A CloudFormation template deploys VPC and EC2 security groups. A manager discovers some engineers changed security group settings on a few EC2 instances for testing. A developer must determine what changes were made. Which method will identify the modifications?

CloudFormation drift detection is the correct method because it specifically identifies when the actual configuration of resources in a stack deviates from their expected configuration defined in the CloudFormation template. In this scenario, the security group changes made outside of CloudFormation would be detected as drift. Adding a Conditions section to the CloudFormation template is used for conditionally creating resources based on input parameters or other conditions, not for detecting out-of-band changes. Executing a CloudFormation change set shows proposed changes before applying them to the stack, but it doesn't detect existing changes made manually. Amazon Detective is a security service that investigates potential security issues and anomalous behavior, but it's not designed for detecting configuration drift in CloudFormation stacks.