Aws/drift State
Unified drift detection surface that composes observations from existing models (adopt, inventory, terraform, config, dns) into queryable versioned state.
This higher-order model makes zero AWS API calls. It reads upstream model data via the swamp data repository and produces typed drift state: baselines, drift results, timelines, and velocity metrics.
Quick Start
# Pull the extension
swamp extension pull @webframp/aws/drift-state
# Create the drift-state model (after upstream models exist)
swamp model create @webframp/aws/drift-state drift-state
# Set baselines from current upstream data
swamp model method run drift-state set_baseline
# Later: compute drift against baselines
swamp model method run drift-state compute_drift
# Query drifted resources
swamp model method run drift-state get_drifted
# View drift timeline for a resource
swamp model method run drift-state get_drift_timeline \
--input '{"canonicalId": "arn:aws:ec2:us-east-1:123456:vpc/vpc-abc"}'
# Run the full refresh workflow (syncs upstream + recomputes)
swamp workflow run @webframp/drift-state-refreshMethods
- compute_drift — Compare latest upstream snapshots against baselines
- set_baseline — Mark current upstream state as expected
- get_drifted — Query resources currently in drifted state
- get_drift_timeline — History of drift events for a resource
- get_drift_velocity — Aggregate drift rate metrics
- refresh — Recompute drift from current upstream data
Upstream Sources
@webframp/aws/adopt(required) — VPCs, subnets, gateways, route tables, security groups, RDS@webframp/aws/inventory(required) — EC2, RDS, DynamoDB, Lambda, S3, EBS@webframp/terraform(optional) — All Terraform-managed resources. If not installed, terraform is reported inunavailableSourcesand skipped gracefully.@webframp/aws/config-compliance(optional) — AWS Config non-compliant resources. If not installed, config is reported inunavailableSources.@webframp/aws/dns-observation(optional) — Orphaned DNS records pointing at decommissioned infrastructure. If not installed, dns is reported inunavailableSources.@webframp/aws/event-topology(optional) — Event graph topology (EventBridge, SNS, SQS, Lambda ESM). If not installed, event_topology is reported inunavailableSources.
2026.09.25.1
Upgrade note: Updated the required @webframp/aws/adopt and
@webframp/aws/inventory dependencies to 2026.09.24.1. Pull all three
extensions together.
| Argument | Type | Description |
|---|---|---|
| sources? | array | Upstream sources to compose. Omit for all available. |
| adoptModelName? | string | Name of the @webframp/aws/adopt model instance |
| inventoryModelName? | string | Name of the @webframp/aws/inventory model instance |
| terraformModelName? | string | Name of the @webframp/terraform model instance |
| configModelName? | string | Name of the @webframp/aws/config-compliance model instance |
| dnsModelName? | string | Name of the @webframp/aws/dns-observation model instance |
| topologyModelName? | string | Name of the @webframp/aws/event-topology model instance |
| staleThresholdMinutes? | number | Data older than this (minutes) is flagged as stale |
| Argument | Type | Description |
|---|---|---|
| source | enum | Which upstream source to baseline |
| adoptModelName? | string | Name of the @webframp/aws/adopt model instance |
| inventoryModelName? | string | Name of the @webframp/aws/inventory model instance |
| terraformModelName? | string | Name of the @webframp/terraform model instance |
| configModelName? | string | Name of the @webframp/aws/config-compliance model instance |
| dnsModelName? | string | Name of the @webframp/aws/dns-observation model instance |
| topologyModelName? | string | Name of the @webframp/aws/event-topology model instance |
| Argument | Type | Description |
|---|---|---|
| resourceType? | string | Filter by AWS resource type (e.g., AWS::EC2::VPC) |
| source? | string | Filter by detection source (adopt, inventory, terraform) |
| Argument | Type | Description |
|---|---|---|
| canonicalId | string | Canonical resource ID (ARN or composite key) |
| limit? | number | Maximum events to return |
| Argument | Type | Description |
|---|---|---|
| adoptModelName? | string | Name of the @webframp/aws/adopt model instance |
| inventoryModelName? | string | Name of the @webframp/aws/inventory model instance |
| terraformModelName? | string | Name of the @webframp/terraform model instance |
| configModelName? | string | Name of the @webframp/aws/config-compliance model instance |
| dnsModelName? | string | Name of the @webframp/aws/dns-observation model instance |
| topologyModelName? | string | Name of the @webframp/aws/event-topology model instance |
Resources
Refresh upstream models and recompute drift state. Runs discover_all (adopt), inventory_scan (inventory), get_non_compliant (config), detect_orphans (dns), and discover (event-topology) in parallel, then computes drift against stored baselines.
