AWS CloudFormation: Deploying Stacks and Reviewing Change Sets

Purpose of This Lesson

This lesson demonstrates how to deploy and update AWS resources with CloudFormation templates. The workflow progresses from a minimal EC2 instance to templates using Elastic IP addresses, mappings, parameters, security groups, and EC2 user data. It also shows how to use change sets to preview modifications before applying them.

The examples use several YAML templates that should be updated with valid, region-specific AMI IDs before deployment.

Key Concepts

• CloudFormation stack: A collection of AWS resources managed as one deployment unit. In the examples, a stack contains an EC2 instance and may also contain an Elastic IP, security group, or other resources.
• Template resource logical IDs: Names such as MyEC2Instance and MyEIP identify resources inside the template. These logical IDs are user-defined and can be changed, but references must use the correct ID.
• Resource type: The Type property determines what AWS resource CloudFormation creates, such as AWS::EC2::Instance or AWS::EC2::EIP.
• Resource properties: Properties specify configuration such as the availability zone, AMI ID, instance type, and security groups.
• Intrinsic functions: Ref retrieves a value or resource reference. In the examples, an Elastic IP uses Ref to associate itself with the EC2 instance, while FindInMap retrieves region- and environment-specific values.
• Mappings: A mapping stores fixed key-value relationships in the template. The examples use mappings to associate environments and regions with instance types and AMI IDs.
• Parameters: Parameters allow values to be selected at deployment time. The environment parameter offers dev and prod, allowing the same template to choose different mapped values.
• Change set: A preview of the changes CloudFormation would make to an existing stack. Creating a change set does not deploy the changes; the change set must be executed separately.
• User data: Launch-time instructions supplied to an EC2 instance. The final template uses user data to install Apache and update index.html.

CloudFormation Deployment and Update Workflow

1. Prepare region-specific AMI IDs

AMI IDs are region-specific. An AMI ID valid in US East (N. Virginia) cannot automatically be assumed to be valid in US West (N. California). Before uploading the templates, retrieve the appropriate Amazon Linux 2023—or the selected default AMI—from the EC2 launch workflow for each target region.

Update every template that contains an AMI ID. The mapping-based template requires separate values for the regions represented in its mapping, such as us-east-1 and us-west-1.

2. Deploy a basic EC2 stack

The first template contains one EC2 instance resource with the basic properties used in the demonstration:

• Availability zone
• AMI ID
• Instance type

In the CloudFormation console, choose Create stack, select With new resources, upload the template file, provide a stack name, and submit the deployment. CloudFormation makes the required API calls and reports progress through stack events, such as CREATE_IN_PROGRESS and CREATE_COMPLETE.

The template can also be supplied through an S3 URL. The demonstration uses an S3 bucket containing the uploaded template files and their newer versions.

3. Add an Elastic IP with a change set

The second template adds an Elastic IP resource and references the EC2 instance with Ref. Both resources are declared at the same resource level, and the Elastic IP is associated with the instance.

To preview this update:

1. Open the existing stack.
2. Choose Stack actions and Create change set.
3. Select the option to replace the existing template.
4. Upload the revised template.
5. Review the proposed changes.
6. Execute the change set only after confirming the result.

The preview identifies the new AWS::EC2::EIP resource and provides details about the instance it will attach to. After execution, the stack retains the instance and adds the Elastic IP in this example.

4. Use mappings for environment and region values

The third template introduces two mappings:

• An instance map containing instance types for environments such as dev and prod.
• An AMI map containing AMI IDs for different AWS Regions.

FindInMap retrieves the appropriate value. The template combines the mapping lookup with Ref to obtain the AWS Region and the selected environment key.

The demonstration initially hard-codes the environment as dev in the resource definition. Even when the resulting instance configuration matches the previous configuration, CloudFormation can still replace the instance if the effective template change requires replacement. The change-set preview shows this by marking the existing instance for replacement and deletion.

5. Replace hard-coded choices with parameters

The fourth template adds an environment parameter with allowed values of dev and prod. Instead of editing the template to change the environment, the operator selects the value in the CloudFormation console during stack creation.

The selected parameter value becomes the key used by the mappings. This allows one template to choose an instance type and AMI based on the deployment environment and Region.

The demonstration deploys the same parameterized template in two Regions. Selecting dev produces the instance type mapped to dev in each Region. Because mappings can contain different values by Region, the resulting instance types may differ between deployments.

Parameters can also be used for other deployment choices, such as a VPC, subnet, or EC2 key pair, when those values are represented in the template.

6. Add an SSH security group

The fifth template adds a security group and references it from the EC2 instance’s SecurityGroups property. The security group permits TCP port 22 from any source address in the demonstration.

Port 22 is used for SSH. A change set identifies the new security group and may also identify replacement of the instance when the revised configuration or resource relationship requires it.

Opening SSH to any source is suitable only for this controlled hands-on demonstration. In an operational environment, access should be restricted to the required administrative source range.

