AWS CloudFormation Overview

• Definition: Service to manage, configure, and provision AWS infrastructure as code.
• Provides a common language (YAML or JSON) to describe and provision cloud resources.
• Interprets templates and makes appropriate API calls to create defined resources.
• Can provision a broad range of AWS resources.
• Think of it as Infrastructure as Code (IaC).

Key Benefits

• Infrastructure is provisioned consistently, with fewer human errors.
• Less time and effort than manual configuration.
• Supports version control and peer review for templates.
• Free to use (only charged for resources provisioned).
• Manages updates and dependencies.
• Can rollback and delete the entire stack.

Key Concepts

Templates

• YAML or JSON file describing the end-state of infrastructure.
• Uploaded directly to CloudFormation or via S3.
• CloudFormation reads the template and makes API calls.
• Resulting resources are called a "Stack".
• Logical IDs: Used to reference resources within the template.
• Physical IDs: Identify resources outside CloudFormation templates, after creation.

Template Elements (Sections)

• Mandatory: Resources section.
• Not Mandatory: Parameters (limit 60), Output values (limit 60), Mappings, Conditions, Transform.

Resources (Mandatory)

• Declares AWS resources to be included in the stack (e.g., EC2 instance, S3 bucket).
• Represent AWS components that will be created.
• Declared resources can reference each other.
• Example:

  Resources:
  MyEC2Instance:
  Type: "AWS::EC2::Instance"
  Properties:
  ImageId: "ami-0ff8a91507f77f867"

Parameters

• Used to customize templates; input custom values each time a stack is created/updated.
• Useful for template reuse.
• Example (with default and allowed values):

  Parameters:
  InstanceTypeParameter:
  Type: String
  Default: t2.micro
  AllowedValues:
  - t2.micro
  - m1.small
  - m1.large
  Description: Enter t2.micro, m1.small, or m1.large. Default is t2.micro.

Pseudo Parameters

• Predefined by AWS CloudFormation; not declared in your template.
• Used with the !Ref function.
• Examples: AWS::AccountId, AWS::NotificationARNs, AWS::Region, AWS::StackId, AWS::StackName, AWS::URLSuffix, AWS::Partition.

Mappings

• Matches a key to a corresponding set of named values (two-level map).
• Fixed variables, good for differentiating values based on region, environment, AMIs, etc.
• Values must be known in advance. Use parameters for user-specific values.
• Example:

  RegionMap:
  us-east-1:
  HVM64: ami-0ff8a91507f77f867
  HVMG2: ami-0a584ac55a7631c0c
  us-west-1:
  HVM64: ami-0bdb828fd58c52235
  HVMG2: ami-066ee5fd4a9ef77f1

Outputs

• Declares output values that can be:
  • Imported into other stacks (for cross-stack references).
  • Returned in response to describe stack calls.
  • Viewed on the AWS CloudFormation console.
• Cannot delete a stack if its outputs are being referenced by another CloudFormation stack.
• Example (with Export for cross-stack referencing):

  Outputs:
  StackVPC:
  Description: The ID of the VPC
  Value: !Ref MyVPC
  Export:
  Name: !Sub "${AWS::StackName}-VPCID"

Conditions

• Define circumstances under which entities (resources, outputs) are created or configured.
• Control the creation of resources based on a condition.
• Example:

  Conditions:
  CreateProdResources: !Equals [ !Ref EnvType, prod ]

Transform

• Specifies one or more macros that CloudFormation uses to process your template.
• Can reference additional code stored in S3 (Lambda code, reusable snippets).
• The AWS::Serverless-2016-10-31 transform (AWS SAM macro) expands SAM syntax into CloudFormation.
• Example:

  Transform: AWS::Serverless-2016-10-31
  Resources:
  MyServerlessFunctionLogicalID:
  Type: AWS::Serverless::Function
  Properties:
  Handler: index.handler
  Runtime: nodejs8.10
  CodeUri: 's3://testBucket/mySourceCode.zip'

Intrinsic Functions (Crucial for Exam!)