2026.09.18.1
Upgrade note: Normalized npm:zod dependency version to 4.6.5 across the
repo. No behavioral changes in this extension.
updated dependencies
2026.09.17.2
Changed: Refreshed the @webframp/aws/adopt and @webframp/aws/inventory manifest pins to 2026.09.17.1. No code or behavioral changes.
2026.09.17.1
Changed: Bump @webframp/aws/adopt 2026.08.29.1 → 2026.09.15.1
Changed: Bump @webframp/aws/inventory 2026.08.29.1 → 2026.09.15.1
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.09.04.1
Changed: Bump @webframp/aws/adopt 2026.08.28.1 → 2026.08.29.1
Changed: Bump @webframp/aws/inventory 2026.08.28.1 → 2026.08.29.1
2026.08.28.3
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.2
Fixed: Re-pinned @webframp/aws/adopt and @webframp/aws/inventory to
2026.08.28.1 — the versions published in the prior sweep. The 2026.08.28.1
release of this composite still pinned the pre-sweep 2026.08.26.3 leaf versions
(SDK 3.1114.0), so its dependency graph did not deliver the AWS SDK 3.1120.0
bump it was bumped alongside. No schema or behavioral changes.
2026.08.28.1
Changed: Bump @webframp/aws/adopt 2026.08.20.1 → 2026.08.26.3
Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
updated dependencies
2026.09.17.1
Changed: Bump @webframp/aws/adopt 2026.08.29.1 → 2026.09.15.1
Changed: Bump @webframp/aws/inventory 2026.08.29.1 → 2026.09.15.1
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.09.04.1
Changed: Bump @webframp/aws/adopt 2026.08.28.1 → 2026.08.29.1
Changed: Bump @webframp/aws/inventory 2026.08.28.1 → 2026.08.29.1
2026.08.28.3
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.2
Fixed: Re-pinned @webframp/aws/adopt and @webframp/aws/inventory to
2026.08.28.1 — the versions published in the prior sweep. The 2026.08.28.1
release of this composite still pinned the pre-sweep 2026.08.26.3 leaf versions
(SDK 3.1114.0), so its dependency graph did not deliver the AWS SDK 3.1120.0
bump it was bumped alongside. No schema or behavioral changes.
2026.08.28.1
Changed: Bump @webframp/aws/adopt 2026.08.20.1 → 2026.08.26.3
Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
updated dependencies
2026.09.15.1
Changed: Bump zod 4.4.3 → 4.6.5
2026.09.04.1
Changed: Bump @webframp/aws/adopt 2026.08.28.1 → 2026.08.29.1
Changed: Bump @webframp/aws/inventory 2026.08.28.1 → 2026.08.29.1
2026.08.28.3
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.2
Fixed: Re-pinned @webframp/aws/adopt and @webframp/aws/inventory to
2026.08.28.1 — the versions published in the prior sweep. The 2026.08.28.1
release of this composite still pinned the pre-sweep 2026.08.26.3 leaf versions
(SDK 3.1114.0), so its dependency graph did not deliver the AWS SDK 3.1120.0
bump it was bumped alongside. No schema or behavioral changes.
