AWS CloudFormation
Infrastructure as code — declare AWS resources in a template, CloudFormation provisions them as a stack.
Verified against AWS documentation · 2026-08-27
Key facts
- 01Templates are declarative JSON/YAML — you describe the end state, CloudFormation figures out create/update/delete order
- 02A stack is the unit of deployment — all resources succeed together or roll back together
- 03Change sets preview exactly what an update will modify before you commit — the safety net for prod stacks
- 04Drift detection reports when someone hand-edited resources outside the template
- 05StackSets deploy one template across multiple accounts and Regions in a single operation
- 06Limits: 500 resources per template, 51,200 bytes inline / 1 MB via S3, 2,000 stacks per account
Exam triggers
Phrases and scenarios that point here.
- "Infrastructure as code", "repeatable deployments", "provision identical environments" → CloudFormation
- "Deploy the same baseline to every account in the Organization" → StackSets
- "Preview changes before applying" → change set
- "Resources were modified manually, how to detect it" → drift detection
- Failed deployment must not leave half-built infrastructure → automatic rollback
Not this service
- Prefer writing infrastructure in Python/TypeScript instead of templates → CDK (which compiles down to CloudFormation)
- Configuration inside the OS — packages, patches, app config → Systems Manager / OpsWorks
- Pre-approved template catalog for end users to self-serve → Service Catalog
- Audit resource configuration history over time → AWS Config
Use cases
- 01Spinning up an identical staging copy of production for a load test, then deleting the whole stack afterward — no orphaned resources leaking cost
- 02New-Region disaster recovery: the same template that built us-east-1 rebuilds everything in ap-southeast-1 in one deploy
- 03Onboarding a new team account — StackSets pushes the standard VPC, IAM roles, and logging baseline automatically
- 04Catching the engineer who 'temporarily' opened a security group in the console — drift detection flags the stack as drifted
- 05Reviewing a change set before a template update, and spotting that an innocent-looking property change would replace the RDS instance
How it's charged
- 01No charge for CloudFormation itself when provisioning AWS resource types — you pay only for the resources the stack creates
- 02Third-party and private registry resource types are billed per handler operation beyond a monthly free tier
- 03Hooks invocations are billed per handler operation the same way
- 04The classic billing surprise isn't CloudFormation — it's forgetting to delete a test stack that contains a NAT Gateway or RDS instance