• Built-in functions to assign values to properties not available until runtime.
• YAML Short Forms: Use !Fn::FunctionName or !FunctionName (e.g., !Ref, !GetAtt).
• !Ref (or Fn::Ref):
  • Returns the value of the specified parameter or resource.
  • For parameters: returns the parameter's value.
  • For resources: returns a value that typically refers to that resource (e.g., physical ID).
  • Example: InstanceId: !Ref MyEC2Instance
• !GetAtt (or Fn::GetAtt):
  • Returns the value of an attribute from a resource.
  • Syntax: !GetAtt LogicalNameOfResource.AttributeName
  • Example: SourceSecurityGroupOwnerId: !GetAtt myELB.SourceSecurityGroup.OwnerAlias
• !FindInMap (or Fn::FindInMap):
  • Returns a value from a two-level map declared in the Mappings section.
  • Syntax: !FindInMap [ MapName, TopLevelKey, SecondLevelKey ]
  • Example: ImageId: !FindInMap [ RegionMap, !Ref 'AWS::Region', HVM64 ]
• !ImportValue (or Fn::ImportValue):
  • Returns the value of an output exported by another stack (cross-stack references).
  • Example: !ImportValue !Sub "${NetworkStackName}-SecurityGroupID"
• !Join (or Fn::Join):
  • Concatenates a list of values into a single string, separated by a delimiter.
  • Syntax: !Join [ delimiter, [ comma-delimited list of values ] ]
  • Example: !Join ['', ['arn:', !Ref Partition, ':s3:::elasticbeanstalk-*-', !Ref 'AWS::AccountId']]
• !Sub (or Fn::Sub):
  • Substitutes variables in an input string with specified values.
  • Can use $ or ${variable} syntax.
  • Example: Name: !Sub 'www.${Domain}' (where Domain is a parameter or other reference).

Stacks and Stack Sets

Stacks

• Deployed resources based on templates.
• Managed via Console, CLI, or APIs.
• Stack Creation Errors:
  • Automatic rollback on error is enabled by default.
  • You are charged for resources provisioned even if there is an error (before rollback).
  • Can optionally disable rollback for troubleshooting.
• Updating Stacks:
  • Direct Update: Submit changes, CloudFormation immediately deploys. Use for quick deployments.
  • Change Sets: Preview proposed changes before applying them. Recommended for critical updates to understand impact.
• Stack Update Failures: Stack automatically rolls back to the previous known working state.

Stack Sets

• Create, update, or delete stacks across multiple accounts and regions with a single operation.
• Requires an administrator account (where stack set is created) and target accounts (where stacks are deployed).
• Trust relationship must be set up between admin and target accounts.

Nested Stacks

• Allow re-use of CloudFormation code for common use cases (e.g., standard LB, web server configs).
• Create standard templates for common uses and reference them from within your main template.

CloudFormation Helper Scripts

• Python scripts that assist with instance configuration.
• Logs for these scripts are typically found in /var/log/cloud-init-output.log (general CloudInit) and /var/log/cfn-init.log (specifically for cfn-init).
• Binary available on EC2 at /opt/aws/bin/cfn-init.

cfn-init

• Reads template metadata from the AWS::CloudFormation::Init key.
• Actions: Fetch/parse metadata, install packages, write files, enable/disable/start/stop services.
• Does not require credentials (no access key, secret key, role, or credential file options).

cfn-signal

• Signals CloudFormation to indicate whether EC2 instances (or other resources) have been successfully created or updated.
• Used in conjunction with a CreationPolicy or an Auto Scaling group with a WaitOnResourceSignals update policy.
• CloudFormation suspends work until it receives the required signals or timeout.
• Can signal a CreationPolicy or a WaitCondition handle.

CloudFormation Resource Attributes

• These attributes control resource behavior during stack operations.

CreationPolicy attribute

• Used to wait on resource configuration actions before stack creation proceeds.
• Prevents resource status from reaching create complete until a specified number of success signals are received or timeout.
• Signal using cfn-signal helper script or SignalResource API.
• Supported by AWS::AutoScaling::AutoScalingGroup, AWS::EC2::Instance, AWS::CloudFormation::WaitCondition.

DeletionPolicy attribute

• Preserves or backs up a resource when its stack is deleted.
• If not specified, CloudFormation deletes the resource by default.
• Common values: Retain, Snapshot, Delete (default).

