ACKF logoACKF
Management and Governance

AWS CloudFormation

View on GitHub

AWS CloudFormation

AWS CloudFormation is an infrastructure-as-code service that provisions and manages AWS resources using declarative templates. It operates by interpreting JSON or YAML templates to create, update, and delete stacks of resources according to the template and stack operations. It typically sits in the control plane layer, invoked by operators or automation to orchestrate resource creation and lifecycle in an AWS account and region.

🗂 Resource Category

Management and Governance • Developer Tools

🧠 Exam Memory Hook

Think: "Declarative templates + repeatable provisioning + preview changes = AWS CloudFormation"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and maintains the CloudFormation control plane, APIs, console, service endpoints, and the underlying physical infrastructure and service platform; AWS is responsible for patching and securing the infrastructure and the CloudFormation service software components it runs. AWS maintains service availability, scalability of the control plane, and the backend systems that execute provisioning actions. AWS does not manage or change customer templates, stack resource configurations, or customer-owned resource software.

Customer responsibilities: The customer writes, stores, and secures templates and parameters, configures stack operations, provides IAM roles and permissions used by CloudFormation, and manages the lifecycle of resources created by stacks; customers must validate templates, manage sensitive parameters, and secure artifacts stored in Amazon S3. Customers monitor stack events, resource health, and perform remediation for resource-level issues; they are responsible for resources created by CloudFormation (for example, EC2 instance OS, application code, database schema). For custom resources, customers build and maintain the code (for example Lambda functions) and any external endpoints invoked during stack operations.

Patching responsibilities: AWS patches and maintains the physical infrastructure, hypervisor, control plane, and the CloudFormation service platform. The customer patches guest operating systems, installed runtimes, libraries, dependencies, and applications on resources provisioned by CloudFormation (for example EC2 instances). For AWS-managed compute used as custom resource handlers (for example AWS Lambda), AWS patches the underlying runtime platform and infrastructure while the customer patches and updates the function code and its packaged dependencies. If the customer deploys container workloads on EC2 worker nodes, the customer is responsible for patching those nodes and their guest OS.

🏗 Typical Architecture

💡 Top 5 Features

  • Declarative templates in JSON or YAML to define desired resource state and relationships.
  • Orchestrated provisioning and dependency resolution for supported AWS resources during stack operations.
  • Change sets to preview differences before applying updates to a stack.
  • Drift detection to compare deployed stack resources against the template and report differences.
  • StackSets to deploy and manage stacks across multiple AWS accounts and regions when configured.

✅ Top 5 Use Cases

  • Provisioning complete application environments (networking, compute, storage, IAM) from version-controlled templates to ensure consistent deployments.
  • Automating infrastructure changes in CI/CD pipelines where templates are validated, tested, and applied by automation tools.
  • Deploying baseline security and compliance configurations repeatedly across accounts and regions using StackSets.
  • Orchestrating resource creation that requires ordered dependencies and rollback on failure for predictable lifecycle management.
  • Implementing custom resource workflows where CloudFormation invokes Lambda-backed resources to extend provisioning logic.

🏗 Architecture Placement

CloudFormation is a control-plane orchestration service invoked by consoles, SDKs, CLI, or CI/CD systems; it reads templates (often stored in Amazon S3) and uses IAM roles to create, update, or delete resources in the caller's account and region. Stacks are managed at the account and regional scope although templates can define resources with global scope (for example IAM). CloudFormation itself does not host application workloads; it provisions and configures the resources that run workloads.

🎯 Commonly Used With

- AWS Identity and Access Management
- Amazon S3
- AWS Lambda
- Amazon EC2
- Amazon CloudWatch

🌍 5 Real-World Examples

  • A financial services team uses CloudFormation templates in a CI pipeline to provision test and staging VPCs and EC2 instances with identical network and security configurations for reproducible testing.
  • A healthcare provider standardizes deployments of a HIPAA-aligned environment by using CloudFormation to create audit-enabled logging resources and network controls from approved templates.
  • An online retailer uses StackSets to replicate a baseline monitoring and networking stack across multiple accounts used by different product teams for consistent operations.
  • A government IT unit uses CloudFormation to automate the provisioning of sandbox environments for developers, ensuring each environment follows the organisation's required guardrails.
  • A technology team automates blue-green infrastructure changes by generating change sets and executing stack updates through CI/CD with pre-deployment validation.

🎓 AWS Exam Clues

  • Use when you need declarative, versionable infrastructure defined as templates under source control.
  • Change sets are the mechanism to preview stack modifications before applying updates.
  • StackSets indicate a multi-account or multi-region deployment requirement managed centrally.
  • Drift detection is relevant when verifying that manually changed resources diverge from the declared template.
  • Custom resources backed by Lambda are used to extend CloudFormation capabilities where native resources are insufficient.

📝 Quick Revision

CloudFormation provides declarative infrastructure-as-code using JSON/YAML templates to provision and manage AWS resources. Use it for repeatable, version-controlled provisioning, but design IAM execution roles, template validation, parameters, and drift/rollback handling carefully in production.

🏷 Keywords

templates • stacks • StackSets • change sets • drift detection • nested stacks • custom resources • stack policy • parameters • outputs • macros • resource dependencies