2026.08.28.1
Changed: Bump @webframp/aws/adopt 2026.08.20.1 → 2026.08.26.3
Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.09.04.1
Changed: Bump @webframp/aws/adopt 2026.08.28.1 → 2026.08.29.1
Changed: Bump @webframp/aws/inventory 2026.08.28.1 → 2026.08.29.1
2026.08.28.3
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.2
Fixed: Re-pinned @webframp/aws/adopt and @webframp/aws/inventory to
2026.08.28.1 — the versions published in the prior sweep. The 2026.08.28.1
release of this composite still pinned the pre-sweep 2026.08.26.3 leaf versions
(SDK 3.1114.0), so its dependency graph did not deliver the AWS SDK 3.1120.0
bump it was bumped alongside. No schema or behavioral changes.
2026.08.28.1
Changed: Bump @webframp/aws/adopt 2026.08.20.1 → 2026.08.26.3
Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
updated dependencies
2026.08.28.3
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.2
Fixed: Re-pinned @webframp/aws/adopt and @webframp/aws/inventory to
2026.08.28.1 — the versions published in the prior sweep. The 2026.08.28.1
release of this composite still pinned the pre-sweep 2026.08.26.3 leaf versions
(SDK 3.1114.0), so its dependency graph did not deliver the AWS SDK 3.1120.0
bump it was bumped alongside. No schema or behavioral changes.
2026.08.28.1
Changed: Bump @webframp/aws/adopt 2026.08.20.1 → 2026.08.26.3
Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.2
Fixed: Re-pinned @webframp/aws/adopt and @webframp/aws/inventory to
2026.08.28.1 — the versions published in the prior sweep. The 2026.08.28.1
release of this composite still pinned the pre-sweep 2026.08.26.3 leaf versions
(SDK 3.1114.0), so its dependency graph did not deliver the AWS SDK 3.1120.0
bump it was bumped alongside. No schema or behavioral changes.
2026.08.28.1
Changed: Bump @webframp/aws/adopt 2026.08.20.1 → 2026.08.26.3
Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
updated dependencies
2026.08.28.1
Changed: Bump @webframp/aws/adopt 2026.08.20.1 → 2026.08.26.3
Changed: Bump @webframp/aws/inventory 2026.08.20.1 → 2026.08.26.3
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
updated dependencies
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.25.1
Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.
updated labels
2026.08.24.1
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.23.1
Changed: Documentation only — no code changes. Added a full
## Troubleshooting section (this README was the thinnest in the repo at 29
lines) plus guidance on the upstream-model-name mismatch failure mode.
2026.08.21.1
Changed: Previously-silent catch blocks around stored baseline, drift
result, and timeline reads (in compute_drift, get_drifted,
get_drift_timeline, and get_drift_velocity) now log a warning naming the
resource being read and the underlying error before falling back to the
same graceful "not available yet" behavior. Before, an unexpected read
failure (as opposed to a simple "not found") was swallowed with no
diagnostic at all.
Changed: compute_drift's sources argument, if provided, must now be a
non-empty array instead of silently accepting [] and producing an empty
drift result. get_drift_timeline's canonicalId must be a non-empty
string.
