1. Overview

AWS CloudFormation is a service that helps you model and set up your AWS resources using Infrastructure as Code (IaC). You create templates that describe your AWS resources, and CloudFormation provisions and configures those resources for you.

Key Characteristics

  • Infrastructure as Code - Define infrastructure in JSON/YAML templates
  • Declarative - Specify what you want, not how to create it
  • Version controlled - Templates can be stored in source control
  • Repeatable - Create identical environments consistently
  • Rollback capable - Automatic rollback on failure
  • Change management - Preview changes before applying
  • Cross-region - Deploy to multiple regions

What Problem Does It Solve?

  • Eliminates manual resource provisioning
  • Ensures consistent infrastructure deployment
  • Enables version control of infrastructure
  • Provides automated rollback on failures
  • Manages resource dependencies automatically
  • Enables infrastructure replication across environments
  • Supports compliance and governance requirements

2. Core Concepts

Template

  • JSON or YAML file describing AWS resources
  • Declarative specification of infrastructure
  • Version controlled and reusable
  • Maximum size: 460,800 bytes (450 KB)

Stack

  • Collection of AWS resources created from template
  • Unit of deployment and management
  • Has lifecycle (create, update, delete)
  • Resources created/updated/deleted together

Change Set

  • Preview of changes before stack update
  • Shows what will be added, modified, or deleted
  • Allows review before execution
  • Can be executed or discarded

Parameters

  • Input values for templates
  • Make templates reusable and flexible
  • Can have default values and constraints
  • Referenced using !Ref or Ref function

Outputs

  • Values returned from stack
  • Can be exported for use by other stacks
  • Useful for sharing resource information
  • Referenced using !ImportValue function

Resources

  • AWS resources to be created
  • Only required section in template
  • Each resource has Type and Properties
  • Can reference other resources

Mappings

  • Static lookup tables in template
  • Key-value pairs for conditional logic
  • Often used for AMI IDs by region
  • Referenced using !FindInMap function

Conditions

  • Control resource creation based on parameters
  • Boolean logic (equals, not equals, and, or)
  • Applied to resources and outputs
  • Evaluated at stack creation/update time

3. Template Structure

Basic Template Structure (YAML)

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Sample CloudFormation template'

Parameters:
  EnvironmentName:
    Type: String
    Default: Development
    AllowedValues:
      - Development
      - Staging
      - Production
    Description: Environment name

  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
    Description: EC2 instance type

Mappings:
  RegionMap:
    us-east-1:
      AMI: ami-0abcdef1234567890
    us-west-2:
      AMI: ami-0fedcba0987654321

Conditions:
  IsProduction: !Equals [!Ref EnvironmentName, Production]
  CreateLargeInstance: !Equals [!Ref InstanceType, t3.medium]

Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-VPC'

  MySubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-Subnet'

  MySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for web server
      VpcId: !Ref MyVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

  MyInstance:
    Type: AWS::EC2::Instance
    Condition: IsProduction
    Properties:
      ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]
      InstanceType: !Ref InstanceType
      SubnetId: !Ref MySubnet
      SecurityGroupIds:
        - !Ref MySecurityGroup
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-Instance'

Outputs:
  VPCId:
    Description: VPC ID
    Value: !Ref MyVPC
    Export:
      Name: !Sub '${EnvironmentName}-VPC-ID'

  InstanceId:
    Description: Instance ID
    Value: !Ref MyInstance
    Condition: IsProduction

  WebsiteURL:
    Description: Website URL
    Value: !Sub 'http://${MyInstance.PublicDnsName}'
    Condition: IsProduction

Template Structure (JSON)

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Sample CloudFormation template",
  "Parameters": {
    "InstanceType": {
      "Type": "String",
      "Default": "t3.micro",
      "AllowedValues": ["t3.micro", "t3.small", "t3.medium"]
    }
  },
  "Resources": {
    "MyInstance": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "ImageId": "ami-0abcdef1234567890",
        "InstanceType": {"Ref": "InstanceType"}
      }
    }
  },
  "Outputs": {
    "InstanceId": {
      "Value": {"Ref": "MyInstance"}
    }
  }
}

4. Intrinsic Functions

Common Functions

!Ref (Reference)

# Reference parameter
InstanceType: !Ref InstanceTypeParameter

# Reference resource (returns resource ID)
VpcId: !Ref MyVPC

!GetAtt (Get Attribute)