7. Add HTTP access and EC2 user data

The final template retains the security group and adds a rule for TCP port 80. It also supplies launch-time user data that:

• Installs Apache.
• Updates the instance’s index.html file.
• Produces a simple success message when accessed through the instance’s public IP address.

Because user data runs at instance launch, changing it can result in instance replacement in the demonstrated update workflow. The change-set summary gives a high-level indication of the replacement, but it does not display the actual user-data script.

After the update completes, the instance’s public IP can be entered in a browser to verify that the web server responds with the expected message.

Exam- or Assessment-Relevant Takeaways

• A change set is a preview, not an update. Creating one evaluates and displays proposed changes; execution is a separate action.
• Always inspect replacement behavior. A change set may show Replace and Delete for an EC2 instance. Executing that plan can terminate the existing instance and create a new one.
• AMI IDs are regional. A template intended for multiple Regions must supply valid AMI values for each Region, commonly through mappings or another supported selection mechanism.
• Mappings and parameters serve different purposes. Mappings hold predefined static relationships in the template; parameters allow an operator to select a value at deployment time.
• Resource references create relationships. Ref is used in the examples to connect the Elastic IP and security group configuration to the EC2 instance.
• User data is launch-time configuration. It is useful for bootstrapping software, but changes may affect replacement behavior and are not necessarily shown in full in the change-set console details.
• Stack events are a primary troubleshooting view. Creation, update, rollback, and cleanup problems appear in the stack’s event history.
• Cleanup is part of the deployment workflow. Deleting the stack removes the resources managed by it according to the configured deletion behavior, but the operator should verify termination in EC2.

Tool / Feature Decision Guide

Situation	Recommended feature	Reason
Creating the initial collection of resources	Create a CloudFormation stack	Establishes a managed deployment unit from a template.
Reviewing an update before changing the stack	Change set	Shows proposed additions, modifications, replacements, and deletions without applying them.
Selecting between predefined deployment environments	Parameter with allowed values	Lets the operator choose dev or prod at deployment time.
Storing region- and environment-specific fixed values	Mapping with FindInMap	Keeps AMI IDs and instance types organized inside one template.
Connecting one resource to another in the template	Ref	Uses the logical resource or parameter reference when defining relationships.
Installing software when an instance launches	EC2 user data	Runs the bootstrap instructions at launch; validate replacement implications before updating.
Investigating a failed deployment or rollback	CloudFormation Events	Shows resource status and error messages during stack operations.

Common Traps / Misconceptions

• Mistaking a created change set for a deployed change: The stack remains unchanged until the change set is executed.
• Assuming the change-set details show everything: The console provides a high-level summary, but the actual user-data script is not displayed in the demonstrated details.
• Reusing an AMI ID across Regions: AMI IDs must be checked for each target Region.
• Assuming an unchanged effective configuration prevents replacement: A template update can still produce replacement and deletion actions even when the resulting AMI and instance type happen to be the same.
• Confusing mappings with parameters: A mapping is defined in the template; a parameter is supplied or selected during deployment.
• Treating port 22 open to all sources as a safe default: The demonstration uses an unrestricted SSH source for simplicity, not as a recommended production security posture.
• Forgetting that user data runs at launch: Updating the bootstrap script is not equivalent to interactively editing an already-running instance.
• Deleting only the EC2 instance manually: Stack-managed resources should generally be cleaned up through stack deletion, followed by verification in EC2 and relevant services.
• Ignoring stack failure settings: The console offers behavior such as rolling back resources or preserving successfully created resources. These settings affect how failures are handled and should be reviewed for the situation.

Real-World Engineer / Analyst Notes

• Validate every AMI ID before deployment, especially when templates are shared across Regions.
• Use change sets as a review checkpoint for production updates. Pay particular attention to resources marked for replacement or deletion.
• Treat logical IDs and references as part of the template’s dependency structure. Changing a logical ID can cause CloudFormation to treat a resource as different.
• Keep environment selection explicit through parameters rather than repeatedly editing hard-coded values.
• Test user-data scripts independently and verify the resulting service through an application-level check, such as an HTTP request.
• Avoid broad inbound rules in operational security groups. The lesson’s 0.0.0.0/0-style SSH access is a lab convenience and exposes the instance to unnecessary sources.
• After deleting a stack, confirm that EC2 instances have terminated and review CloudFormation events for rollback or deletion errors.
• Remember that a public IP address may change when an instance is replaced. An Elastic IP provides a stable allocated address for the demonstrated association, but its lifecycle and cleanup should still be checked.

Quick Reference Summary

• Update AMI IDs for every target Region before uploading templates.
• Use Create stack to deploy a new template.
• Use Create change set to preview an update; use Execute change set to apply it.
• Use Ref for references such as attaching an Elastic IP or security group to an instance.
• Use mappings for predefined region/environment values.
• Use parameters for deployment-time choices such as dev or prod.
• Review any Replace or Delete action before executing an update.
• Port 22 is SSH; port 80 is HTTP.
• User data bootstraps the instance at launch and may contribute to replacement behavior.
• Use CloudFormation events to monitor progress and diagnose failures.
• Delete the stack after the lab and verify that resources were removed.

