Complete Guide to AWS CloudFormation: Infrastructure as Code Made Simple#

AWS CloudFormation is a service that helps you model and set up your AWS resources so that you can spend less time managing those resources and more time focusing on your applications. You create a template that describes all the AWS resources you want, and CloudFormation takes care of provisioning and configuring those resources for you.

Overview#

CloudFormation enables Infrastructure as Code (IaC), allowing you to define your cloud infrastructure in JSON or YAML templates. This provides version control, repeatability, and consistency across environments.

Key Benefits#

1. Infrastructure as Code#

Version control your infrastructure
Track changes over time
Peer review infrastructure changes
Rollback to previous versions

2. Consistency and Repeatability#

Deploy identical environments
Reduce human error
Standardize deployments
Ensure compliance

3. Automation and Efficiency#

Automate resource provisioning
Integrate with CI/CD pipelines
Reduce manual intervention
Scale infrastructure quickly

4. Cost Management#

Delete entire stacks to clean up resources
Estimate costs before deployment
Tag resources for cost allocation
Implement cost controls

Core Concepts#

1. Templates#

CloudFormation templates are JSON or YAML files that define your infrastructure:

1
AWSTemplateFormatVersion: '2010-09-09'
2
Description: 'Simple EC2 instance template'
3

4
Parameters:
5
  InstanceType:
6
    Type: String
7
    Default: t3.micro
8
    Description: EC2 instance type
9

10
Resources:
11
  MyEC2Instance:
12
    Type: AWS::EC2::Instance
13
    Properties:
14
      InstanceType: !Ref InstanceType
15
      ImageId: ami-0c02fb55956c7d316
16
      KeyName: my-key-pair
17

18
Outputs:
19
  InstanceId:
20
    Description: Instance ID
21
    Value: !Ref MyEC2Instance

2. Stacks#

A stack is a collection of AWS resources that you can manage as a single unit:

1
# Create stack
2
aws cloudformation create-stack \
3
  --stack-name my-web-app \
4
  --template-body file://template.yaml \
5
  --parameters ParameterKey=InstanceType,ParameterValue=t3.small
6

7
# Update stack
8
aws cloudformation update-stack \
9
  --stack-name my-web-app \
10
  --template-body file://updated-template.yaml
11

12
# Delete stack
13
aws cloudformation delete-stack --stack-name my-web-app

3. Change Sets#

Preview changes before applying them:

1
# Create change set
2
aws cloudformation create-change-set \
3
  --stack-name my-web-app \
4
  --template-body file://new-template.yaml \
5
  --change-set-name my-changeset
6

7
# Describe changes
8
aws cloudformation describe-change-set \
9
  --stack-name my-web-app \
10
  --change-set-name my-changeset
11

12
# Execute change set
13
aws cloudformation execute-change-set \
14
  --stack-name my-web-app \
15
  --change-set-name my-changeset

Template Structure#

1. Complete Template Format#

1
AWSTemplateFormatVersion: '2010-09-09'
2
Description: 'Template description'
3

4
Metadata:
5
  AWS::CloudFormation::Interface:
6
    ParameterGroups:
7
      - Label:
8
          default: "Network Configuration"
9
        Parameters:
10
          - VpcCIDR
11
          - PublicSubnetCIDR
12

13
Parameters:
14
  VpcCIDR:
15
    Type: String
16
    Default: 10.0.0.0/16
17
    Description: CIDR block for VPC
18

19
Mappings:
20
  RegionMap:
21
    us-east-1:
22
      AMI: ami-0c02fb55956c7d316
23
    us-west-2:
24
      AMI: ami-0892d3c7ee96c0bf7
25

26
Conditions:
27
  CreateProdResources: !Equals [!Ref Environment, production]
28

29
Resources:
30
  MyVPC:
31
    Type: AWS::EC2::VPC
32
    Properties:
33
      CidrBlock: !Ref VpcCIDR
34
      EnableDnsHostnames: true
35
      EnableDnsSupport: true
36

37
Outputs:
38
  VPCId:
39
    Description: VPC ID
40
    Value: !Ref MyVPC
41
    Export:
42
      Name: !Sub "${AWS::StackName}-VPC-ID"

2. Intrinsic Functions#

1
# Reference parameters and resources
2
InstanceType: !Ref InstanceTypeParameter
3

4
# Join strings
5
UserData: !Base64
6
  !Sub |
7
    #!/bin/bash
8
    echo "Hello from ${AWS::StackName}"
9

