AWS CloudFormation IaC

Native infrastructure-as-code with JSON/YAML templates, stacks, drift detection, and nested stacks.

AWSIntermediate

Why

CloudFormation is free (only resource costs) and native — no third-party deps. Drift detection finds manual changes.

StackSets deploy across accounts. CDK compiles to CFN.

When

Use for AWS-only infra, drift detection, and when avoiding third-party tools. Prefer CDK for complex logic, Terraform for multi-cloud.

How

1. Template — YAML/JSON, Resources/Parameters/Outputs/Mappings 2. Deploy — aws cloudformation deploy --template-file infra.yaml --stack-name prod 3. Drift — aws cloudformation detect-stack-drift, compare to template 4. Nested stacks — break large templates, AWS::CloudFormation::Stack 5. StackSets — deploy same template to N accounts/regions 6. Change sets — preview changes before applying 7. Deletion policy — Retain/Snapshot/Delete on resource removal 8. cfn-lint — validate template syntax/policy before deploy

Example

# Deploy template aws cloudformation deploy \ --template-file infra.yaml \ --stack-name prod-web \ --parameter-overrides Env=prod DBPassword=${DB_PASS} \ --capabilities CAPABILITY_IAM # infra.yaml Resources: Bucket: Type: AWS::S3::Bucket Properties: BucketEncryption: ServerSideEncryptionConfiguration: - ServerSideEncryptionByDefault: { SSEAlgorithm: AES256 } BucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: !Ref Bucket PolicyDocument: Statement: - Effect: Deny Action: s3:* Principal: "*" Resource: !Sub "${Bucket}/*" Condition: { Bool: { "aws:SecureTransport": false } }

Common Problems

⚠ROLLBACK_FAILED — manual change blocks deletion, manually delete stuck resource
⚠No drift detection by default — run detect-stack-drift periodically
⚠Template size limit 1MB — use nested stacks or CDK for large infra

Best Practices

✓Use CDK over raw YAML — TypeScript/Python, type safety, abstractions
✓Run cfn-lint in CI — catches syntax/policy errors before deploy
✓Enable drift detection — schedule weekly, alert on drift to prevent manual changes

FAQ

What is AWS CloudFormation IaC and what problem does it solve?

Native infrastructure-as-code with JSON/YAML templates, stacks, drift detection, and nested stacks. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with AWS CloudFormation IaC in 5 minutes?

Two steps to run it: (1) Template — YAML/JSON, Resources/Parameters/Outputs/Mappings; (2) Deploy — aws cloudformation deploy --template-file infra.yaml --stack-name prod. Validate on the free tier first, then wire into production.

What is the #1 pitfall with AWS CloudFormation IaC?

The most frequent issue is: ROLLBACK_FAILED — manual change blocks deletion, manually delete stuck resource. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for AWS CloudFormation IaC?

Best practices for AWS CloudFormation IaC include: Use CDK over raw YAML — TypeScript/Python, type safety, abstractions; Run cfn-lint in CI — catches syntax/policy errors before deploy; Enable drift detection — schedule weekly, alert on drift to prevent manual changes. The first one — "Use CDK over raw YAML — TypeScript/Python, type safety, abstractions" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with AWS CloudFormation IaC?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most AWS CloudFormation IaC options offer a free tier — validate within free quota before scaling.