# Get resource attribute
PublicIP: !GetAtt MyInstance.PublicIp
DNSName: !GetAtt MyLoadBalancer.DNSName

!Sub (Substitute)

# String substitution
Name: !Sub '${EnvironmentName}-${AWS::Region}-bucket'
UserData: !Sub |
  #!/bin/bash
  echo "Instance ID: ${AWS::InstanceId}" > /tmp/instance-info

!Join

# Join strings with delimiter
SecurityGroupIds: !Join
  - ','
  - - !Ref SecurityGroup1
    - !Ref SecurityGroup2

!Select

# Select item from list by index
AvailabilityZone: !Select [0, !GetAZs '']

!GetAZs

# Get availability zones for region
AvailabilityZones: !GetAZs ''
SpecificRegionAZs: !GetAZs 'us-west-2'

!FindInMap

# Find value in mapping
ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]

!ImportValue

# Import exported value from another stack
VpcId: !ImportValue NetworkStack-VPC-ID

!If (Conditional)

# Conditional value assignment
InstanceType: !If [IsProduction, t3.large, t3.micro]

!Equals, !And, !Or, !Not

Conditions:
  IsProduction: !Equals [!Ref Environment, Production]
  IsLargeInstance: !Equals [!Ref InstanceType, t3.large]
  CreateProdLarge: !And
    - !Condition IsProduction
    - !Condition IsLargeInstance
  NotDevelopment: !Not [!Equals [!Ref Environment, Development]]

5. Stack Operations

Stack Lifecycle

Create Stack

aws cloudformation create-stack \
  --stack-name my-stack \
  --template-body file://template.yaml \
  --parameters ParameterKey=InstanceType,ParameterValue=t3.small \
  --capabilities CAPABILITY_IAM

Update Stack

aws cloudformation update-stack \
  --stack-name my-stack \
  --template-body file://updated-template.yaml \
  --parameters ParameterKey=InstanceType,ParameterValue=t3.medium

Delete Stack

aws cloudformation delete-stack --stack-name my-stack

Change Sets

Create Change Set

aws cloudformation create-change-set \
  --stack-name my-stack \
  --change-set-name my-changeset \
  --template-body file://updated-template.yaml \
  --parameters ParameterKey=InstanceType,ParameterValue=t3.medium

Execute Change Set

aws cloudformation execute-change-set \
  --change-set-name my-changeset \
  --stack-name my-stack

Stack Policies

{
  "Statement": [
    {
      "Effect": "Deny",
      "Principal": "*",
      "Action": "Update:Delete",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ResourceType": ["AWS::RDS::DBInstance"]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": "*",
      "Action": "Update:*",
      "Resource": "*"
    }
  ]
}

6. Nested Stacks & Cross-Stack References

Nested Stacks

Resources:
  NetworkStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-bucket/network-template.yaml
      Parameters:
        VpcCidr: 10.0.0.0/16
        Environment: !Ref Environment
      TimeoutInMinutes: 10

  ApplicationStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: NetworkStack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-bucket/app-template.yaml
      Parameters:
        VpcId: !GetAtt NetworkStack.Outputs.VpcId
        SubnetId: !GetAtt NetworkStack.Outputs.SubnetId

Cross-Stack References

Export from Stack A

Outputs:
  VPCId:
    Description: VPC ID
    Value: !Ref MyVPC
    Export:
      Name: !Sub '${AWS::StackName}-VPC-ID'

Import in Stack B

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      SubnetId: !ImportValue NetworkStack-Subnet-ID
      SecurityGroupIds:
        - !ImportValue NetworkStack-SecurityGroup-ID

7. IAM Roles & Permissions

CloudFormation Service Role

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:*",
        "s3:*",
        "iam:*",
        "rds:*",
        "lambda:*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateStack",
        "cloudformation:UpdateStack",
        "cloudformation:DeleteStack",
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResources"
      ],
      "Resource": "*"
    }
  ]
}

User Permissions for CloudFormation

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateStack",
        "cloudformation:UpdateStack",
        "cloudformation:DeleteStack",
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResources",
        "cloudformation:CreateChangeSet",
        "cloudformation:ExecuteChangeSet",
        "cloudformation:DescribeChangeSet",
        "cloudformation:DeleteChangeSet"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "iam:PassRole",
      "Resource": "arn:aws:iam::123456789012:role/CloudFormationServiceRole"
    }
  ]
}