10
# Get attribute from resource
11
WebsiteURL: !GetAtt LoadBalancer.DNSName
12

13
# Conditional values
14
InstanceType: !If [CreateProdResources, m5.large, t3.micro]
15

16
# Find in map
17
ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", AMI]
18

19
# Split and select
20
AvailabilityZone: !Select [0, !GetAZs ""]

Common Resource Types#

1. VPC and Networking#

1
Resources:
2
  VPC:
3
    Type: AWS::EC2::VPC
4
    Properties:
5
      CidrBlock: 10.0.0.0/16
6
      EnableDnsHostnames: true
7

8
  PublicSubnet:
9
    Type: AWS::EC2::Subnet
10
    Properties:
11
      VpcId: !Ref VPC
12
      CidrBlock: 10.0.1.0/24
13
      AvailabilityZone: !Select [0, !GetAZs ""]
14

15
  InternetGateway:
16
    Type: AWS::EC2::InternetGateway
17

18
  AttachGateway:
19
    Type: AWS::EC2::VPCGatewayAttachment
20
    Properties:
21
      VpcId: !Ref VPC
22
      InternetGatewayId: !Ref InternetGateway
23

24
  SecurityGroup:
25
    Type: AWS::EC2::SecurityGroup
26
    Properties:
27
      GroupDescription: Web server security group
28
      VpcId: !Ref VPC
29
      SecurityGroupIngress:
30
        - IpProtocol: tcp
31
          FromPort: 80
32
          ToPort: 80
33
          CidrIp: 0.0.0.0/0

2. EC2 Instances#

1
Resources:
2
  WebServer:
3
    Type: AWS::EC2::Instance
4
    Properties:
5
      InstanceType: !Ref InstanceType
6
      ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", AMI]
7
      KeyName: !Ref KeyPairName
8
      SubnetId: !Ref PublicSubnet
9
      SecurityGroupIds:
10
        - !Ref WebServerSecurityGroup
11
      UserData: !Base64
12
        !Sub |
13
          #!/bin/bash
14
          yum update -y
15
          yum install -y httpd
16
          systemctl start httpd
17
          systemctl enable httpd
18
          echo "<h1>Hello from CloudFormation</h1>" > /var/www/html/index.html
19

20
  ElasticIP:
21
    Type: AWS::EC2::EIP
22
    Properties:
23
      InstanceId: !Ref WebServer
24
      Domain: vpc

3. Auto Scaling#

1
Resources:
2
  LaunchTemplate:
3
    Type: AWS::EC2::LaunchTemplate
4
    Properties:
5
      LaunchTemplateName: !Sub "${AWS::StackName}-launch-template"
6
      LaunchTemplateData:
7
        ImageId: !FindInMap [RegionMap, !Ref "AWS::Region", AMI]
8
        InstanceType: !Ref InstanceType
9
        SecurityGroupIds:
10
          - !Ref WebServerSecurityGroup
11
        UserData: !Base64
12
          !Sub |
13
            #!/bin/bash
14
            # Install and configure application
15

16
  AutoScalingGroup:
17
    Type: AWS::AutoScaling::AutoScalingGroup
18
    Properties:
19
      VPCZoneIdentifier:
20
        - !Ref PublicSubnet1
21
        - !Ref PublicSubnet2
22
      LaunchTemplate:
23
        LaunchTemplateId: !Ref LaunchTemplate
24
        Version: !GetAtt LaunchTemplate.LatestVersionNumber
25
      MinSize: 1
26
      MaxSize: 3
27
      DesiredCapacity: 2
28
      TargetGroupARNs:
29
        - !Ref TargetGroup

4. RDS Database#

1
Resources:
2
  DBSubnetGroup:
3
    Type: AWS::RDS::DBSubnetGroup
4
    Properties:
5
      DBSubnetGroupDescription: Subnet group for RDS database
6
      SubnetIds:
7
        - !Ref PrivateSubnet1
8
        - !Ref PrivateSubnet2
9

10
  Database:
11
    Type: AWS::RDS::DBInstance
12
    Properties:
13
      DBInstanceIdentifier: !Sub "${AWS::StackName}-database"
14
      DBInstanceClass: db.t3.micro
15
      Engine: mysql
16
      EngineVersion: '8.0'
17
      MasterUsername: admin
18
      MasterUserPassword: !Ref DBPassword
19
      AllocatedStorage: 20
20
      DBSubnetGroupName: !Ref DBSubnetGroup
21
      VPCSecurityGroups:
22
        - !Ref DatabaseSecurityGroup

