AWS CloudFormation
Infrastructure as code
Describe infrastructure in YAML/JSON templates; CloudFormation creates, updates and deletes all resources according to the template (stack).
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Managed by AWS
- In examsSAA · DVA · SOA
Think of it asLike construction blueprints: hand over the blueprint and you get exactly that building, identical no matter how many times you build it.
Where does CloudFormation fit?
CloudFormationCloudFormation calls
A real example, step by step
- Every time the team builds a test environment, someone clicks through dozens of console steps and something is always missing.
- You write a YAML template describing the VPC, ALB, Auto Scaling group and database.
- You create a stack from the template; CloudFormation creates the resources in the right dependency order.
- To change the instance size, you edit the template, review a change set to see what will change, then apply it.
- If something fails midway, the stack rolls back; deleting the stack cleans up everything, except the database, which DeletionPolicy Retain keeps.
When to use it
✓ Use it when
Creating repeatable environments (dev/staging/prod), reviewing infrastructure as code.
✗ Avoid it when
You prefer writing in a programming language → CDK (which still generates CloudFormation).
Common uses
- Create identical dev / staging / prod environments
- Infrastructure as code, reviewed via pull requests
- Deploy serverless with SAM or CDK
- StackSets for multiple accounts and Regions
CloudFormation, Systems Manager or Organizations?
| CloudFormation |  Systems Manager |  Organizations | |
|---|---|---|---|
| What it does | Creates and updates infrastructure from templates | Operates machines: run commands, patch, access | Manages many AWS accounts |
| Works on | AWS resources (VPC, EC2, RDS…) | EC2 and on-premises machines | Accounts and policies |
| Repeatable | Yes, same template, same infrastructure | Yes, via documents and runbooks | Yes, via OUs and SCPs |
| Cost | Free for AWS resources | Mostly free | Free |
What does it cost?
- Pricing model: Free for AWS resources; only charged when using third-party extensions (~$0.0009/operation).
- Free tier: Free.
No pricing traps; the risk is that deleting a stack also deletes its resources (use DeletionPolicy to keep them).
Deploy the same infrastructure to many accounts/regions → StackSets. Preview changes → change sets. Keep a database when the stack is deleted → DeletionPolicy: Retain. Detect manual changes outside the template → drift detection. The only required template section is Resources.
Try real exam questions
1An administrator is using Amazon CloudFormation to deploy a three tier web application that consists of a web tier and application tier that will utilize Amazon DynamoDB for storage. When creating the CloudFormation template, which of the following would allow the application instance access to the DynamoDB tables without exposing API credentials?
- ACreate an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and associate the Role to the application instances by referencing an instance profile.
- BUse the Parameter section in the Cloud Formation template to have the user input Access and Secret Keys from an already created IAM user that has the permissions required to read and write from the required DynamoDB table.
- CCreate an Identity and Access Management Role that has the required permissions to read and write from the required DynamoDB table and reference the Role in the instance profile property of the application instance.
- DCreate an identity and Access Management user in the CloudFormation template that has permissions to read and write from the required DynamoDB table, use the GetAtt function to retrieve the Access and secret keys and pass them to the application instance through user-data.
Show answer
Correct answer: C
Create an IAM role with read/write permissions on the DynamoDB table and reference it through the instance profile property of the instance in the template. Never put access keys in parameters or generate them in the template.
2You need to create a JSON-formatted text file for AWS CloudFormation. This is your first template and the only thing you know is that the templates include several major sections but there is only one that is required for it to work. What is the only section required?
- AMappings.
- BOutputs.
- CResources.
- DConditions.
Show answer
Correct answer: C
Resources is the only required section of a CloudFormation template; it declares at least one resource. Mappings, Outputs and Conditions are optional.
Frequently asked questions
How does CloudFormation compare with CDK and Terraform?
CloudFormation describes infrastructure in YAML or JSON templates. CDK lets you write TypeScript, Python or Java that generates CloudFormation templates. Terraform is a HashiCorp tool that uses the HCL language and supports many cloud providers.
What are change sets and drift detection for?
A change set previews which resources will be created, modified or replaced before you update a stack. Drift detection finds resources that were changed manually outside CloudFormation and no longer match the template.
Does CloudFormation cost anything?
There is no charge for AWS resources; you pay only for the resources your stacks create. Charges apply only to third-party resources or hooks beyond the free allowance.
What do AWS exams ask about CloudFormation?
StackSets for deploying across accounts and regions, change sets, DeletionPolicy to keep a database when a stack is deleted, rollback on failure, parameters and outputs shared between stacks, and cfn-init or user data to configure EC2.