AWS CloudFormation & CDK IaC

Define infrastructure as code — CloudFormation YAML/JSON or CDK TypeScript, deploy reproducibly.

AWSIntermediate

Why

IaC makes infrastructure version-controlled, reviewable, and reproducible. CDK lets you write TS/Python that compiles to CloudFormation — 10x less code than YAML.

Drift detection catches manual changes.

When

Use IaC for all production infrastructure — no console clicks. CDK for complex stacks, CloudFormation for simple/sam.

Avoid for one-off resources (CLI is fine).

How

1. CDK init — npx cdk init app --language typescript 2. Define stack — construct library (aws-s3, aws-lambda, etc.) 3. Synthesize — cdk synth → CloudFormation template 4. Bootstrap — cdk bootstrap (one-time per env, creates deployment role) 5. Deploy — cdk deploy, diff shows changes, confirm destructive 6. Stages — cdk deploy --stage prod, separate accounts/envs 7. Drift — cdk drift detect, manual changes show as drifted 8. CI/CD — cdk deploy in CodePipeline/GitHub Actions on merge

Example

// lib/my-stack.ts — CDK stack import * as cdk from "aws-cdk-lib"; import * as s3 from "aws-cdk-lib/aws-s3"; import * as lambda from "aws-cdk-lib/aws-lambda"; export class MyStack extends cdk.Stack { constructor(scope: cdk.App, id: string, props?: cdk.StackProps) { super(scope, id, props); const bucket = new s3.Bucket(this, "uploads", { removalPolicy: cdk.RemovalPolicy.DESTROY, autoDeleteObjects: true, }); const fn = new lambda.Function(this, "api", { runtime: lambda.Runtime.NODEJS_20_X, handler: "index.handler", code: lambda.Code.fromAsset("./dist"), environment: { BUCKET: bucket.bucketName }, }); bucket.grantReadWrite(fn); } } # Deploy cdk deploy MyStack --require-approval never

Common Problems

⚠Destructive changes not caught — cdk deploy shows REPLACE/DELETE, read carefully
⚠Stack stuck in UPDATE_ROLLBACK — manual fix or continue-rollback, understand cause first
⚠CDK v1 vs v2 — v2 is one package (aws-cdk-lib), v1 is deprecated, migrate

Best Practices

✓Use cdk diff in CI — block PRs with unexpected destructive changes
✓Separate stacks by lifecycle — stateful (DB) vs stateless (Lambda) for safe redeploy
✓Use cdk-nag for security — auto-checks against AWS best practices, fails CI on violations

FAQ

What is AWS CloudFormation & CDK IaC and what problem does it solve?

Define infrastructure as code — CloudFormation YAML/JSON or CDK TypeScript, deploy reproducibly. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with AWS CloudFormation & CDK IaC in 5 minutes?

Two steps to run it: (1) CDK init — npx cdk init app --language typescript; (2) Define stack — construct library (aws-s3, aws-lambda, etc.). Validate on the free tier first, then wire into production.

What is the #1 pitfall with AWS CloudFormation & CDK IaC?

The most frequent issue is: Destructive changes not caught — cdk deploy shows REPLACE/DELETE, read carefully. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for AWS CloudFormation & CDK IaC?

Best practices for AWS CloudFormation & CDK IaC include: Use cdk diff in CI — block PRs with unexpected destructive changes; Separate stacks by lifecycle — stateful (DB) vs stateless (Lambda) for safe redeploy; Use cdk-nag for security — auto-checks against AWS best practices, fails CI on violations. The first one — "Use cdk diff in CI — block PRs with unexpected destructive changes" — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with AWS CloudFormation & CDK IaC?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most AWS CloudFormation & CDK IaC options offer a free tier — validate within free quota before scaling.