CloudFormation

CloudFormation lets you define your AWS infrastructure as code — written in YAML or JSON. Instead of clicking through the console to create a VPC, subnets, security groups, an RDS database, and an EC2 instance, you write a template that describes all of them, and CloudFormation creates and manages the entire stack for you.

The Infrastructure as Code Idea

Manual infrastructure is fragile. You can't easily reproduce it, you can't review changes before applying them, and you can't roll back when something goes wrong. Infrastructure as code solves all three problems: your template lives in version control, changes go through code review, and CloudFormation can roll back a failed update automatically.

How Stacks Work

You upload a template to CloudFormation and it creates a stack — a collection of AWS resources managed as a single unit. To update your infrastructure, you update the template and submit a change set, which shows you exactly what will be created, modified, or deleted before anything actually changes. When you delete the stack, CloudFormation deletes all the resources it created.

Templates

A CloudFormation template has a few key sections:

Parameters — inputs you supply at deploy time (environment name, instance type, database password). This lets one template serve dev, staging, and prod with different values.

Resources — the actual AWS resources to create. Each resource has a type (e.g., AWS::EC2::Instance) and properties. Resources can reference each other using !Ref and !GetAtt.

Outputs — values exported from the stack (a load balancer URL, a bucket name, a VPC ID) that other stacks or systems can use.

Drift Detection

After resources are created, someone might manually change them through the console. CloudFormation can detect this drift — the difference between what the template says and what actually exists — and report which resources have been modified outside of CloudFormation's control.

Blueprint → Building → Renovation plan. The template is the blueprint, the stack is the building, and a change set is the renovation plan you review before the crew arrives — watch for the word Replace: it means demolish-and-rebuild (new physical ID, old data gone). Drift is a tenant knocking down a wall without telling the architect: CloudFormation can detect it, but never fixes it on its own.

The Bigger Picture

CloudFormation is the foundation that higher-level tools like AWS CDK (Cloud Development Kit) build on. CDK lets you define infrastructure using TypeScript, Python, or Java, then synthesizes it into a CloudFormation template. Under the hood, CDK deploys are just CloudFormation stacks.