AWS CloudFormation Creation and Deletion Policies, DependsOn, and WaitConditions

Purpose of This Lesson

This lesson explains CloudFormation resource attributes that control deployment sequencing, resource readiness, preservation during deletion, and handling of resource replacement during stack updates. These features are especially important when infrastructure creation depends on configuration actions, external processes, or the preservation of existing resources.

Key Concepts

• CreationPolicy: Prevents a supported resource from reaching CREATE_COMPLETE until CloudFormation receives the required success signal or the configured timeout expires.
• DeletionPolicy: Controls whether a resource is retained, snapshotted, or deleted when its stack is deleted.
• DependsOn: Establishes an explicit creation dependency between resources.
• WaitCondition: Coordinates stack creation with readiness signals or configuration actions that may occur outside normal stack resource creation.
• UpdatePolicy: Defines how CloudFormation handles updates to certain supported resources.
• UpdateReplacePolicy: Determines whether the old physical resource is retained or backed up when a stack update requires replacement.

Deployment Sequencing and Resource Readiness

CreationPolicy

Use a CreationPolicy when resource creation is not complete merely because CloudFormation has provisioned the underlying resource. The policy allows configuration actions—such as initialization or software setup—to finish before the resource is considered successfully created.

A resource with a creation policy does not reach CREATE_COMPLETE until CloudFormation receives the required success signal, such as a configured number of signals, or until the configured timeout is exceeded. Signals can be sent using the cfn-signal helper script or the CloudFormation signal resource API. Valid signals are published in stack events, allowing the signal count and deployment progress to be tracked.

The lecture identifies these supported resources:

• Auto Scaling groups
• EC2 instances
• CloudFormation WaitCondition resources

The central distinction is that CreationPolicy gates the completion status of a resource itself. It is useful when the resource must perform or wait for configuration actions before stack creation proceeds.

DependsOn

Use DependsOn to explicitly control resource creation order. A resource with a DependsOn relationship is created only after the resource named in that relationship has been created.

For example, if an EC2 instance depends on a database resource, CloudFormation creates the database first and then creates the instance. This is a direct resource dependency and should be used when the required ordering is not otherwise established by the template’s resource relationships.

WaitCondition

A WaitCondition is useful when stack creation must wait for readiness information or configuration activity that is external to ordinary stack creation. It can coordinate resource creation with external configuration actions or track the status of a configuration process.

A common pattern is using a wait condition to wait for a desired number of instances in a web server group to report that they are ready. Unlike DependsOn, which establishes ordering between resources, a WaitCondition waits for readiness signals or a configuration milestone.

Resource Preservation and Update Behavior

DeletionPolicy

A DeletionPolicy is specified on each resource whose deletion behavior needs to be controlled. If no deletion policy is specified, CloudFormation deletes the resource by default when the stack is deleted.

The supported policy choices described in the lesson are:

Policy	Behavior
Retain	Preserves the resource after stack deletion so it can be handled separately.
Snapshot	Creates a snapshot before deletion for resource types that support snapshots. The lecture gives EC2 volumes, ElastiCache, and RDS as examples.
Delete	Deletes the resource; this is the default behavior.

Retain and Snapshot serve different purposes. Choose Retain when the resource itself must remain available. Choose Snapshot when the important safeguard is a recoverable point-in-time copy and the resource supports snapshot behavior.

UpdatePolicy

UpdatePolicy specifies how CloudFormation handles updates to certain resource types. The lecture identifies support for:

• Auto Scaling groups
• ElastiCache replication groups
• Elasticsearch domains
• Lambda aliases

The exact update behavior depends on the resource and the policy configuration. The key decision is whether an update should be handled using a controlled resource-specific strategy rather than simply applying a generic replacement.

UpdateReplacePolicy

When a stack update changes a property that requires resource replacement, CloudFormation creates a new physical resource with a new physical ID. UpdateReplacePolicy controls what happens to the old physical resource during that replacement.

The policy can be used to retain or back up the old resource, including taking a snapshot for an EC2 volume when snapshot behavior is supported. This is different from DeletionPolicy: DeletionPolicy applies when the stack or resource is deleted, while UpdateReplacePolicy applies when an update replaces the existing physical resource.

