Configuration Management and IaC · Topic 1 of 5

CloudFormation Templates and Stacks

Write reusable CloudFormation templates with parameters, conditions and intrinsic functions, and manage stacks with change sets, nesting and drift checks.

5 min

In a nutshell

Resources is the only required section.
Use change sets to preview updates, and check for Replacement before you run them.
Use Retain or Snapshot deletion policies to protect stateful resources.

What it is

AWS CloudFormation turns a template file into real resources. The template describes what you want, and CloudFormation works out the order, creates the resources and tracks them as a unit called a stack.

This is infrastructure as code (IaC): environments become repeatable, reviewable in version control and easy to delete. For the exam, know how to make templates reusable and how to change a live stack without surprises.

How it works

Template sections

Only Resources is required. The others make a template flexible.

Section	Purpose
Parameters	Values supplied at deploy time, with types, allowed values and defaults
Mappings	Fixed lookup tables, for example an AMI per Region
Conditions	Boolean tests that switch resources or properties on and off
Transform	Macros such as AWS SAM or AWS::Include
Resources	The things to create
Outputs	Values to show or to export to other stacks

A small example shows several parts working together.

AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  Env:
    Type: String
    AllowedValues: [dev, prod]
  LatestAmi:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /golden/web/latest
Conditions:
  IsProd: !Equals [!Ref Env, prod]
Resources:
  Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      VersioningConfiguration:
        Status: !If [IsProd, Enabled, Suspended]
Outputs:
  BucketArn:
    Value: !GetAtt Bucket.Arn
    Export:
      Name: !Sub "${AWS::StackName}-BucketArn"

Intrinsic functions

!Ref returns a parameter value or a resource identifier. !GetAtt returns an attribute such as an ARN. !Sub substitutes variables into a string, !Join and !Split build and break strings, !FindInMap reads a mapping, and !If picks a value by condition.

Pseudo parameters such as AWS::Region, AWS::AccountId and AWS::StackName need no declaration.

Use SSM parameter types or dynamic references to keep values out of the template. A reference like {{resolve:secretsmanager:prod/db:SecretString:password}} is resolved at deploy time.

Sharing between stacks

Method	How	Trade-off
Export and `Fn::ImportValue`	One stack exports an output, another imports it	Tight coupling: you cannot delete or change an export that is in use
Nested stacks	A parent stack creates children with `AWS::CloudFormation::Stack`	Reuse of one template, updated as one unit
SSM Parameter Store	A stack writes a parameter, others read it	Loose coupling, no dependency lock
Modules and the registry	Reusable resource bundles in a registry	Central governance of patterns

Changing a stack safely

A change set previews what an update will do before you run it. For each resource it shows add, modify or remove, and whether the change replaces the resource.

aws cloudformation create-change-set --stack-name web-prod \
  --change-set-name review1 --template-body file://template.yaml \
  --parameters ParameterKey=Env,ParameterValue=prod
aws cloudformation execute-change-set --stack-name web-prod --change-set-name review1
aws cloudformation deploy --template-file template.yaml --stack-name web-prod \
  --capabilities CAPABILITY_NAMED_IAM

The deploy command creates and executes a change set for you. Templates that create IAM resources need CAPABILITY_IAM or CAPABILITY_NAMED_IAM, and templates with macros need CAPABILITY_AUTO_EXPAND.

Protecting data and recovery

DeletionPolicy takes Delete, Retain or Snapshot (for resources that support snapshots, such as databases and volumes).
UpdateReplacePolicy does the same when an update replaces a resource.
Termination protection blocks accidental deletion of the whole stack.
Drift detection finds resources changed outside CloudFormation.

aws cloudformation detect-stack-drift --stack-name web-prod

Rollback behavior

If a create fails, the stack rolls back and ends in ROLLBACK_COMPLETE, which you can only delete. If an update fails, CloudFormation reverts to the last good state. When that revert itself fails the stack lands in UPDATE_ROLLBACK_FAILED, and you continue the rollback, optionally skipping the stuck resources.

What to remember for the exam

Resources is the only required section.
Use change sets to preview updates, and check for Replacement before you run them.
Use Retain or Snapshot deletion policies to protect stateful resources.
Exports cannot be deleted while another stack imports them.
Nested stacks reuse a template; SSM parameters give loose coupling.
IAM resources need a capability acknowledgement on deploy.
Dynamic references fetch secrets and parameters at deploy time, so no plain text appears in the template.
A stack in ROLLBACK_COMPLETE cannot be updated, only deleted and recreated.
Drift detection reports manual changes; it does not fix them.

Exam tip

When a question asks how to deploy the same template across environments, the answer is parameters, mappings and conditions, not a separate copy of the template per environment.

Common mistakes

Hardcoding AMI IDs. They differ by Region and go stale, so use a Mapping or an SSM parameter type.

Putting secrets in parameters. Parameter values can appear in the console, so use a dynamic reference or NoEcho with care.

Editing resources by hand. Manual changes create drift, and the next stack update can overwrite them.

Relying on exports for everything. Tight export chains block updates in the producing stack.

Watch out

A property change that triggers replacement of a database deletes the old one unless DeletionPolicy and UpdateReplacePolicy protect it, so read the change set before executing.

Check yourself

How do you preview whether an update will replace a resource?
Create a change set and read the Replacement column for that resource.
What is a loosely coupled alternative to exports?
Write values to SSM Parameter Store and read them from other stacks.
What keeps a database snapshot when its stack is deleted?
A DeletionPolicy of Snapshot on the resource.

Topic 1 of 5 in Configuration Management and IaC

Test yourself on Configuration Management and IaC

The full AWS DOP-C02 question bank has 844 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.