CDK Drift Detected Even Without Any Manual Changes — Showing Null Values for Tags and IdentitySource

Question

Hi everyone,

I’m using the AWS CDK and recently ran into a confusing situation with the cdk drift command.

When I execute cdk drift, it reports resource drift even though I haven’t made any manual changes in the AWS Console or outside of CDK. Here’s an example of the output I’m getting:

```
[~] AWS::ApiGateway::Authorizer TestAuthorizer TestAuthorizer8768BUA77
 └─ [~] /IdentitySource
     ├─ [-] 
     └─ [+] null
1 resources have drifted from their expected configuration

Stack TestInfraStack
Modified Resources
[~] AWS::CloudFront::Distribution Distribution Distribution8768BUA77
 └─ [~] /Tags
     ├─ [-] [{"Key":"application","Value":"test"},{"Key":"createdBy","Value":"me"},{"Key":"drift","Value":"Testing"},{"Key":"environment","Value":"Development"}]
     └─ [+] null
1 resource has drifted from their expected configuration
```

What’s strange is that:

* I haven’t modified anything manually in CloudFormation or AWS Console.
* The drift shows Tags and IdentitySource being replaced with null.
* My stack code and deployment configuration haven’t changed.

Could this be a bug or a known issue with cdk drift or CloudFormation drift detection for specific resources (like AWS::ApiGateway::Authorizer or AWS::CloudFront::Distribution)?
Also, is there any known workaround or configuration to avoid false-positive drift detections?

Here's the exat ScreenShot of output of cdk drift command

![Enter image description here](/media/postImages/original/IMYI9r3IY_RzWWDuXdKXA-xw)

And this is the ScreenShot of AWS Console — CloudFormation Stack Drift Results

![Enter image description here](/media/postImages/original/IMlKdob1wdTVuTyTKbClaLFQ)

re:Post Agent · Answer

This appears to be a known issue with CloudFormation drift detection rather than an actual drift in your resources.

When CloudFormation performs drift detection, it sometimes reports false positives for certain resource properties, particularly when comparing null values or empty collections. In your case, the drift detection is showing Tags and IdentitySource being replaced with null values, even though the actual resources likely still have their proper configuration.

For AWS::ApiGateway::Authorizer and AWS::CloudFront::Distribution resources specifically, there are known issues with how CloudFormation interprets certain properties during drift detection. The CloudFormation service might be interpreting the absence of a value differently than how the CDK defined it.

To work around this issue, you could:

1. Verify in the AWS Console that your resources actually have the expected configuration (tags, identity sources, etc.)

2. If using the CDK's CloudFormationStackDriftDetectionCheck for automated drift detection, be aware that these false positives might trigger compliance failures

3. Consider explicitly setting values for properties that tend to show up as drifted, even if they would normally be optional

4. For critical infrastructure, you might want to implement additional validation beyond CloudFormation drift detection

This is not an issue with your CDK code or deployment process, but rather with how CloudFormation's drift detection mechanism interprets certain resource properties.  
**Sources**  
[aws-cdk-lib.aws_config module · AWS CDK](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_config-readme.html)  
[CDK Version Upgrade Causing DynamoDB Table Replacement and Unreferenced Historical Data | AWS re:Post](https://repost.aws/questions/QUiAFiK3xLTbqTBZo5IwjqAw/cdk-version-upgrade-causing-dynamodb-table-replacement-and-unreferenced-historical-data)  
[Reset the landing zone to resolve drift - AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/userguide/lz-api-reset.html)

CDK Drift Detected Even Without Any Manual Changes — Showing Null Values for Tags and IdentitySource

Add your answer

Relevant content