Exam- or Assessment-Relevant Takeaways

• A CreationPolicy delays CREATE_COMPLETE until the required success signal is received or the configured timeout is exceeded.
• The cfn-signal helper script and the CloudFormation signal resource API can provide valid creation signals.
• Creation policies are associated with EC2 instances, Auto Scaling groups, and WaitCondition resources in the material covered here.
• DeletionPolicy controls what happens when a stack is deleted; the default is Delete.
• Retain preserves the resource, while Snapshot creates a backup for supported resource types before deletion.
• DependsOn controls creation order but does not itself represent application readiness or an external configuration completion signal.
• WaitCondition is suited to coordinating stack progress with external configuration actions or readiness signals.
• UpdateReplacePolicy applies when an update requires replacement and determines what happens to the old physical resource.
• When a resource property requires replacement, CloudFormation creates a new physical ID; preservation or backup of the old resource must be handled deliberately.

Tool / Feature Decision Guide

Requirement	Prefer	Why
A resource must finish initialization before CloudFormation marks it complete	CreationPolicy	Completion is gated by success signals or timeout.
One resource must be created after another	DependsOn	Establishes explicit creation order.
Stack creation must wait for external configuration or readiness reports	WaitCondition	Coordinates stack progress with signals from a configuration process or instance group.
Preserve a resource when the stack is deleted	DeletionPolicy: Retain	Leaves the resource in place after stack deletion.
Create a backup before deleting a supported resource	DeletionPolicy: Snapshot	Produces a snapshot before deletion.
Allow normal deletion behavior	DeletionPolicy: Delete or no policy	Delete is the default behavior described in the lesson.
Control how supported resources handle updates	UpdatePolicy	Applies resource-specific update behavior to supported resource types.
Preserve or back up the old resource during replacement	UpdateReplacePolicy	Applies when an update creates a new physical resource and replaces the old one.

Common Traps / Misconceptions

• Confusing creation completion with provisioning: An EC2 instance being created does not necessarily mean its required configuration actions are finished. A CreationPolicy can gate completion on signals.
• Treating DependsOn as a readiness check: DependsOn controls order; it does not wait for an external configuration process to report that a resource is ready.
• Assuming resources are retained automatically: Without a deletion policy, CloudFormation deletes resources by default when the stack is deleted.
• Confusing Retain and Snapshot: Retain keeps the resource itself. Snapshot creates a backup before deletion for supported resources.
• Applying DeletionPolicy to replacement events: Resource replacement during an update is governed by UpdateReplacePolicy, not only by the stack deletion behavior.
• Forgetting the new physical ID: A replacement creates a new physical resource with a new physical ID, so the fate of the old resource must be considered.
• Ignoring signal visibility: Valid creation signals are published in stack events, which can be used to track progress and signal counts.

Real-World Engineer / Analyst Notes

• Use CreationPolicy when initialization is part of the definition of successful deployment, rather than allowing the stack to appear complete while configuration is still running.
• Use DependsOn sparingly for explicit ordering requirements. The dependency should describe a real sequencing need, such as requiring the database resource to be created before an instance.
• Use WaitCondition when the readiness event comes from an external configuration process or when a desired number of instances must report readiness.
• For stateful resources, decide separately what should happen on stack deletion and on update replacement. A resource may need one policy for stack deletion and another policy for replacement during updates.
• Before choosing Snapshot, verify that the resource type supports snapshot behavior. The lesson specifically frames snapshots as applicable to supported resources such as EC2 volumes, ElastiCache, and RDS.
• When using signal-driven completion, monitor stack events so missing or insufficient signals can be distinguished from ordinary provisioning delays.

Quick Reference Summary

• CreationPolicy: Waits for success signals before CREATE_COMPLETE.
• Signal mechanisms: cfn-signal helper script or CloudFormation signal resource API.
• DependsOn: Creates one resource only after another resource has been created.
• WaitCondition: Waits for external configuration or readiness signals.
• DeletionPolicy: Controls stack-deletion behavior: Retain, Snapshot, or Delete.
• Default deletion behavior: Delete the resource when no deletion policy is specified.
• UpdatePolicy: Controls updates for supported resources such as Auto Scaling groups, ElastiCache replication groups, Elasticsearch domains, and Lambda aliases.
• UpdateReplacePolicy: Controls retention or backup of the old physical resource when an update requires replacement.
• Replacement consequence: The replacement resource receives a new physical ID.

Flashcards

Q: A web server must complete initialization before CloudFormation reports the EC2 instance as created. Which feature should be used?
A: Use a CreationPolicy and require a valid success signal, such as one sent by the cfn-signal helper script. The instance does not reach CREATE_COMPLETE until the signal requirement is met or the timeout expires.

