Skip to main content
← back to extensions

Aws/drift State

@webframp/aws/drift-statev2026.06.29.2· 8d agoMODELSWORKFLOWS
01README

Unified drift detection surface that composes observations from existing models (adopt, inventory, terraform, config, dns) into queryable versioned state.

This higher-order model makes zero AWS API calls. It reads upstream model data via the swamp data repository and produces typed drift state: baselines, drift results, timelines, and velocity metrics.

Quick Start

# Pull the extension
swamp extension pull @webframp/aws/drift-state

# Create the drift-state model (after upstream models exist)
swamp model create @webframp/aws/drift-state drift-state

# Set baselines from current upstream data
swamp model method run drift-state set_baseline

# Later: compute drift against baselines
swamp model method run drift-state compute_drift

# Query drifted resources
swamp model method run drift-state get_drifted

# View drift timeline for a resource
swamp model method run drift-state get_drift_timeline \
  --input '{"canonicalId": "arn:aws:ec2:us-east-1:123456:vpc/vpc-abc"}'

# Run the full refresh workflow (syncs upstream + recomputes)
swamp workflow run @webframp/drift-state-refresh

Methods

  • compute_drift — Compare latest upstream snapshots against baselines
  • set_baseline — Mark current upstream state as expected
  • get_drifted — Query resources currently in drifted state
  • get_drift_timeline — History of drift events for a resource
  • get_drift_velocity — Aggregate drift rate metrics
  • refresh — Recompute drift from current upstream data

Upstream Sources

  • @webframp/aws/adopt (required) — VPCs, subnets, gateways, route tables, security groups, RDS
  • @webframp/aws/inventory (required) — EC2, RDS, DynamoDB, Lambda, S3, EBS
  • @webframp/terraform (optional) — All Terraform-managed resources. If not installed, terraform is reported in unavailableSources and skipped gracefully.
  • @webframp/aws/config-compliance (optional) — AWS Config non-compliant resources. If not installed, config is reported in unavailableSources.
  • @webframp/aws/dns-observation (optional) — Orphaned DNS records pointing at decommissioned infrastructure. If not installed, dns is reported in unavailableSources.
  • @webframp/aws/event-topology (optional) — Event graph topology (EventBridge, SNS, SQS, Lambda ESM). If not installed, event_topology is reported in unavailableSources.
02Models1
@webframp/aws/drift-statev2026.06.29.2aws/drift_state.ts
fn compute_drift(sources?: array, adoptModelName?: string, inventoryModelName?: string, terraformModelName?: string, configModelName?: string, dnsModelName?: string, topologyModelName?: string, staleThresholdMinutes?: number)
Compare latest upstream snapshots against stored baselines to detect drift across adopt, inventory, terraform, config, dns, and event_topology sources.
ArgumentTypeDescription
sources?arrayUpstream sources to compose. Omit for all available.
adoptModelName?stringName of the @webframp/aws/adopt model instance
inventoryModelName?stringName of the @webframp/aws/inventory model instance
terraformModelName?stringName of the @webframp/terraform model instance
configModelName?stringName of the @webframp/aws/config-compliance model instance
dnsModelName?stringName of the @webframp/aws/dns-observation model instance
topologyModelName?stringName of the @webframp/aws/event-topology model instance
staleThresholdMinutes?numberData older than this (minutes) is flagged as stale
fn set_baseline(source: enum, adoptModelName?: string, inventoryModelName?: string, terraformModelName?: string, configModelName?: string, dnsModelName?: string, topologyModelName?: string)
Set baseline from current upstream data. Future compute_drift runs compare against this baseline.
ArgumentTypeDescription
sourceenumWhich upstream source to baseline
adoptModelName?stringName of the @webframp/aws/adopt model instance
inventoryModelName?stringName of the @webframp/aws/inventory model instance
terraformModelName?stringName of the @webframp/terraform model instance
configModelName?stringName of the @webframp/aws/config-compliance model instance
dnsModelName?stringName of the @webframp/aws/dns-observation model instance
topologyModelName?stringName of the @webframp/aws/event-topology model instance
fn get_drifted(resourceType?: string, source?: string)
Query resources currently in drifted state from the latest drift computation.
ArgumentTypeDescription
resourceType?stringFilter by AWS resource type (e.g., AWS::EC2::VPC)
source?stringFilter by detection source (adopt, inventory, terraform)
fn get_drift_timeline(canonicalId: string, limit?: number)
View the drift status change history for a resource.
ArgumentTypeDescription
canonicalIdstringCanonical resource ID (ARN or composite key)
limit?numberMaximum events to return
fn get_drift_velocity()
Compute aggregate drift rate metrics by resource type and time window.
fn refresh(adoptModelName?: string, inventoryModelName?: string, terraformModelName?: string, configModelName?: string, dnsModelName?: string, topologyModelName?: string)
Recompute drift from current upstream data. For full upstream refresh (re-run discover/scan), use the drift-state-refresh workflow.
ArgumentTypeDescription
adoptModelName?stringName of the @webframp/aws/adopt model instance
inventoryModelName?stringName of the @webframp/aws/inventory model instance
terraformModelName?stringName of the @webframp/terraform model instance
configModelName?stringName of the @webframp/aws/config-compliance model instance
dnsModelName?stringName of the @webframp/aws/dns-observation model instance
topologyModelName?stringName of the @webframp/aws/event-topology model instance

