Drift detection on a university StackSet shows that one account's stack instance has drifted. Every other stack instance still matches the template. Rebuilding every account was proposed. What should be fixed?
Select an answer to reveal the explanation.
Short Explanation
You don’t need to rebuild every account because one stack instance has drifted. Repair only that instance and leave the accounts that still match the template untouched.
Full Explanation
StackSet drift is reported per stack instance, so repair only the drifted instance by updating or redeploying it from the StackSet; leave instances that still match the template untouched. The StackSet administration role is shared by accounts for StackSet operations, but replacing that role does not undo a resource change inside one account. Deleting and recreating the whole StackSet would rebuild every account to correct drift in just one instance. Changing template parameters in accounts whose stacks already match would alter healthy stacks and could create new drift. One caveat: an update can reconcile properties managed by the template and remove a manual hotfix, so incorporate any still-needed hotfix into the template before repairing the instance. After the repair, rerun drift detection on that instance and confirm it matches while the other instances remain untouched. Drift detection only reports differences; it does not change resources, so a detect-only pass is not the repair.