cdk diff does not diff from console changes

Question

1. I have a stack which creates IAM policies Its deployed successfully I then change a policy by removing few statements Then invoke cdk diff, which does not detect the drift

Is this expected?

Answer 1

Indeed, cdk diff will only compare the specified stack with the local template file (created by the previous cdk deploy).

Thus, if you made some changes in the AWS Console, the AWS CDK will not detect the drift.

Since version 1.17.0, you can now do the following to detect and show drifted changes:

cdk deploy --no-execute

From the PR description:

You will be able to see the ChangeSet in AWS CloudFormation Console, validate the resources and discard or execute the ChangeSet.