AWS CloudFormation

What it is

AWS CloudFormation is AWS's IaC (Infrastructure as code)Defining infrastructure, such as networks, servers, and permissions, in text files that are versioned and deployed automatically, instead of setting it up by hand. AWS CloudFormation and the AWS CDK are AWS tools for it.Glossary entry (IaC) service. You write a template that describes the AWS resources you want, such as VPCs, EC2 instances, RDS databases, and IAM roles, and CloudFormation provisions and configures them for you, working out the dependencies and the order. Because the infrastructure is code, you can version it, review it, and repeat it in any account or AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry.

Choose CloudFormation when a question asks to deploy the same infrastructure repeatedly and consistently, recreate an environment quickly (for example for DR (Disaster recovery)Preparing for and recovering from events that take a workload down, such as a Regional outage or deleted data. AWS describes four strategies, from cheapest and slowest to costliest and fastest: backup and restore, pilot light, warm standby, and multi-site active/active.Glossary entry), or track and control infrastructure changes. Using CloudFormation with AWS resource types has no additional charge; you pay for the resources it creates.

Templates and stacks

A template (JSON (JavaScript Object Notation)A text format for structured data made of name-and-value pairs and lists, such as {"bucket": "logs"}. IAM policies, most AWS API responses, and many CloudFormation templates are written in JSON.Glossary entry or YAML) has several sections. Resources is the only required one. The others are optional:
- Parameters: inputs at deploy time.
- Mappings: lookup tables, such as an AMI (Amazon Machine Image)A template for launching EC2 instances: the operating system, software, and settings to copy onto the new instance's volumes, plus who may launch it. AMIs come from AWS, AWS Marketplace, or the community, or you create your own from an instance.Glossary entry ID per Region. Fn::FindInMap with the AWS::Region pseudo parameter picks the right value in whichever Region the stack is created, so one template deploys unchanged in any Region.
- Conditions.
- Outputs: values to return or export.
- Transform: for example, AWS::Serverless for AWS SAM templates.
Intrinsic functions such as Ref, Fn::GetAtt, Fn::Sub, and Fn::ImportValue connect resources and values.
A stack is the set of resources created from one template, managed as a unit. Deleting the stack deletes its resources (unless a policy says otherwise).
Nested stacks split large templates into reusable pieces. Exports let one stack share outputs with other stacks in the same account and Region through Fn::ImportValue.
Dynamic references pull values from Systems Manager Parameter Store or Secrets Manager at deploy time, so secrets never appear in the template.

Changing stacks safely

Change sets: preview how a proposed update affects running resources, including whether a resource will be replaced or deleted, before you run it.
Drift detection: find resources whose configuration was changed outside CloudFormation, for example in the console.
Rollback: if a create or update fails, CloudFormation rolls back by default. You can instead preserve successfully provisioned resources to troubleshoot. Rollback triggers roll back an update when a CloudWatch alarm fires during or shortly after deployment.
Stack termination protection prevents a stack from being deleted by accident.
DeletionPolicy keeps a resource when it is removed from the stack or the stack is deleted:
- Retain keeps the resource.
- Snapshot takes a final snapshot, for resources such as EBS volumes and RDS databases.
- Snapshot is the default for RDS DB clusters, and for DB instances that aren't part of a cluster. For other resources, the default is to delete.
CreationPolicy: wait for a success signal, for example from cfn-signal after an instance finishes its setup, before marking the resource complete.
UpdatePolicy: control how Auto Scaling groups are updated when, for example, the launch template changes. Without one, a launch template change doesn't replace running instances.
- AutoScalingRollingUpdate replaces instances in batches (MaxBatchSize) while keeping at least MinInstancesInService running.
- AutoScalingReplacingUpdate (WillReplace: true) creates a new group and switches to it, rolling back to the old group if the update fails.
- AutoScalingInstanceRefresh runs an EC2 Auto Scaling instance refresh instead of a rolling update.
Stack policies: once set, a stack policy protects every resource from updates unless a statement allows it. Deny Update:Replace and Update:Delete (or Update:*) on a critical resource, such as the production database, while other resources can still be updated. Stack policies apply only to updates; use termination protection to stop the stack from being deleted.

