CloudFormation

A CloudFormation template is a JSON or YAML file that defines AWS infrastructure.

Resources is the only required section. Every AWS resource goes here. Parameters make templates reusable by accepting input values at deploy time. Outputs export values for use in other stacks. Conditions control resource creation based on parameter values.

Example template sections:

Resources define actual AWS resources like VPCs, EC2 instances, and security groups. Parameters accept values like environment name and instance type. Outputs expose values like VPC IDs and endpoint URLs. Conditions enable or disable resources based on parameter values.

Use intrinsic functions like Ref, Sub, Join, and GetAtt to reference resources and construct dynamic values. These functions let you create templates that adapt to different environments and inputs.

Stack Sets deploy CloudFormation templates across multiple AWS accounts and regions from a single template. They are essential for enterprise governance.

Service-managed permissions use AWS Organizations to automatically deploy to member accounts. When you add a new account to an OU, Stack Sets automatically deploys the template.

Self-managed permissions require creating IAM roles in target accounts. Use this when you do not have Organizations access.

Deployment preferences control rollout speed with MaxConcurrentPercentage and FailureTolerancePercentage settings. Stack Sets are ideal for deploying baseline security controls, logging configurations, and networking standards across all accounts.

Change Sets let you preview changes before applying them. They show which resources will be created, modified, or deleted. Review the Change Set carefully, especially for Delete actions, before executing.

Drift detection identifies resources that have been modified outside of CloudFormation. Drifted resources show the actual versus expected configuration. You can revert drift by updating the stack, or import the drifted values into CloudFormation to reconcile.

Best practice: always use Change Sets for production deployments and run drift detection regularly to ensure your infrastructure matches your templates.

Nested stacks are CloudFormation stacks created from within another stack. They help organize complex templates into manageable pieces. The parent stack manages the nested stack lifecycle.

Custom resources extend CloudFormation to manage resources it does not natively support. They use Lambda functions or SNS topics to create, update, or delete resources. Common uses include creating Route 53 records, configuring third-party services, or populating initial data.

Macros transform templates before deployment. They let you create custom syntax that expands into standard CloudFormation, reducing repetition and enabling domain-specific abstractions.