Aws Stackset Audit

Read-only operational audit of a CloudFormation StackSet and all of its stack instances across accounts and regions. A single audit method fans out in one locked execution — DescribeStackSet, paginated ListStackInstances, recent ListStackSetOperations — and writes one summary resource plus one instance resource per stack instance.

The summary carries the stackset config, a drift-detection rollup, per-dimension counts (detailed/overall status, region, drift status, failure category), recent operations, a ranked rootCauses grouping, detected cross-instance anti-patterns, and a derived safeToReapply verdict. Each instance carries account, region, detailed and overall status, status reason, drift status, stack id, OU id, and a normalized failureCategory.

Read-only: only Describe* / List* are ever called, so the audit runs under a *-readonly profile. It reports each instance's existing drift status as the StackSet API returns it; triggering fresh drift detection is a separate, mutating sibling extension. Compose them in a swamp workflow (drift-detect step first, then this audit step with dependsOn: succeeded).