Advanced Features#

1. Nested Stacks#

1
# Parent template
2
Resources:
3
  NetworkStack:
4
    Type: AWS::CloudFormation::Stack
5
    Properties:
6
      TemplateURL: https://s3.amazonaws.com/my-bucket/network.yaml
7
      Parameters:
8
        VpcCIDR: 10.0.0.0/16
9

10
  ApplicationStack:
11
    Type: AWS::CloudFormation::Stack
12
    Properties:
13
      TemplateURL: https://s3.amazonaws.com/my-bucket/application.yaml
14
      Parameters:
15
        VPCId: !GetAtt NetworkStack.Outputs.VPCId

2. Stack Sets#

Deploy stacks across multiple accounts and regions:

1
# Create stack set
2
aws cloudformation create-stack-set \
3
  --stack-set-name my-cross-account-stack \
4
  --template-body file://template.yaml \
5
  --capabilities CAPABILITY_NAMED_IAM
6

7
# Deploy to accounts and regions
8
aws cloudformation create-stack-instances \
9
  --stack-set-name my-cross-account-stack \
10
  --accounts 123456789012 234567890123 \
11
  --regions us-east-1 us-west-2

3. Custom Resources#

1
Resources:
2
  CustomResource:
3
    Type: AWS::CloudFormation::CustomResource
4
    Properties:
5
      ServiceToken: !GetAtt CustomResourceLambda.Arn
6
      CustomProperty: CustomValue
7

8
  CustomResourceLambda:
9
    Type: AWS::Lambda::Function
10
    Properties:
11
      Handler: index.handler
12
      Role: !GetAtt LambdaExecutionRole.Arn
13
      Code:
14
        ZipFile: |
15
          import json
16
          import boto3
17
          import urllib3
18

19
          def handler(event, context):
20
              # Handle create, update, delete operations
21
              response_url = event['ResponseURL']
22
              # Process the request and send response
23
              return send_response(response_url, event, context, "SUCCESS", {})
24
      Runtime: python3.9

Best Practices#

1. Template Organization#

1
# Use clear naming conventions
2
Resources:
3
  WebServerInstance:
4
    Type: AWS::EC2::Instance
5
    # Clear, descriptive names
6

7
  WebServerSecurityGroup:
8
    Type: AWS::EC2::SecurityGroup
9
    # Consistent naming pattern
10

11
# Use parameters for flexibility
12
Parameters:
13
  Environment:
14
    Type: String
15
    AllowedValues: [dev, staging, prod]
16

17
  InstanceType:
18
    Type: String
19
    Default: t3.micro
20
    AllowedValues: [t3.micro, t3.small, t3.medium]

2. Security Best Practices#

1
# Use least privilege IAM roles
2
WebServerRole:
3
  Type: AWS::IAM::Role
4
  Properties:
5
    AssumeRolePolicyDocument:
6
      Statement:
7
        - Effect: Allow
8
          Principal:
9
            Service: ec2.amazonaws.com
10
          Action: sts:AssumeRole
11
    ManagedPolicyArns:
12
      - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
13

14
# Encrypt sensitive data
15
Database:
16
  Type: AWS::RDS::DBInstance
17
  Properties:
18
    StorageEncrypted: true
19
    KmsKeyId: !Ref DatabaseKMSKey
20

21
# Use Secrets Manager for passwords
22
DatabaseSecret:
23
  Type: AWS::SecretsManager::Secret
24
  Properties:
25
    GenerateSecretString:
26
      SecretStringTemplate: '{"username": "admin"}'
27
      GenerateStringKey: password
28
      PasswordLength: 16
29
      ExcludeCharacters: '"@/\'

3. Error Handling#

1
# Use rollback configuration
2
Resources:
3
  AutoScalingGroup:
4
    Type: AWS::AutoScaling::AutoScalingGroup
5
    CreationPolicy:
6
      ResourceSignal:
7
        Count: 2
8
        Timeout: PT10M
9
    UpdatePolicy:
10
      AutoScalingRollingUpdate:
11
        MinInstancesInService: 1
12
        MaxBatchSize: 1
13
        WaitOnResourceSignals: true
14
        PauseTime: PT10M
15

16
# Use DeletionPolicy for critical resources
17
Database:
18
  Type: AWS::RDS::DBInstance
19
  DeletionPolicy: Snapshot
20
  Properties:
21
    # Database properties