Flashcards

Q: You need to preview the effect of uploading a revised CloudFormation template without applying it. Which feature should you use?
A: Create a change set. It evaluates and displays proposed changes, but deployment does not occur until the change set is executed.

Q: Why must an AMI ID be checked separately for each AWS Region?
A: AMI IDs are Region-specific. A valid AMI identifier in one Region cannot simply be reused in another.

Q: When should you use a mapping instead of a parameter?
A: Use a mapping for fixed relationships already defined in the template, such as Region-to-AMI or environment-to-instance type. Use a parameter when the operator should select a value during deployment.

Q: A change set marks an EC2 instance for replacement even though the effective AMI and instance type remain the same. What should you conclude?
A: The template change still affects resource replacement behavior or dependencies. Review the replacement action carefully because execution can terminate the existing instance.

Q: How does the example associate an Elastic IP with the EC2 instance?
A: The Elastic IP resource references the EC2 instance through the Ref intrinsic function, allowing CloudFormation to use that instance in the association.

Q: What does FindInMap accomplish in the multi-Region template?
A: It retrieves a value from a mapping using keys such as Region and environment, allowing the template to select the appropriate AMI ID or instance type.

Q: What is the operational difference between creating and executing a change set?
A: Creation is a review step that does not implement changes. Execution applies the proposed plan to the stack.

Q: A template includes an environment parameter with allowed values dev and prod. What benefit does this provide?
A: The same template can be deployed with different environment selections without editing its resource definitions manually. The selected value can drive mapping lookups.

Q: Which ports are opened by the demonstrated security group, and for what purposes?
A: TCP port 22 is opened for SSH, and TCP port 80 is opened for HTTP access to the web server.

Q: Why might changing EC2 user data cause an instance replacement in the demonstrated workflow?
A: User data runs when the instance launches, so applying a changed bootstrap configuration can require a new instance. The change set should be reviewed for the exact replacement behavior.

Q: What information does the CloudFormation Events view provide during deployment?
A: It shows resource operation statuses and error messages during creation, update, rollback, and cleanup.

Q: What is the security concern with the lesson’s SSH rule?
A: Allowing SSH from any source exposes port 22 broadly. It may be acceptable for a temporary lab, but production access should be limited to the necessary source range.

Q: After deleting a stack, what verification should you perform?
A: Confirm in EC2 that managed instances have terminated and review CloudFormation events for deletion or rollback errors.

Practice Questions

Question 1

A CloudFormation update is ready for review. The change-set summary says the EC2 instance will be replaced and deleted, although a new instance will use the same apparent AMI and instance type. What is the best next step?

A. Execute immediately because the final configuration is unchanged
B. Delete the stack and recreate it manually
C. Investigate the replacement reason and assess the termination impact before execution
D. Ignore the change set because it cannot predict replacement behavior

Correct answer: C

Explanation: A replacement can terminate the existing instance and create a new one. The decisive clue is the explicit Replace and Delete action in the change set.

Question 2

An organization wants one template to support multiple Regions, each with its own valid AMI ID, while allowing the operator to select either dev or prod. Which design best matches the demonstrated approach?

A. Hard-code one AMI ID and edit it before every deployment
B. Store Region and environment values in mappings and use a parameter for the environment selection
C. Use a change set to discover the correct AMI automatically
D. Store all AMI IDs in the security group definition

Correct answer: B

Explanation: Mappings hold predefined Region- and environment-specific values, while the parameter supplies the deployment-time environment choice.

Question 3

A learner creates a change set for a revised template and expects the new Elastic IP to appear immediately in EC2. What explains the missing resource?

A. Change sets are limited to security-group changes
B. Elastic IPs cannot be managed by CloudFormation
C. The change set has been created but not executed
D. The AMI ID must be changed before an Elastic IP can be created

Correct answer: C

Explanation: Creating a change set only previews the change. The resource appears after the change set is executed successfully.

Question 4

An EC2 instance should install Apache during launch and serve a test page over HTTP. Which template changes are required in the demonstrated progression?

A. Add TCP 22 only and omit user data
B. Add a port 80 rule and launch-time user data that installs Apache and updates index.html
C. Add an Elastic IP only; HTTP is enabled automatically
D. Add a mapping only; mappings install software on the instance

Correct answer: B

Explanation: Port 80 permits HTTP access, while user data performs the launch-time Apache installation and page update.

WordPress Metadata

Suggested Slug:
aws-cloudformation-deploy-stacks-change-sets

Meta Description:
Learn how to deploy AWS CloudFormation stacks, use change sets to preview updates, apply mappings and parameters, configure security groups and user data, and clean up resources safely.

Tags:
AWS CloudFormation, CloudFormation stacks, CloudFormation change sets, AWS deployment automation, CloudFormation mappings, CloudFormation parameters, EC2, AWS security groups, EC2 user data, AWS AMI