Resource-Level Permissions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "cloudformation:*",
      "Resource": [
        "arn:aws:cloudformation:us-east-1:123456789012:stack/MyApp-*/*",
        "arn:aws:cloudformation:us-east-1:123456789012:stackset/MyApp-*:*"
      ]
    }
  ]
}

8. Advanced Features

Custom Resources

Resources:
  CustomResource:
    Type: AWS::CloudFormation::CustomResource
    Properties:
      ServiceToken: !GetAtt CustomResourceFunction.Arn
      CustomProperty1: Value1
      CustomProperty2: Value2

  CustomResourceFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.9
      Handler: index.handler
      Code:
        ZipFile: |
          import json
          import boto3
          import cfnresponse
          
          def handler(event, context):
              try:
                  if event['RequestType'] == 'Create':
                      # Custom create logic
                      response_data = {'Message': 'Resource created'}
                  elif event['RequestType'] == 'Update':
                      # Custom update logic
                      response_data = {'Message': 'Resource updated'}
                  elif event['RequestType'] == 'Delete':
                      # Custom delete logic
                      response_data = {'Message': 'Resource deleted'}
                  
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data)
              except Exception as e:
                  cfnresponse.send(event, context, cfnresponse.FAILED, {})

Stack Sets

# Create stack set
aws cloudformation create-stack-set \
  --stack-set-name my-stackset \
  --template-body file://template.yaml \
  --capabilities CAPABILITY_IAM

# Create stack instances
aws cloudformation create-stack-instances \
  --stack-set-name my-stackset \
  --accounts 123456789012 210987654321 \
  --regions us-east-1 us-west-2

Drift Detection

# Detect drift
aws cloudformation detect-stack-drift --stack-name my-stack

# Get drift results
aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id drift-detection-id

9. Integration with CI/CD Services

CodePipeline Integration

- Name: Deploy
  Actions:
    - Name: CreateChangeSet
      ActionTypeId:
        Category: Deploy
        Owner: AWS
        Provider: CloudFormation
        Version: 1
      Configuration:
        ActionMode: CHANGE_SET_REPLACE
        StackName: MyStack
        ChangeSetName: MyChangeSet
        TemplatePath: BuildArtifact::template.yaml
        Capabilities: CAPABILITY_IAM
        RoleArn: arn:aws:iam::123456789012:role/CloudFormationRole
      InputArtifacts:
        - Name: BuildArtifact

    - Name: ExecuteChangeSet
      ActionTypeId:
        Category: Deploy
        Owner: AWS
        Provider: CloudFormation
        Version: 1
      Configuration:
        ActionMode: CHANGE_SET_EXECUTE
        StackName: MyStack
        ChangeSetName: MyChangeSet
      RunOrder: 2

CodeBuild Integration

# buildspec.yml
version: 0.2
phases:
  install:
    runtime-versions:
      python: 3.9
  pre_build:
    commands:
      - pip install cfn-lint
  build:
    commands:
      - cfn-lint template.yaml
      - aws cloudformation validate-template --template-body file://template.yaml
  post_build:
    commands:
      - echo "Template validation completed"
artifacts:
  files:
    - template.yaml
    - parameters.json

Parameter Overrides in Pipeline

{
  "ParameterOverrides": {
    "Environment": "Production",
    "InstanceType": "t3.large",
    "DBPassword": {"Fn::GetParam": ["MyParameters", "parameters.json", "DBPassword"]}
  }
}

10. Security Best Practices

Template Security

  • Use least privilege IAM roles
  • Avoid hardcoding secrets in templates
  • Use AWS Secrets Manager or Parameter Store
  • Enable termination protection for critical stacks
  • Use stack policies to prevent accidental deletions

Secrets Management

Parameters:
  DBPassword:
    Type: String
    NoEcho: true
    Description: Database password

Resources:
  DBInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      MasterUserPassword: !Ref DBPassword
      # Better approach: use Secrets Manager
      ManageMasterUserPassword: true
      MasterUserSecret:
        Description: RDS Master User Secret
        KmsKeyId: alias/aws/secretsmanager

