us-west-2", "eu-west-1" ], "watchedResourceTypes": [ "AWS::Lambda::Function", "AWS::S3::Bucket", "AWS::ECS::Service", "AWS::DynamoDB::Table", "AWS::RDS::DBInstance" ] }' | apify call defenestrator/cloudformation-resource-spec-drift-monitor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=defenestrator/cloudformation-resource-spec-drift-monitor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "CloudFormation Resource Spec Drift Monitor", "description": "Monitor AWS CloudFormation resource specification JSON for resource/property drift, required-property changes, and replacement-risk updates.", "version": "0.0", "x-build-id": "mdLnYh5r738HDOd1z" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/defenestrator~cloudformation-resource-spec-drift-monitor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-defenestrator-cloudformation-resource-spec-drift-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/defenestrator~cloudformation-resource-spec-drift-monitor/runs": { "post": { "operationId": "runs-sync-defenestrator-cloudformation-resource-spec-drift-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/defenestrator~cloudformation-resource-spec-drift-monitor/run-sync": { "post": { "operationId": "run-sync-defenestrator-cloudformation-resource-spec-drift-monitor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "regions": { "title": "AWS regions", "type": "array", "description": "AWS regions whose official CloudFormation resource specification files should be checked. Unsupported regions produce clear error rows instead of fetching arbitrary URLs.", "items": { "type": "string" } }, "watchedResourceTypes": { "title": "Watched resource types", "type": "array", "description": "Exact CloudFormation resource type names to inspect, such as AWS::Lambda::Function or AWS::S3::Bucket. Leave empty only if resourceTypePatterns are provided.", "items": { "type": "string" } }, "resourceTypePatterns": { "title": "Resource type wildcard patterns", "type": "array", "description": "Optional wildcard patterns for resource types, for example AWS::Lambda::* or AWS::ECS::*. Matching resources are checked in addition to exact watchedResourceTypes.", "items": { "type": "string" }, "default": [] }, "criticalResourceTypes": { "title": "Critical resource types", "type": "array", "description": "Resource types where source errors, missing resources, required-property changes, or replacement-risk changes should be promoted to high priority.", "items": { "type": "string" }, "default": [ "AWS::Lambda::Function", "AWS::RDS::DBInstance", "AWS::DynamoDB::Table", "AWS::ECS::Service" ] }, "baselineDataset": { "title": "Previous run dataset", "type": "string", "description": "Optional previous run dataset for drift comparison. Use the picker so this limited-permission Actor receives READ access to the selected private dataset." }, "baselineDatasetId": { "title": "Previous dataset ID (advanced)", "type": "string", "description": "Advanced/API fallback for a previous dataset ID. Prefer the picker under limited permissions." }, "baselineRows": { "title": "Inline previous rows", "type": "array", "description": "Optional rows copied from a previous run. Rows with rowKey, region, resourceType, resourceSpecHash, propertyNames, requiredProperties, immutableProperties, conditionalProperties, and updateTypeMap are used for drift comparison.", "items": { "type": "object" }, "default": [] }, "maxBaselineRows": { "title": "Max baseline rows to read", "minimum": 1, "maximum": 20000, "type": "integer", "description": "Maximum rows to read from the selected baseline dataset.", "default": 5000 }, "includeUnchangedRows": { "title": "Include unchanged rows", "type": "boolean", "description": "If false, only alert, changed, or error rows are pushed to the dataset. OUTPUT.snapshot still includes every checked resource row.", "default": true }, "alertOnSpecHashDrift": { "title": "Alert on resource spec hash drift", "type": "boolean", "description": "If true, a changed canonical resource specification fingerprint compared with baseline creates an alert.", "default": true }, "alertOnRequiredPropertyChanges": { "title": "Alert on required-property changes", "type": "boolean", "description": "If true, newly required or no-longer-required properties compared with baseline create alerts.", "default": true }, "alertOnReplacementRiskChanges": { "title": "Alert on replacement-risk changes", "type": "boolean", "description": "If true, newly Immutable or Conditional properties compared with baseline create alerts because CloudFormation updates may replace resources or depend on other changed properties.", "default": true }, "expectedSpecVersion": { "title": "Expected CloudFormation spec version", "type": "string", "description": "Optional exact ResourceSpecificationVersion expected across fetched regions. A mismatch creates a warning row." }, "maxResourceRows": { "title": "Max resource rows", "minimum": 1, "maximum": 2000, "type": "integer", "description": "Maximum region/resource rows to emit after exact and wildcard selection.", "default": 200 }, "maxBytesPerSpec": { "title": "Max bytes per spec", "minimum": 1000000, "maximum": 80000000, "type": "integer", "description": "Maximum CloudFormation specification response size after HTTP decoding.", "default": 25000000 }, "requestTimeoutSecs": { "title": "Request timeout seconds", "minimum": 5, "maximum": 90, "type": "integer", "description": "Timeout for each official public AWS CloudFormation resource specification request.", "default": 30 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```