Q: What is the decisive difference between DependsOn and WaitCondition?
A: DependsOn enforces creation order between resources. WaitCondition waits for readiness or configuration signals, including signals from activity external to normal stack resource creation.

Q: What happens when a resource has no DeletionPolicy attribute and its stack is deleted?
A: CloudFormation deletes the resource by default.

Q: When should DeletionPolicy: Retain be chosen instead of DeletionPolicy: Snapshot?
A: Choose Retain when the resource itself must remain after stack deletion. Choose Snapshot when a recoverable backup is sufficient and the resource supports snapshots.

Q: Which signal mechanisms are identified for satisfying a creation policy?
A: The cfn-signal helper script and the CloudFormation signal resource API can send valid signals.

Q: An EC2 instance must be created only after a database resource is created. Which attribute expresses this dependency?
A: Add DependsOn to the EC2 instance and specify the database resource. CloudFormation then creates the database first.

Q: What does a CreationPolicy prevent until its signal requirement is satisfied?
A: It prevents the resource from reaching CREATE_COMPLETE until CloudFormation receives the required success signal or the configured timeout is exceeded.

Q: What is the default DeletionPolicy behavior described in the lesson?
A: Delete is the default, meaning CloudFormation deletes the resource when the stack is deleted.

Q: A stack must wait for a desired number of web server instances to report readiness. Which feature best matches this requirement?
A: Use a WaitCondition, because it can wait for the desired number of instance readiness signals and coordinate stack progress with configuration activity.

Q: Which resource categories are identified as supporting creation policies?
A: Auto Scaling groups, EC2 instances, and CloudFormation WaitCondition resources.

Q: When does UpdateReplacePolicy become important?
A: It becomes important when a stack update changes a property that requires resource replacement. CloudFormation creates a new physical resource, and the policy controls whether the old one is retained or backed up.

Q: How does UpdateReplacePolicy differ from DeletionPolicy?
A: DeletionPolicy controls what happens when a stack is deleted. UpdateReplacePolicy controls what happens to the old physical resource when an update replaces it.

Q: What happens to a resource’s physical identity when CloudFormation replaces it during an update?
A: CloudFormation creates a new physical resource with a new physical ID.

Q: Which resource types are listed as examples of those supporting UpdatePolicy?
A: Auto Scaling groups, ElastiCache replication groups, Elasticsearch domains, and Lambda aliases.

Practice Questions

Question 1

An EC2 instance launches successfully, but a configuration script must finish before the stack can treat the instance as complete. Which approach is most appropriate?

A. Add DependsOn to the EC2 instance
B. Add a CreationPolicy and send the required success signal
C. Set DeletionPolicy to Retain
D. Set UpdateReplacePolicy to Snapshot

Correct answer: B

Explanation: A CreationPolicy gates CREATE_COMPLETE on valid success signals or timeout. DependsOn only controls resource ordering.

Question 2

A database must be created before an EC2 instance in the same CloudFormation stack. The requirement is only about resource creation order, not post-launch configuration readiness. Which feature should be selected?

A. WaitCondition
B. CreationPolicy
C. DependsOn
D. DeletionPolicy: Snapshot

Correct answer: C

Explanation: DependsOn explicitly requires the dependent resource to be created after the named prerequisite resource.

Question 3

A stack contains a resource that must remain available after the stack is deleted so engineers can manage it separately. Which deletion policy best fits?

A. Delete
B. Snapshot
C. Retain
D. UpdatePolicy

Correct answer: C

Explanation: Retain preserves the resource itself after stack deletion. Snapshot creates a backup and is not the same as keeping the resource in place.

Question 4

A stack update changes a property that requires replacement of an existing resource. The team wants the old physical resource backed up when supported instead of simply disappearing. Which attribute addresses this event?

A. DependsOn
B. UpdateReplacePolicy
C. CreationPolicy
D. WaitCondition

Correct answer: B

Explanation: UpdateReplacePolicy governs the old physical resource during replacement caused by a stack update. The replacement receives a new physical ID.

WordPress Metadata

Suggested Slug:
aws-cloudformation-creation-deletion-policies-dependson-waitconditions

Meta Description:
Study AWS CloudFormation creation, deletion, update, and replacement policies, along with DependsOn and WaitCondition behavior for deployment decisions.

Tags:
AWS CloudFormation, AWS Certified CloudOps Engineer, CreationPolicy, DeletionPolicy, UpdatePolicy, UpdateReplacePolicy, DependsOn, WaitCondition, CloudFormation signals, Infrastructure as code