2026.08.20.1
Changed: Bump @webframp/aws/adopt 2026.08.05.1 → 2026.08.20.1
Changed: Bump @webframp/aws/inventory 2026.08.05.1 → 2026.08.20.1
2026.08.15.1
Changed: Bump @webframp/aws/adopt 2026.08.02.1 → 2026.08.05.1
Changed: Bump @webframp/aws/inventory 2026.08.02.1 → 2026.08.05.1
2026.08.05.1
Changed: Bump @webframp/aws/adopt 2026.08.01.1 → 2026.08.02.1
Changed: Bump @webframp/aws/inventory 2026.08.01.1 → 2026.08.02.1
2026.08.02.1
Changed: Bump @webframp/aws/adopt 2026.07.30.1 → 2026.08.01.1
Changed: Bump @webframp/aws/inventory 2026.07.30.1 → 2026.08.01.1
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @webframp/aws/adopt 2026.07.26.1 → 2026.07.30.1
Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @webframp/aws/adopt 2026.07.21.1 → 2026.07.26.1
Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1
2026.07.24.1
Changed: Bump dependency pins to latest published versions:
- @webframp/aws/adopt 2026.07.18.1 → 2026.07.21.1
- @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
updated dependencies
2026.08.15.1
Changed: Bump @webframp/aws/adopt 2026.08.02.1 → 2026.08.05.1
Changed: Bump @webframp/aws/inventory 2026.08.02.1 → 2026.08.05.1
2026.08.05.1
Changed: Bump @webframp/aws/adopt 2026.08.01.1 → 2026.08.02.1
Changed: Bump @webframp/aws/inventory 2026.08.01.1 → 2026.08.02.1
2026.08.02.1
Changed: Bump @webframp/aws/adopt 2026.07.30.1 → 2026.08.01.1
Changed: Bump @webframp/aws/inventory 2026.07.30.1 → 2026.08.01.1
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @webframp/aws/adopt 2026.07.26.1 → 2026.07.30.1
Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @webframp/aws/adopt 2026.07.21.1 → 2026.07.26.1
Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1
2026.07.24.1
Changed: Bump dependency pins to latest published versions:
- @webframp/aws/adopt 2026.07.18.1 → 2026.07.21.1
- @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
updated dependencies
2026.08.05.1
Changed: Bump @webframp/aws/adopt 2026.08.01.1 → 2026.08.02.1
Changed: Bump @webframp/aws/inventory 2026.08.01.1 → 2026.08.02.1
2026.08.02.1
Changed: Bump @webframp/aws/adopt 2026.07.30.1 → 2026.08.01.1
Changed: Bump @webframp/aws/inventory 2026.07.30.1 → 2026.08.01.1
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @webframp/aws/adopt 2026.07.26.1 → 2026.07.30.1
Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @webframp/aws/adopt 2026.07.21.1 → 2026.07.26.1
Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1
2026.07.24.1
Changed: Bump dependency pins to latest published versions:
- @webframp/aws/adopt 2026.07.18.1 → 2026.07.21.1
- @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
updated dependencies
2026.08.02.1
Changed: Bump @webframp/aws/adopt 2026.07.30.1 → 2026.08.01.1
Changed: Bump @webframp/aws/inventory 2026.07.30.1 → 2026.08.01.1
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @webframp/aws/adopt 2026.07.26.1 → 2026.07.30.1
Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @webframp/aws/adopt 2026.07.21.1 → 2026.07.26.1
Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1
2026.07.24.1
Changed: Bump dependency pins to latest published versions:
- @webframp/aws/adopt 2026.07.18.1 → 2026.07.21.1
- @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
updated dependencies
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @webframp/aws/adopt 2026.07.26.1 → 2026.07.30.1
Changed: Bump @webframp/aws/inventory 2026.07.24.1 → 2026.07.30.1
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @webframp/aws/adopt 2026.07.21.1 → 2026.07.26.1
Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1
2026.07.24.1
Changed: Bump dependency pins to latest published versions:
- @webframp/aws/adopt 2026.07.18.1 → 2026.07.21.1
- @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
updated dependencies
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @webframp/aws/adopt 2026.07.21.1 → 2026.07.26.1
Changed: Bump @webframp/aws/inventory 2026.07.21.1 → 2026.07.24.1
2026.07.24.1
Changed: Bump dependency pins to latest published versions:
- @webframp/aws/adopt 2026.07.18.1 → 2026.07.21.1
- @webframp/aws/inventory 2026.07.18.1 → 2026.07.21.1
updated dependencies
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned