5.4 CloudFormation and Infrastructure as Code

Quick Answer: CloudFormation is AWS's declarative infrastructure-as-code engine using YAML/JSON templates. A stack is the unit of deployment; StackSets roll a stack out across many accounts and Regions; Change Sets preview changes before you apply them; drift detection flags manual out-of-band edits. CDK lets you author IaC in programming languages, and SAM is a CloudFormation extension tuned for serverless.

Template Anatomy

Intrinsic functions glue templates together: Ref returns a resource's id or a parameter value, Fn::GetAtt pulls an attribute (such as an ALB DNS name), Fn::Sub interpolates variables, and Fn::ImportValue consumes another stack's exported output.

Stacks, StackSets, Change Sets, and Drift

By default a failed create or update rolls back automatically to the last known-good state, preventing half-built infrastructure. A Change Set is the safe way to touch production: it surfaces destructive replacements (some property changes force resource re-creation) before you commit.

CloudFormation vs. CDK vs. Terraform, and SAM

AWS SAM (Serverless Application Model) is a thin CloudFormation extension: shorthand for Lambda, API Gateway, DynamoDB, and Step Functions, plus the SAM CLI for local invoke and debug. SAM templates transform into ordinary CloudFormation at deploy time.

On the Exam: "Deploy identical infrastructure to 15 accounts across 3 Regions" → StackSets. "Preview changes before updating production" → Change Set. "Detect manual changes to managed resources" → drift detection. "Author infrastructure in Python" → CDK. "Simplify a serverless deployment" → SAM.

Deletion Protection, Retention, and Stack Policies

Production CloudFormation usage hinges on a few safety controls the exam likes to probe:

• DeletionPolicy on a resource controls what happens when the resource is removed or the stack is deleted. Retain keeps the resource (common for data stores), Snapshot takes a final snapshot (valid for RDS, EBS, ElastiCache, Redshift), and Delete (the default for most resources) removes it. An S3 bucket or RDS instance you must not lose should carry DeletionPolicy: Retain.
• Termination protection on the stack blocks accidental DeleteStack calls until it is disabled.
• Stack policies are JSON documents that protect specific resources from updates, preventing, for example, an accidental replacement of a production database during an unrelated update.

Reuse, Modularity, and Multi-Account Patterns

Large environments avoid one monolithic template. Nested stacks factor reusable pieces (a standard VPC, a logging stack) into child templates referenced by a parent. Cross-stack references export an output (Export) from one stack and Fn::ImportValue it elsewhere — useful for sharing a VPC ID across many application stacks. For organization-wide rollout, StackSets integrate with AWS Organizations so a new account automatically receives baseline stacks (guardrails, IAM roles, logging).

Common Traps

Knowing that CDK and SAM both compile down to CloudFormation is the key conceptual takeaway: they change the authoring experience, not the underlying provisioning and state-management engine, which remains CloudFormation across all of them.

Parameters, Pseudo-Parameters, and Reuse Mechanics

Templates become reusable through Parameters (typed inputs like String, Number, or AWS-specific types such as AWS::EC2::KeyPair::KeyName that the console validates against your account) and Mappings (static lookups, classically an AMI ID per Region). Pseudo-parameters such as AWS::Region, AWS::AccountId, and AWS::StackName are supplied automatically and let one template adapt across Regions and accounts without editing.

For sensitive inputs, mark a parameter NoEcho: true so its value is masked in the console and events, and reference values stored in AWS Systems Manager Parameter Store or Secrets Manager rather than hard-coding credentials. Conditions combined with Fn::If let a single template create a small footprint in dev and a full Multi-AZ footprint in prod from one parameter — a frequently tested way to keep environments consistent while varying scale.

Together these features mean one well-authored template can drive an entire fleet of stacks through StackSets, each parameterized per account and Region while sharing identical, version-controlled logic.