After AZ or Region recovery drills, rebuilt municipal environments sometimes drift from the known-good baseline. How should automation protect infrastructure integrity?

Using AWS CloudFormation (and AWS Systems Manager where appropriate) so rebuilt stacks match templates and drift can be detected or corrected protects infrastructure integrity after AZ or Region recovery drills. The approach works because municipal environments rebuilt by memory diverge—security groups, AMI IDs, IAM paths, and subnet routes silently change until the next incident. CloudFormation (or equivalent IaC) encodes desired state; stack drift detection highlights unmanaged changes; Systems Manager can enforce instance-level configuration, patch baselines, or runbooks that keep hosts aligned after launch. Automation turns “we think the spare Region matches” into a verifiable claim.

Rebuilding exclusively by click-ops in the console with undocumented tribal knowledge fails by concept because human console paths are not repeatable under stress and produce undetectable drift. Forbidding Infrastructure as Code so operators can improvise every restore differently fails because improvisation maximizes variance precisely when auditors and on-call need sameness. Storing the only network diagram as a whiteboard photo with no machine-readable template fails because pictures are not deployable desired state and cannot drive drift detection.

Exam caveat: IaC only helps if templates are the real source of truth—out-of-band console edits without reconciliation recreate the drift problem. Operational check: after each recovery drill, run drift detection on core stacks, remediate unauthorized changes, store templates in version control, and use Systems Manager inventory/state manager to confirm instance configuration matches the municipal baseline.