Study guide
Technical reference and lesson notes
Purpose of This Lesson
AWS CloudFormation is AWS’s native infrastructure-as-code (IaC) service. It allows you to define AWS resources in a JSON or YAML template and deploy them as a managed unit called a stack.
CloudFormation is useful when infrastructure must be repeatable, consistent, reviewable, and manageable through automation rather than manual console configuration.
Key Concepts
CloudFormation Templates
A CloudFormation template is a text file written in either:
- YAML
- JSON
The template describes the desired AWS infrastructure, such as:
- A VPC and its networking components
- Security groups
- EC2 instances or Auto Scaling groups
- Elastic Load Balancing resources
- IAM resources
- Databases and other supported AWS services
The template acts as the source definition for the environment. Multiple environments can be created from the same template, reducing configuration drift and manual errors.
Stacks
A stack is the deployed instance of a CloudFormation template. It represents the collection of resources that CloudFormation manages together.
Typical stack operations include:
- Create: Provision the resources defined in the template.
- Update: Modify the template or its parameters and apply the resulting changes.
- Delete: Remove the stack and, by default, delete the resources it created.
A stack provides a single management boundary for related resources. Instead of individually creating or deleting every resource, an operator can manage the environment through stack-level operations.
Resource deletion behavior should be considered carefully. Some resources contain important data, and deletion policies or resource retention settings may be needed to prevent accidental data loss.
StackSets
AWS CloudFormation StackSets extend stack management across multiple AWS accounts and Regions.
A StackSet is appropriate when an organization needs to deploy the same or similar CloudFormation stack to many accounts or Regions from a central operation. Common uses include deploying:
- Baseline IAM or security resources
- Logging and monitoring configurations
- Standard networking components
- Organization-wide governance controls
StackSets reduce the need to manually deploy separate stacks in each target account and Region.
Change Sets
A change set is a preview of the changes CloudFormation expects to make when updating a stack.
The usual workflow is:
- Modify the CloudFormation template or its input parameters.
- Create a change set against the existing stack.
- Review the proposed additions, modifications, and deletions.
- Execute the change set if the results are intended.
- Cancel or replace the change set if the proposed changes are unsafe or incorrect.
Change sets improve operational safety by separating change review from change execution. They are especially valuable for production stacks and changes that could replace resources or cause downtime.
A change set is a preview, not a complete guarantee of the final outcome. Dependencies, service behavior, and runtime conditions can still affect deployment.
Infrastructure as Code Benefits
CloudFormation provides several important IaC benefits:
- Consistency: The same definition can be used repeatedly.
- Repeatability: Environments can be recreated through automation.
- Change visibility: Template changes can be reviewed and managed through version control and change sets.
- Reduced manual error: Fewer console-based, one-off configuration steps are required.
- Lifecycle management: Related resources can be created, updated, and removed as a unit.
- Standardization: Organizations can distribute approved infrastructure patterns across teams and accounts.
Exam-Relevant Takeaways
- CloudFormation templates are written in YAML or JSON.
- A stack is the deployed collection of resources described by a template.
- Updating a stack applies changes to the resources managed by that stack.
- Deleting a stack generally deletes its managed resources unless deletion behavior is configured to retain or snapshot specific resources.
- StackSets deploy and manage stacks across multiple AWS accounts and Regions.
- Change sets show the expected impact of a proposed stack update before execution.
- CloudFormation is an AWS-native IaC service, while Terraform is a broader multi-provider IaC tool.
- For production changes, review the change set before execution and check for resource replacement or deletion.
Architecture Decision Guide
| Requirement | CloudFormation capability | Design consideration |
|---|---|---|
| Define AWS infrastructure in code | Template in YAML or JSON | Store templates in version control and review changes before deployment |
| Deploy a complete environment as one unit | Stack | Group resources with a clear lifecycle relationship |
| Update infrastructure safely | Change set | Review additions, modifications, replacements, and deletions before execution |
| Deploy a standard configuration across accounts and Regions | StackSet | Define target accounts, Regions, and deployment permissions carefully |
| Recreate consistent environments | Reusable template | Use parameters and controlled configuration rather than manual edits |
| Remove an entire environment | Stack deletion | Protect stateful resources with appropriate retention or deletion policies |
Common Exam Traps
- Confusing a template with a stack: The template is the declarative definition; the stack is the deployed environment created from it.
- Assuming StackSets are only multi-Region: StackSets support both multiple AWS accounts and multiple Regions.
