Stack Fundamentals

🏗️

CloudFormation & Infrastructure as Code

Declare your infrastructure in templates — CloudFormation provisions, updates, and rolls back entire environments as a single unit.

~66 min total10 modules9 quiz questionsDOP-C02 High priority

CloudFormation is AWS's native Infrastructure-as-Code service. You declare your infrastructure in a YAML or JSON template; CloudFormation provisions and manages the resources, tracks state, and handles rollback when things go wrong.

Template Anatomy — Click Each Section

Only Resources is required. All others are optional.

Minimal CloudFormation template (YAML)

AWSTemplateFormatVersion: "2010-09-09"
Description: "VPC with public subnet — minimal example"

Parameters:
  Env:
    Type: String
    AllowedValues: [dev, staging, prod]
    Default: dev

Conditions:
  IsProd: !Equals [!Ref Env, prod]

Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: "10.0.0.0/16"
      EnableDnsHostnames: true

  FlowLog:
    Type: AWS::EC2::FlowLog
    Condition: IsProd        # only created in production
    Properties:
      ResourceId: !Ref MyVPC
      ResourceType: VPC
      TrafficType: ALL
      LogDestinationType: cloud-watch-logs
      LogGroupName: /vpc/flowlogs

Outputs:
  VpcId:
    Value: !Ref MyVPC
    Export:
      Name: !Sub "${AWS::StackName}-VpcId"

Intrinsic Functions — The Most Tested

!RefReturns the resource ID (for resources) or parameter value (for parameters)

!GetAttReturns an attribute of a resource — !GetAtt MyBucket.Arn

!SubString substitution — !Sub "arn:aws:s3:::${BucketName}/*"

!ImportValueImport an exported Output from another stack (cross-stack reference)

!FindInMapLookup a value from a Mappings table — !FindInMap [RegionMap, !Ref AWS::Region, AMI]

!IfConditional value — !If [IsProd, ProdValue, DevValue]

!SelectPick item from list by index — !Select [0, !GetAZs ""]

!Split / !JoinSplit a string into list / join a list with delimiter

ℹ️Pseudo-parameters are built-in: AWS::AccountId, AWS::Region, AWS::StackName, AWS::NoValue (removes a property when used in !If), AWS::Partition (aws, aws-cn, aws-us-gov). Reference with !Ref AWS::Region.

Real-vs-Fake Tells — Spotting Fabricated Options

Exam questions love to bury a made-up resource type, attribute, or property inside an otherwise plausible answer. If you know the real skeleton, the fake jumps out. Fabrication almost always hides in one of three places, rarely in an outright invented property name.

① Fake resource Type

Real: Types are always AWS::Service::ResourceName. If you don't recognize the ResourceName, suspect it.

Fake tell: AWS::AutoScaling::DeploymentUpdates (there is no such type — it's AWS::AutoScaling::AutoScalingGroup)

② Fake top-level section

Real: Exactly 9 exist: AWSTemplateFormatVersion, Description, Metadata, Parameters, Mappings, Conditions, Transform, Resources, Outputs (+ Rules).

Fake tell: Variables:, Imports:, Policies: at the top level

③ Contradictory combo

Real: Real keys assembled in a way that cancels itself out.

Fake tell: AutoScalingReplacingUpdate with WillReplace: false, then bolting on AutoScalingRollingUpdate

④ Fake attribute value

Real: DeletionPolicy is Delete / Retain / Snapshot / RetainExceptOnCreate.

Fake tell: DeletionPolicy: ForceDelete (does not exist)

Resource Anatomy — Properties vs Attributes

Every entry under Resources has a logical ID, a Type, a Properties block (config specific to that type), and optional resource attributes that sit as siblings of Properties — not inside it. The attributes are a fixed, generic set CloudFormation recognizes on any resource.

The 4-part resource shape (attributes are siblings of Properties)

Resources:
  MyAsg:                                     # logical ID (you name it)
    Type: AWS::AutoScaling::AutoScalingGroup  # real resource type
    Properties:                              # config for THIS type only
      MinSize: "4"
      MaxSize: "8"
    # --- resource ATTRIBUTES (siblings of Properties) ---
    CreationPolicy:     {...}   # wait for signal on CREATE
    UpdatePolicy:       {...}   # how to update (ASG / Lambda alias / ElastiCache)
    DeletionPolicy:     Retain  # Delete | Retain | Snapshot | RetainExceptOnCreate
    UpdateReplacePolicy: Retain # what to do with data on REPLACE
    DependsOn:          [OtherResource]
    Metadata:           {...}

ℹ️The fixed set of resource attributes: CreationPolicy, UpdatePolicy, DeletionPolicy, UpdateReplacePolicy, DependsOn, Metadata, Condition. Anything else claiming to be a sibling of Properties is fabricated.

UpdatePolicy — The Three Real ASG Variants

UpdatePolicy only applies to a few types (mainly ASG, plus Lambda alias and ElastiCache). For an Auto Scaling group it accepts exactly three keys — this is the source of the most common CloudFormation deployment traps.

ASG UpdatePolicy — the only three valid keys

UpdatePolicy:
  AutoScalingReplacingUpdate:      # replace the WHOLE ASG (new one; keep old on failure)
    WillReplace: true              #   -> immediate rollback + full capacity (CFN "Immutable")
  AutoScalingRollingUpdate:        # update instances IN BATCHES, in place
    MinInstancesInService: 4       #   -> guarantees capacity during the roll
    MaxBatchSize: 1
    MinSuccessfulInstancesPercent: 100
    WaitOnResourceSignals: true    #   -> wait for each new instance to cfn-signal
    PauseTime: PT15M
  AutoScalingScheduledAction:      # respect scheduled scaling during the update
    IgnoreUnmodifiedGroupSizeProperties: true

AutoScalingReplacingUpdate

Builds a brand-new ASG; only deletes the old one after the new one signals success. WillReplace: true ⇒ immediate rollback (keep old on failure) + full capacity. CFN analogue of Beanstalk Immutable.

AutoScalingRollingUpdate

Updates the existing instances in batches, in place. Can leave a partial/mixed-version state; rollback re-rolls. Use when you want gradual in-place replacement, not a full swap.

🎯"Update the ASG, immediate rollback, keep the normal instance count" → AutoScalingReplacingUpdate with WillReplace: true. Watch for the trap options: a fake type like AWS::AutoScaling::DeploymentUpdates, or WillReplace: false mixed with RollingUpdate (contradiction). The real property names (WaitOnResourceSignals, PauseTime, WillReplace) get reused across wrong answers to make them feel plausible.