will a manually updated stack in AWS that was created with cloudformation cause conflicts in the future?

Question

I am using cloudformation to deploy/update some stacks, including RDS. At the moment I successfully created my database and I want to update the port since I set the wrong one.

Reading the docs I encounter that by updating it via cloudformation, I must rename the stack in order to be able to update the port, therefore it will just create a new RDS instance with the new port and destroy the old one, this means I must create a backup first and later restore it.

I was reading that updating the port "manually" from the AWS console does not behave that way and no data loss should happen, so far I have not tried.

So, for example:

My deployed cloudformation is the following:

cloudformation template -> port 123 deployed stack -> port 123

I need to update it to port 234

then my cloudformation will still know the latest deploy happen to port 123 deployed stack -> 234 (the updated via aws console)

My question is the following: In the case, I am able to update the port via AWS Console, what will happen with the cloudformation template? should I update the template to have port 234 or I should leave it with port 123 so it wont try to make an update? (that would cause inconsistency on what I have at the template and what is really deployed but I wonder if would work)

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement

I dont have problems with all the vpc, security groups, rules, etc, its basically just the port.

Any idea about this?

Answer 1

Modify resources manually outside in AWS console (or CLI, SDK) which were created by CFN is a bad practice which results in a stack drift. The drift can lead to future issues; from docs:

Regardless, changes made outside of CloudFormation can complicate stack update or deletion operations.

Specifically to answer your question:

In the case, I am able to update the port via AWS Console, what will happen with the cloudformation template?

Nothing will happen per-se. CFN will not be aware by itself of any changes made to your RDS outside of CFN. But your stack will be considered as drifted, which, as AWS docs write, can lead to issues. Thus its better to avoid such situation.

should I update the template to have port 234 or I should leave it with port 123 so it wont try to make an update?

Yes, if you want to avoid drift. But updating port through CFN will lead to replacement of your db instance and data lost. So you must take all precautions on how to do it. Best would be to create some dummy RDS db, and do a test-run on it to understand the procedure and consequences of changing its port.