- Treating a change set as an executed update: Creating a change set only previews the proposed changes. It must be explicitly executed.
- Ignoring resource replacement: Some template changes cannot be applied in place and may replace a resource. Replacement can cause downtime or data loss depending on the resource.
- Assuming stack deletion is harmless: Stack deletion can remove managed resources. Stateful resources require deliberate retention and backup planning.
- Using manual console changes as the normal operating model: Manual changes can create drift from the template and reduce repeatability.
- Assuming every AWS feature has identical CloudFormation behavior: Resource support, update behavior, and replacement semantics vary by AWS resource type.
Real-World Engineer Notes
- Keep templates in a source-control system and use peer review for production changes.
- Separate reusable infrastructure patterns from environment-specific values by using parameters and configuration conventions.
- Review change sets for unexpected resource replacement, deletion, or security-group changes.
- Treat databases, object storage, and other stateful resources differently from disposable compute resources.
- Use StackSets for organization-wide baselines, but establish account and Region deployment rules before rolling changes broadly.
- CloudFormation manages resources declaratively, but operational safety still depends on backups, dependency awareness, testing, and staged deployment.
- Test templates in a nonproduction account or Region before applying them to critical environments.
Quick Reference Summary
- Template: YAML or JSON definition of desired AWS resources.
- Stack: Deployed collection of resources managed from a template.
- StackSet: Mechanism for deploying stacks across multiple accounts and Regions.
- Change set: Preview of the impact of a proposed stack update.
- Primary value: Repeatable, consistent, reviewable AWS infrastructure deployment.
- Primary risk: An update or stack deletion can replace or remove resources if lifecycle behavior is not reviewed.
Flashcards
1. What is an AWS CloudFormation template?
A YAML or JSON file that defines the desired AWS resources and their configuration.
2. What is a CloudFormation stack?
The deployed collection of resources created and managed from a CloudFormation template.
3. What happens when a stack is deleted by default?
CloudFormation generally deletes the resources managed by the stack, subject to configured retention or deletion behavior.
4. What problem do change sets solve?
They allow operators to preview the expected effects of a stack update before executing it.
5. Does creating a change set modify the stack?
No. The change set must be executed before CloudFormation applies the proposed update.
6. What is a StackSet used for?
Deploying and managing CloudFormation stacks across multiple AWS accounts and Regions.
7. Which formats can CloudFormation templates use?
YAML and JSON.
8. Why is infrastructure as code useful?
It improves consistency, repeatability, reviewability, and automation while reducing manual configuration errors.
9. What should be checked in a change set before production execution?
Unexpected resource deletions, replacements, configuration changes, and possible availability or data-loss effects.
10. What is the difference between CloudFormation and Terraform in this context?
CloudFormation is AWS’s native IaC service, while Terraform is designed to manage resources across multiple providers.
Practice Questions
Question 1
A company needs to deploy the same logging infrastructure into 40 AWS accounts across two Regions. The security team wants to manage the deployment centrally. Which solution best meets the requirement?
Correct answer: Use an AWS CloudFormation StackSet.
Explanation: StackSets are designed to create and manage stacks across multiple AWS accounts and Regions from a centralized operation.
Question 2
An architect modifies a CloudFormation template for a production application. Before applying the update, the architect wants to identify whether a database or other resource will be replaced. What should the architect do?
Correct answer: Create and review a CloudFormation change set.
Explanation: A change set provides a preview of the expected additions, modifications, replacements, and deletions before the update is executed.
Question 3
A development team wants to create and destroy complete test environments repeatedly while minimizing manual configuration. Which approach is most appropriate?
Correct answer: Define the environment in a CloudFormation template and create or delete a stack for each test environment.
Explanation: CloudFormation templates provide repeatable infrastructure definitions, and stacks provide lifecycle management for the resulting resources.
Question 4
An administrator deletes a CloudFormation stack that contains an application database. The organization wants to ensure that future stack deletion does not remove the database. What should be configured?
Correct answer: Configure an appropriate resource retention or deletion policy for the database.
Explanation: Stack deletion can remove managed resources by default. Stateful resources should have deliberate retention and backup behavior configured.
Question 5
A CloudFormation update proposes deleting a security group and replacing an EC2-related resource, although the engineer expected only a tag change. What is the best next step?
Correct answer: Do not execute the change set; investigate the template and resource update behavior first.
Explanation: The change set reveals an unexpected destructive or replacement operation. The engineer should correct or reassess the template before applying it to production.