AWS CloudFormation: Templates, Stacks & Change Sets

AWS CloudFormation

CloudFormation is AWS's native infrastructure-as-code service. You describe resources in YAML or JSON templates, and CloudFormation provisions and manages them as stacks — handling creation order, updates, rollback on failure, and deletion as a unit.

Its big advantage over third-party tools is depth of AWS integration and AWS-managed state (no state file to host or lock yourself). Its trade-off is being AWS-only and more verbose, which is why many teams reach for the AWS CDK (which generates CloudFormation from real code) or Terraform.

TL;DR

Define AWS resources in templates; deploy them as stacks.
Preview updates with change sets before applying.
Keep stacks small and modular; avoid one giant stack.
State is AWS-managed — no state file to host or lock.

Quick Example

A minimal template declaring one resource — CloudFormation creates and tracks it as part of a stack:

Core Concepts

Template — YAML/JSON declaring resources, parameters, and outputs.
Stack — a deployed instance of a template, managed as one unit.
Change set — a preview of what an update will create, modify, or delete.
Drift detection — finds resources changed outside CloudFormation.

Best Practices

Always review a change set before updating a production stack.
Keep stacks small and modular; compose with nested stacks or cross-stack references.
Use parameters and outputs deliberately to wire stacks together.
Avoid click-ops — manual console changes cause drift and surprise update failures.
Separate environments (dev/staging/prod) into their own stacks.

Comparison: CloudFormation vs Terraform

See Terraform.

Common Mistakes

One giant stack

Manual changes causing drift

FAQ

CloudFormation or Terraform?

CloudFormation if you're all-in on AWS and want native integration plus AWS-managed state. Terraform if you need multi-cloud, prefer HCL, or want the broader provider ecosystem. Both are declarative IaC; the main axis is AWS-only-and-managed-state versus multi-cloud-and-self-managed-state.

What is a change set?

A preview of the modifications an update would make to a stack — which resources get created, updated (and whether replaced), or deleted — before you execute it. It's CloudFormation's equivalent of terraform plan and is essential for safe production updates.

What is drift detection?

A feature that compares the stack's expected configuration against the actual resources in AWS, flagging anything changed outside CloudFormation (manual console edits, other tools). Drift is a sign your IaC no longer reflects reality, so detect and reconcile it.

What's the AWS CDK's relationship to CloudFormation?

The AWS Cloud Development Kit lets you define infrastructure in real languages (TypeScript, Python, etc.) and synthesizes CloudFormation templates under the hood. You get programming abstractions while CloudFormation still does the provisioning — a popular way to avoid hand-writing large YAML.