Using Secrets Manager

Resources:
  DBSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Description: RDS Master User Secret
      GenerateSecretString:
        SecretStringTemplate: '{"username": "admin"}'
        GenerateStringKey: 'password'
        PasswordLength: 16
        ExcludeCharacters: '"@/\'

  DBInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      MasterUsername: !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:username}}'
      MasterUserPassword: !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:password}}'

Cross-Account Deployment

# Assume role for cross-account deployment
Resources:
  CrossAccountRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::111111111111:root
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                'sts:ExternalId': 'unique-external-id'

11. Monitoring & Troubleshooting

CloudWatch Events Integration

Resources:
  StackEventRule:
    Type: AWS::Events::Rule
    Properties:
      Description: Monitor CloudFormation stack events
      EventPattern:
        source:
          - aws.cloudformation
        detail-type:
          - CloudFormation Stack Status Change
        detail:
          status-details:
            status:
              - CREATE_FAILED
              - UPDATE_FAILED
              - DELETE_FAILED
      Targets:
        - Arn: !Ref SNSTopic
          Id: StackFailureNotification

Stack Notifications

Resources:
  MyStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-bucket/template.yaml
      NotificationARNs:
        - !Ref SNSTopic

Common Issues & Solutions

Stack Rollback

  • Cause: Resource creation failure
  • Solution: Check CloudFormation events, fix template, retry
  • Prevention: Validate template, test in dev environment

Resource Already Exists

  • Cause: Resource name conflict
  • Solution: Use unique names, check existing resources
  • Prevention: Use dynamic naming with !Sub function

Insufficient Permissions

  • Cause: IAM role lacks required permissions
  • Solution: Add necessary permissions to service role
  • Prevention: Use least privilege principle

Template Size Limit

  • Cause: Template exceeds 460KB limit
  • Solution: Use nested stacks, store template in S3
  • Prevention: Modularize templates

Troubleshooting Commands

# Describe stack events
aws cloudformation describe-stack-events --stack-name my-stack

# Get stack status
aws cloudformation describe-stacks --stack-name my-stack

# List stack resources
aws cloudformation list-stack-resources --stack-name my-stack

# Describe failed resource
aws cloudformation describe-stack-resource \
  --stack-name my-stack \
  --logical-resource-id MyResource

12. Common Exam Scenarios

Scenario 1: Cross-stack resource sharing

Solution:

  • Export values from base stack using Outputs with Export
  • Import values in dependent stack using !ImportValue
  • Use consistent naming convention for exports

Scenario 2: Conditional resource creation

Solution:

  • Use Parameters for environment input
  • Define Conditions based on parameter values
  • Apply Condition property to resources
  • Use !If function for conditional values

Scenario 3: Multi-region deployment

Solution:

  • Use Mappings for region-specific values (AMI IDs)
  • Create separate stacks per region
  • Use StackSets for automated multi-region deployment
  • Handle region-specific resource availability

Scenario 4: Rolling updates without downtime

Solution:

  • Use Auto Scaling Group with UpdatePolicy
  • Configure CreationPolicy for validation
  • Use blue/green deployment pattern
  • Implement health checks

Scenario 5: Secure parameter passing

Solution:

  • Use NoEcho for sensitive parameters
  • Store secrets in Secrets Manager or Parameter Store
  • Use dynamic references in templates
  • Avoid hardcoding credentials

Scenario 6: Template validation in CI/CD

Solution:

  • Use cfn-lint for template validation
  • Validate template syntax with AWS CLI
  • Test templates in development environment
  • Use change sets for production updates

Scenario 7: Custom resource for unsupported features

Solution:

  • Create Lambda function for custom logic
  • Use AWS::CloudFormation::CustomResource
  • Implement proper error handling
  • Return appropriate response to CloudFormation

Scenario 8: Stack drift remediation

Solution:

  • Enable drift detection on stacks
  • Schedule regular drift detection
  • Use CloudWatch Events for notifications
  • Implement automated remediation

13. CLI Commands Reference

Stack Operations

# Create stack
aws cloudformation create-stack \
  --stack-name my-stack \
  --template-body file://template.yaml \
  --parameters file://parameters.json \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM

# Update stack
aws cloudformation update-stack \
  --stack-name my-stack \
  --template-body file://template.yaml \
  --parameters file://parameters.json