Multi-account and governance

StackSets create, update, or delete stacks across multiple accounts and Regions with one operation. With service-managed permissions, StackSets works with AWS Organizations and can deploy automatically to new accounts added to an OU (Organizational unit)A group of AWS accounts inside an organization in AWS Organizations. OUs can contain other OUs, and policies attached to an OU, such as SCPs, apply to every account in it.Glossary entry.
Hooks check resource configurations before they are provisioned, and can warn or block noncompliant resources. AWS Control Tower's proactive controls use them.
IaC generator: create a template from existing resources that were created outside CloudFormation.
Service role: an IAM role that CloudFormation uses to create resources, so users can deploy stacks without having permissions for every resource themselves.

Security, resilience, performance, and cost

Security

Use a service role with Least privilegeGiving each person or system only the permissions it needs for its task, and no more. In IAM, this means starting with no access and allowing specific actions on specific resources.Glossary entry, and IAM policies on who can create, update, and delete stacks.
Keep secrets out of templates with dynamic references.
Use stack policies and termination protection for critical stacks.

Resilience

Templates make it fast to rebuild infrastructure in another Region for disaster recovery.
Use change sets, rollback triggers, and DeletionPolicy to protect data during updates.

Cost

No additional charge for AWS::* resource types; third-party resource types and hooks are charged per operation. You pay for the resources the stacks create.

Monitoring

Stack events show progress and errors. CloudTrail records CloudFormation API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry calls, and EventBridge can react to stack status changes.

CloudFormation or another option?

If the requirement is	Choose
Repeatable infrastructure as code in AWS	AWS CloudFormation
Deploy stacks to many accounts and Regions	CloudFormation StackSets
Write infrastructure in a programming language	AWS CDK (it generates CloudFormation)
Serverless applications with short templates	AWS SAM (a CloudFormation transform)
Users launch only approved, pre-built templates	AWS Service Catalog
Configure software inside running instances	Systems Manager State Manager

Reverse mindmap: when the question points here

Is it AWS CloudFormation?

Yes, when the question says
- Infrastructure as code leads to CloudFormation
- Recreate the same environment quickly in another Region leads to CloudFormation template
- Repeatable, consistent deployments leads to CloudFormation stacks
Change safely
- Preview an update before running it leads to Change set
- Someone changed resources in the console leads to Drift detection
- Roll back if an alarm fires after deploy leads to Rollback trigger
- Keep the database if the stack is deleted leads to DeletionPolicy Retain or Snapshot
- Prevent accidental stack deletion leads to Termination protection
- Stop updates from replacing the database leads to Stack policy denying Update:Replace and Update:Delete
- Replace instances in batches on a new AMI leads to UpdatePolicy AutoScalingRollingUpdate
- Same template in every Region, different AMI IDs leads to Mappings with Fn::FindInMap and AWS::Region
- Wait until the instance finishes setup leads to CreationPolicy with cfn-signal
Scale out governance
- Same stack in many accounts and Regions leads to StackSets
- Automatically deploy to new accounts in an OU leads to StackSets with service-managed permissions
- Block noncompliant resources before creation leads to Hooks
- Template from resources we already have leads to IaC generator
Keep secrets out
- Database password in a template leads to Dynamic reference to Secrets Manager
No, when the question says
- Self-service catalog of approved products leads to Service Catalog

Key takeaways

CloudFormation provisions AWS resources from JSON or YAML templates; Resources is the only required section.
Stacks group resources; nested stacks and exports share pieces; dynamic references keep secrets out of templates.
Change sets preview updates; drift detection finds manual changes; rollback triggers use CloudWatch alarms.
DeletionPolicy (Retain or Snapshot) and termination protection protect resources and stacks; stack policies protect resources during updates.
UpdatePolicy with AutoScalingRollingUpdate replaces Auto Scaling instances in batches during a stack update.
StackSets deploy across accounts and Regions, automatically to new accounts with Organizations.
It costs nothing extra for AWS resource types.