Resources

driftResult(6h)— Computed drift state across all sources
baseline(30d)— Baseline snapshots per upstream source
timeline(90d)— Drift status change history per resource
drifted(1h)— Filtered view of currently drifted resources
velocity(1h)— Drift rate metrics
03Workflows1
@webframp/drift-state-refreshwf-drift-state-refresh-01

Refresh upstream models and recompute drift state. Runs discover_all (adopt), inventory_scan (inventory), get_non_compliant (config), detect_orphans (dns), and discover (event-topology) in parallel, then computes drift against stored baselines.

refresh-adoptRefresh adopt model discovery data
1.discover${{ inputs.adoptModelName }}.discover_all
refresh-inventoryRefresh inventory scan data
1.scan${{ inputs.inventoryModelName }}.inventory_scan
refresh-configRefresh Config compliance evaluations
1.get-non-compliant${{ inputs.configModelName }}.get_non_compliant
refresh-dnsRefresh DNS orphan detection
1.detect-orphans${{ inputs.dnsModelName }}.detect_orphans
refresh-topologyRefresh event topology graph
1.discover${{ inputs.topologyModelName }}.discover
computeRecompute drift from refreshed upstream data
1.compute-drift${{ inputs.driftModelName }}.compute_drift
04Previous Versions5
2026.06.29.1Jun 29, 2026
2026.06.28.1Jun 28, 2026

2026.06.27.3

Added: @webframp/aws/dns-observation as 5th upstream source. Orphaned DNS records (pointing at decommissioned ELBs, CloudFront distributions, S3 buckets, or stale IPs) now surface as drifted resources with detectionSource: "dns".

  • normalizeDnsResources maps orphan records to NormalizedResource
  • dnsModelName argument added to compute_drift, set_baseline, refresh
  • drift-state-refresh workflow gains parallel refresh-dns job

2026.06.27.2

Added: @webframp/aws/config-compliance as 4th upstream source. AWS Config non-compliant resources now appear as drifted with detectionSource: "config".

  • Refactored normalizer dispatch into SOURCES/NORMALIZERS registry pattern
  • configModelName argument added to all methods

2026.06.27.1

Added: Initial release of @webframp/aws/drift-state — unified drift detection model that composes observations from adopt, inventory, and terraform models into queryable versioned state.

Methods: compute_drift, set_baseline, get_drifted, get_drift_timeline, get_drift_velocity, refresh.

Includes companion workflow @webframp/drift-state-refresh for automated upstream sync + drift computation.

Modified 1 workflows. updated labels

2026.06.27.3Jun 28, 2026

2026.06.27.3

Added: @webframp/aws/dns-observation as 5th upstream source. Orphaned DNS records (pointing at decommissioned ELBs, CloudFront distributions, S3 buckets, or stale IPs) now surface as drifted resources with detectionSource: "dns".

  • normalizeDnsResources maps orphan records to NormalizedResource
  • dnsModelName argument added to compute_drift, set_baseline, refresh
  • drift-state-refresh workflow gains parallel refresh-dns job

2026.06.27.2

Added: @webframp/aws/config-compliance as 4th upstream source. AWS Config non-compliant resources now appear as drifted with detectionSource: "config".

  • Refactored normalizer dispatch into SOURCES/NORMALIZERS registry pattern
  • configModelName argument added to all methods

2026.06.27.1

Added: Initial release of @webframp/aws/drift-state — unified drift detection model that composes observations from adopt, inventory, and terraform models into queryable versioned state.

Methods: compute_drift, set_baseline, get_drifted, get_drift_timeline, get_drift_velocity, refresh.

Includes companion workflow @webframp/drift-state-refresh for automated upstream sync + drift computation.

Modified 1 workflows. updated labels

2026.06.27.2Jun 27, 2026

2026.06.27.1

Added: Initial release of @webframp/aws/drift-state — unified drift detection model that composes observations from adopt, inventory, and terraform models into queryable versioned state.

Methods: compute_drift, set_baseline, get_drifted, get_drift_timeline, get_drift_velocity, refresh.

Includes companion workflow @webframp/drift-state-refresh for automated upstream sync + drift computation.

Modified 1 workflows

2026.06.27.1Jun 27, 2026

2026.06.27.1

Added: Initial release of @webframp/aws/drift-state — unified drift detection model that composes observations from adopt, inventory, and terraform models into queryable versioned state.

Methods: compute_drift, set_baseline, get_drifted, get_drift_timeline, get_drift_velocity, refresh.

Includes companion workflow @webframp/drift-state-refresh for automated upstream sync + drift computation.

05Stats
A
100 / 100
Downloads
0
Archive size
18.6 KB
  • Has README or module doc2/2earned
  • README has a code example1/1earned
  • README is substantive1/1earned
  • Most symbols documented1/1earned
  • No slow types (deprecated)1/1earned
  • Dependencies pass trust audit2/2earned
  • Has description1/1earned
  • Platform support declared (or universal)2/2earned
  • License declared1/1earned
  • Verified public repository2/2earned
Repository
https://github.com/webframp/swamp-extensions
06Platforms
07Labels
#aws#drift#compliance#convergence#observability#dns#topology