# Delete stack
aws cloudformation delete-stack --stack-name my-stack

# Describe stacks
aws cloudformation describe-stacks --stack-name my-stack

# List stacks
aws cloudformation list-stacks --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE

Template Operations

# Validate template
aws cloudformation validate-template --template-body file://template.yaml

# Estimate template cost
aws cloudformation estimate-template-cost \
  --template-body file://template.yaml \
  --parameters file://parameters.json

# Get template summary
aws cloudformation get-template-summary --template-body file://template.yaml

Change Set Operations

# Create change set
aws cloudformation create-change-set \
  --stack-name my-stack \
  --change-set-name my-changeset \
  --template-body file://template.yaml

# Describe change set
aws cloudformation describe-change-set \
  --change-set-name my-changeset \
  --stack-name my-stack

# Execute change set
aws cloudformation execute-change-set \
  --change-set-name my-changeset \
  --stack-name my-stack

# Delete change set
aws cloudformation delete-change-set \
  --change-set-name my-changeset \
  --stack-name my-stack

Stack Set Operations

# Create stack set
aws cloudformation create-stack-set \
  --stack-set-name my-stackset \
  --template-body file://template.yaml

# Create stack instances
aws cloudformation create-stack-instances \
  --stack-set-name my-stackset \
  --accounts 123456789012 \
  --regions us-east-1 us-west-2

# Update stack set
aws cloudformation update-stack-set \
  --stack-set-name my-stackset \
  --template-body file://template.yaml

14. Architecture Patterns

Three-Tier Application

┌─────────────────┐    ┌─────────────────┐    ┌─────────────────┐
│   Web Tier      │    │  Application    │    │   Database      │
│                 │    │     Tier        │    │     Tier        │
│ - ALB           │    │ - Auto Scaling  │    │ - RDS           │
│ - CloudFront    │    │ - EC2 Instances │    │ - ElastiCache   │
│ - S3 (Static)   │    │ - Lambda        │    │ - DynamoDB      │
└─────────────────┘    └─────────────────┘    └─────────────────┘

Multi-Environment Pipeline

Dev Stack → Test Stack → Staging Stack → Production Stack
    ↓           ↓            ↓              ↓
 Dev VPC    Test VPC    Staging VPC    Prod VPC

Nested Stack Architecture

Master Stack
├── Network Stack (VPC, Subnets, IGW)
├── Security Stack (Security Groups, NACLs)
├── Database Stack (RDS, ElastiCache)
└── Application Stack (EC2, ALB, Auto Scaling)

Cross-Account Deployment

Central Account (CI/CD)
    ↓
┌─────────────────────────────────────┐
│ CodePipeline → CloudFormation      │
│                     ↓               │
│              Assume Cross-Account   │
│                   Roles             │
└─────────────────────────────────────┘
    ↓           ↓           ↓
Dev Account  Test Account  Prod Account

15. Best Practices for DOP-C02 Exam

Template Design

  • Use parameters for reusability
  • Implement proper resource naming conventions
  • Use mappings for environment-specific values
  • Implement conditions for optional resources
  • Use outputs for cross-stack references
  • Keep templates modular with nested stacks

Security

  • Use IAM roles with least privilege
  • Never hardcode secrets in templates
  • Use Secrets Manager or Parameter Store
  • Enable termination protection
  • Implement stack policies for critical resources
  • Use encrypted storage for sensitive data

Operational Excellence

  • Validate templates before deployment
  • Use change sets for production updates
  • Implement proper tagging strategy
  • Monitor stack events and drift
  • Use version control for templates
  • Document template parameters and outputs

Reliability

  • Test templates in non-production environments
  • Implement proper error handling
  • Use DependsOn for resource dependencies
  • Configure appropriate timeouts
  • Plan for rollback scenarios
  • Use multiple AZs for high availability

Performance

  • Use appropriate resource sizing
  • Implement caching strategies
  • Use CloudFront for content delivery
  • Optimize database configurations
  • Use Auto Scaling for dynamic scaling
  • Monitor and optimize costs

16. Comparison with Other Services

CloudFormation vs Terraform

FeatureCloudFormationTerraform
ProviderAWS nativeMulti-cloud
State ManagementAWS managedLocal/remote state
LanguageJSON/YAMLHCL
CostFree (pay for resources)Free (Terraform Cloud paid)
RollbackAutomaticManual