DependsOn attribute

• Specifies that the creation of a resource must follow another.
• Resource is created only after the resource specified in DependsOn is created.
• Useful for explicit ordering when implicit dependencies aren't enough.

WaitCondition

• Used to coordinate stack resource creation with external configuration actions or track status of a process.
• Note: For EC2 and Auto Scaling resources, AWS recommends CreationPolicy instead of WaitCondition.

UpdatePolicy attribute (WaitOnResourceSignals)

• Specifies how CloudFormation handles updates to resources like AWS::AutoScaling::AutoScalingGroup, AWS::ElastiCache::ReplicationGroup, AWS::Elasticsearch::Domain, AWS::Lambda::Alias.

UpdateReplacePolicy attribute

• Retains or backs up the existing physical instance of a resource when it's replaced during a stack update.

Troubleshooting Errors

• Verify AMI includes CloudFormation helper scripts.
• Check cfn-init and cfn-signal logs (/var/log/cfn-init.log, /var/log/cloud-init-output.log).
• Verify internet connectivity from the instance.

Monitoring and Reporting

• Monitor stack progress by viewing stack's events in the console (Events tab).
• For resources created by CloudFormation, use standard AWS monitoring/reporting tools (CloudWatch, CloudTrail) applicable to that service.

Authorization and Access Control

• Use IAM to control user actions with CloudFormation (e.g., view templates, create/delete stacks).
• IAM also controls which AWS services and resources are available to users when they use CloudFormation.

Charges

• No additional charge for AWS CloudFormation itself.
• You pay for the AWS resources created using CloudFormation in the same manner as if created manually.
• Pay-as-you-go, no minimum fees or upfront commitments.

Best Practices

• Use CloudFormation for all infrastructure changes (avoid manual changes).
• Make use of Change Sets to identify potential issues before updates.
• Use Stack Policies to explicitly protect sensitive portions of your stack from accidental updates/deletions.
• Use a version control system (CodeCommit, GitHub) to track template changes.
• Use Python "helper scripts" (cfn-init, cfn-signal) for software installation/configuration on EC2.

Serverless Application Model (SAM)

• Extension to CloudFormation specifically for defining serverless applications.
• Provides simplified syntax for serverless resources (APIs, Lambda Functions, DynamoDB Tables).
• Use the SAM CLI to package, upload to S3, and deploy your serverless application.
• The Transform: AWS::Serverless-2016-10-31 header indicates a SAM template.

Important Exam Tips & Tricks

• IaC Core: CloudFormation is AWS's primary Infrastructure as Code tool.
• Template Language: YAML and JSON are both supported.
• Logical vs. Physical IDs: Understand the difference and when each is used (!Ref often returns physical ID for resources).
• Intrinsic Functions: Master !Ref, !GetAtt, !FindInMap, !Sub, !Join, !ImportValue. These are heavily tested. Know their syntax and use cases.
• Stack Rollback:
  • Creation Failure: Rollback is default enabled. You are still charged for resources provisioned before the rollback.
  • Update Failure: Rollback is automatic to the last known good state.
• Change Sets: Used to preview changes before applying. Crucial for understanding impact.
• StackSets: For multi-account, multi-region deployments.
• Nested Stacks: For reusability and modularity of templates.
• Helper Scripts (cfn-init, cfn-signal):
  • cfn-init: For installing/configuring software on EC2 instances from template metadata.
  • cfn-signal: For signaling CloudFormation about instance readiness (used with CreationPolicy or WaitCondition).
  • Remember their log file locations.
• Resource Attributes (CreationPolicy, DeletionPolicy, DependsOn): Know their purpose and how they influence stack behavior. DeletionPolicy: Retain is key for preventing accidental data loss.
• CloudFormation vs. Elastic Beanstalk: CloudFormation is for infrastructure, Elastic Beanstalk is for applications (PaaS). They are complementary.
• SAM: It's a transform that extends CloudFormation for serverless deployments. Know the Transform header.
• Security: IAM permissions control who can create/manage stacks and what resources CloudFormation can create.
• Cost: CloudFormation itself is free; you pay for the resources it creates.