Deployment Strategies#

1. Blue/Green Deployment#

1
Parameters:
2
  BlueGreenDeployment:
3
    Type: String
4
    Default: blue
5
    AllowedValues: [blue, green]
6

7
Conditions:
8
  IsBlueDeployment: !Equals [!Ref BlueGreenDeployment, blue]
9

10
Resources:
11
  BlueTargetGroup:
12
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
13
    Condition: IsBlueDeployment
14
    # Blue environment configuration
15

16
  GreenTargetGroup:
17
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
18
    Condition: !Not [!Condition IsBlueDeployment]
19
    # Green environment configuration

2. Multi-Environment Templates#

1
Mappings:
2
  EnvironmentMap:
3
    dev:
4
      InstanceType: t3.micro
5
      MinSize: 1
6
      MaxSize: 2
7
    prod:
8
      InstanceType: t3.medium
9
      MinSize: 2
10
      MaxSize: 6
11

12
Resources:
13
  AutoScalingGroup:
14
    Type: AWS::AutoScaling::AutoScalingGroup
15
    Properties:
16
      MinSize: !FindInMap [EnvironmentMap, !Ref Environment, MinSize]
17
      MaxSize: !FindInMap [EnvironmentMap, !Ref Environment, MaxSize]

Monitoring and Troubleshooting#

1. CloudFormation Events#

1
# Monitor stack events
2
aws cloudformation describe-stack-events --stack-name my-stack
3

4
# Get stack status
5
aws cloudformation describe-stacks --stack-name my-stack

2. Stack Drift Detection#

1
# Detect drift
2
aws cloudformation detect-stack-drift --stack-name my-stack
3

4
# Get drift results
5
aws cloudformation describe-stack-drift-detection-status \
6
  --stack-drift-detection-id drift-id

3. Troubleshooting Failed Deployments#

1
# Add detailed logging to user data
2
UserData: !Base64
3
  !Sub |
4
    #!/bin/bash
5
    exec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1
6
    echo "Starting user data execution"
7

8
    # Your commands here
9
    yum update -y
10

11
    # Signal success/failure
12
    /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} \
13
      --resource AutoScalingGroup --region ${AWS::Region}

Integration with CI/CD#

1. GitHub Actions#

1
name: Deploy CloudFormation Stack
2
on:
3
  push:
4
    branches: [main]
5

6
jobs:
7
  deploy:
8
    runs-on: ubuntu-latest
9
    steps:
10
      - uses: actions/checkout@v2
11
      - uses: aws-actions/configure-aws-credentials@v1
12
        with:
13
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
14
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
15
          aws-region: us-east-1
16

17
      - name: Deploy CloudFormation Stack
18
        run: |
19
          aws cloudformation deploy \
20
            --template-file template.yaml \
21
            --stack-name my-application \
22
            --parameter-overrides Environment=prod \
23
            --capabilities CAPABILITY_IAM

2. AWS CodePipeline#

1
Resources:
2
  CodePipeline:
3
    Type: AWS::CodePipeline::Pipeline
4
    Properties:
5
      RoleArn: !GetAtt CodePipelineRole.Arn
6
      Stages:
7
        - Name: Source
8
          Actions:
9
            - Name: SourceAction
10
              ActionTypeId:
11
                Category: Source
12
                Owner: AWS
13
                Provider: S3
14
                Version: 1
15
        - Name: Deploy
16
          Actions:
17
            - Name: CreateChangeSet
18
              ActionTypeId:
19
                Category: Deploy
20
                Owner: AWS
21
                Provider: CloudFormation
22
                Version: 1
23
              Configuration:
24
                ActionMode: CHANGE_SET_REPLACE
25
                StackName: my-stack
26
                ChangeSetName: my-changeset
27
                TemplatePath: SourceOutput::template.yaml

Cost Optimization#

1. Resource Tagging#

1
Resources:
2
  EC2Instance:
3
    Type: AWS::EC2::Instance
4
    Properties:
5
      Tags:
6
        - Key: Environment
7
          Value: !Ref Environment
8
        - Key: Project
9
          Value: !Ref ProjectName
10
        - Key: CostCenter
11
          Value: Engineering

2. Lifecycle Policies#

1
# S3 bucket with lifecycle policy
2
S3Bucket:
3
  Type: AWS::S3::Bucket
4
  Properties:
5
    LifecycleConfiguration:
6
      Rules:
7
        - Id: DeleteOldVersions
8
          Status: Enabled
9
          NoncurrentVersionExpirationInDays: 30
10
        - Id: TransitionToIA
11
          Status: Enabled
12
          TransitionInDays: 30
13
          StorageClass: STANDARD_IA

Newsletter