CloudFormation vs CDK

FeatureCloudFormationCDK
LanguageJSON/YAMLProgramming languages
AbstractionLow-levelHigh-level constructs
Learning CurveModerateSteep (requires programming)
FlexibilityLimitedHigh
DebuggingTemplate-basedCode-based

CloudFormation vs AWS SAM

FeatureCloudFormationSAM
ScopeAll AWS resourcesServerless applications
SyntaxVerboseSimplified
Local TestingNoYes (SAM CLI)
DeploymentCloudFormationCloudFormation (under hood)

17. Exam Tips

What to Remember

  • Template sections: Parameters, Mappings, Conditions, Resources, Outputs
  • Intrinsic functions: !Ref, !GetAtt, !Sub, !Join, !Select, !FindInMap
  • Stack operations: Create, Update, Delete, Change Sets
  • Cross-stack references: Export/ImportValue
  • Nested stacks: AWS::CloudFormation::Stack
  • Custom resources: Lambda-backed custom logic
  • Stack policies: Protect resources from updates
  • Drift detection: Identify configuration changes
  • StackSets: Multi-account/region deployment

Common Traps

  • Template size limit is 460KB (use S3 for larger templates)
  • Circular dependencies between stacks via ImportValue
  • Cannot delete exported values while in use
  • Stack updates can cause resource replacement
  • Some resources don’t support updates (require replacement)
  • Custom resources require proper Lambda response format
  • Stack policies deny by default (must explicitly allow)

Scenario-Based Questions

  • Focus on cross-stack resource sharing patterns
  • Understand when to use nested vs separate stacks
  • Know conditional resource creation patterns
  • Understand CI/CD integration with change sets
  • Know security best practices for templates
  • Understand multi-region deployment strategies

Integration Questions

  • CodePipeline CloudFormation actions (change sets)
  • Parameter overrides in CI/CD pipelines
  • Template validation in CodeBuild
  • Cross-account deployment patterns
  • EventBridge integration for stack monitoring

18. Quick Reference Cheat Sheet

Essential Intrinsic Functions

!Ref ResourceName                    # Reference resource/parameter
!GetAtt Resource.Attribute          # Get resource attribute
!Sub 'String with ${Variable}'      # String substitution
!Join [',', [item1, item2]]        # Join with delimiter
!Select [0, !GetAZs '']            # Select from list
!FindInMap [MapName, Key, Value]   # Find in mapping
!ImportValue ExportName            # Import from another stack

Template Sections

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Template description'
Parameters: {}    # Input values
Mappings: {}      # Static lookup tables
Conditions: {}    # Boolean conditions
Resources: {}     # AWS resources (required)
Outputs: {}       # Return values

Common Resource Types

AWS::EC2::Instance, AWS::EC2::VPC, AWS::EC2::Subnet
AWS::IAM::Role, AWS::IAM::Policy, AWS::IAM::User
AWS::S3::Bucket, AWS::RDS::DBInstance
AWS::Lambda::Function, AWS::ApiGateway::RestApi
AWS::CloudFormation::Stack (nested stacks)

Stack Status Values

CREATE_IN_PROGRESS, CREATE_COMPLETE, CREATE_FAILED
UPDATE_IN_PROGRESS, UPDATE_COMPLETE, UPDATE_FAILED
DELETE_IN_PROGRESS, DELETE_COMPLETE, DELETE_FAILED
ROLLBACK_IN_PROGRESS, ROLLBACK_COMPLETE, ROLLBACK_FAILED

AWS Official Documentation

Tools and Utilities

Workshops

20. Summary

AWS CloudFormation is fundamental to Infrastructure as Code practices and is heavily tested in the DOP-C02 exam. Key areas to master:

  1. Template structure (parameters, mappings, conditions, resources, outputs)
  2. Intrinsic functions (!Ref, !GetAtt, !Sub, !Join, !FindInMap, !ImportValue)
  3. Stack operations (create, update, delete, change sets)
  4. Cross-stack references (export/import values)
  5. Nested stacks for modular architecture
  6. IAM roles and permissions for CloudFormation operations
  7. CI/CD integration with CodePipeline and change sets
  8. Security best practices (secrets management, least privilege)
  9. Advanced features (custom resources, StackSets, drift detection)
  10. Troubleshooting common issues and monitoring stack events

Understanding these concepts with hands-on practice will ensure success on CloudFormation-related questions in the DOP-C02 exam.