CloudFormation

A CloudFormation template is a declarative document describing the desired end state of your infrastructure. When you create or update a stack, CloudFormation builds a dependency graph from resource references (Ref, Fn::GetAtt, DependsOn), determines the correct creation order, and calls AWS service APIs on your behalf.

Stack updates go through a change set: CloudFormation computes the diff between the current deployed state and the new template, classifies each change (Add, Modify, Remove), and shows whether modifications require replacement (resource will be deleted and recreated) or can be done in-place.

# Minimal CloudFormation template
AWSTemplateFormatVersion: "2010-09-09"
Description: Simple S3 bucket example

Parameters:
  BucketNameSuffix:
    Type: String
    Description: Suffix appended to bucket name for uniqueness

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "my-app-${BucketNameSuffix}"
      VersioningConfiguration:
        Status: Enabled

Outputs:
  BucketArn:
    Value: !GetAtt MyBucket.Arn
    Export:
      Name: !Sub "${AWS::StackName}-BucketArn"

CloudFormation automatically rolls back a stack to the last stable state if a resource creation fails during a new stack creation. For stack updates, the rollback behavior is configurable.

Stack policies prevent unintended updates to critical resources. A stack policy is a JSON document that denies update actions on specified resources. Once set, it cannot be deleted (only replaced), and any update must explicitly override it.

# Enable termination protection
aws cloudformation update-termination-protection \
  --stack-name my-prod-stack \
  --enable-termination-protection

# Preview a change set before applying
aws cloudformation create-change-set \
  --stack-name my-prod-stack \
  --template-body file://template.yaml \
  --change-set-name preview-v2 \
  --parameters ParameterKey=Env,ParameterValue=prod

aws cloudformation describe-change-set \
  --stack-name my-prod-stack \
  --change-set-name preview-v2

As infrastructure grows, a single template becomes unmanageable. CloudFormation provides three mechanisms for decomposition and multi-account/multi-region deployment:

Cross-stack references create a hard dependency: you cannot delete a stack that has outputs being imported by another stack. This is intentional - it prevents accidental deletion of shared infrastructure - but requires planning for decommissioning.

StackSets require a delegated admin account or use of the Organizations service principal. They support two deployment models: SERVICE_MANAGED (Organizations manages accounts) and SELF_MANAGED (you specify account IDs and assume roles manually).

Custom Resources let you run arbitrary Lambda code during stack create, update, and delete operations. This enables managing resources that don't have native CloudFormation support, or running configuration tasks as part of a deployment.

The Lambda function receives a cfn-response call contract: it must send a SUCCESS or FAILED signal back to CloudFormation's pre-signed S3 URL. If it does not respond within the timeout (up to 1 hour), the stack hangs.

CloudFormation Macros (Transform) let you preprocess templates before CloudFormation parses them. The most well-known macro is AWS::Serverless Transform (SAM), which expands shorthand serverless syntax into full CloudFormation resources.

AWS CDK (Cloud Development Kit) compiles high-level TypeScript, Python, or Java code into CloudFormation templates. CDK is now the recommended approach for complex infrastructure - it brings type safety, loops, and abstractions that are impossible in raw YAML. The output is still CloudFormation under the hood.

Drift detection identifies resources whose actual configuration has diverged from the CloudFormation template. This happens when someone makes manual changes to a resource outside of CloudFormation (via the console or CLI).

# Initiate drift detection on a stack
aws cloudformation detect-stack-drift \
  --stack-name my-prod-stack

# Check drift detection status
aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id <detection-id>

# View drifted resources
aws cloudformation describe-stack-resource-drifts \
  --stack-name my-prod-stack \
  --stack-resource-drift-status-filters MODIFIED DELETED

cfn-guard is an open-source policy-as-code tool that validates CloudFormation templates against rules before deployment. It integrates with CI/CD pipelines to catch misconfigurations like public S3 buckets or unencrypted RDS instances before they reach production.