What CloudFormation is and why AWS-only teams choose it
CloudFormation is the infrastructure as code service built into AWS. You write a template, submit it, and AWS builds a stack: it works out resource ordering, creates what is missing, updates what changed and attempts to roll back if something fails. You do not host a backend, manage a lock or secure a state bucket, because AWS holds that state for you.
For a team that runs only on AWS, that is a real benefit. New AWS features are often available through CloudFormation quickly, deployments are visible in the console and events log, and IAM can control exactly who may create or update stacks. Many AWS services, including CDK and SAM, compile down to CloudFormation, so understanding it helps even if you never write raw templates.
We cover AWS infrastructure delivery through our Terraform and infrastructure as code service, and we advise CloudFormation where it is the right answer.
Designing stacks that stay safe
Stack boundaries
The most consequential decision is what goes in which stack. A single stack containing a VPC, a database and an application means one update can touch everything, and a failed rollback leaves a large mess. We group resources by lifecycle and owner: network foundations, stateful data, then application layers that change often. Nested stacks and cross-stack exports can connect them, but exports create hard dependencies that block changes to the exporting stack, so we use them selectively and often prefer parameters or Systems Manager parameter lookups for loose coupling.
Change sets and replacement
Never update a production stack blind. A change set shows which resources will be added, modified or replaced. Replacement is the dangerous word: a property change on a database or encrypted volume can mean a new resource and a deleted old one. We read every change set for replacement and decide deliberately whether it is acceptable.
Protecting stateful resources
Use DeletionPolicy: Retain or Snapshot and UpdateReplacePolicy on databases, buckets and keys, enable termination protection on critical stacks, and apply stack policies to stop updates to named resources. These are cheap controls that prevent the worst outcomes.
Resources:
DataBucket:
Type: AWS::S3::Bucket
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
VersioningConfiguration:
Status: Enabled
BucketEncryption:
ServerSideEncryptionConfiguration:
- ServerSideEncryptionByDefault:
SSEAlgorithm: aws:kms
PublicAccessBlockConfiguration:
BlockPublicAcls: true
BlockPublicPolicy: true
IgnorePublicAcls: true
RestrictPublicBuckets: true
Multi-account rollout with StackSets
Where you manage many accounts, StackSets deploy one template to many accounts and regions. With AWS Organizations and service-managed permissions, new accounts can receive baseline roles, logging and guardrails automatically. We configure failure tolerance and maximum concurrency so a bad template stops early rather than spreading, and we test against a small organisational unit first.
StackSets add their own concerns: operations can be slow across many regions, and per-account customisation takes planning. For simple needs, a pipeline that deploys the same stack into each account may be easier to reason about.
Security and access
Pipelines should assume a dedicated CloudFormation service role with only the permissions the templates need, rather than running as an administrator. That keeps a compromised pipeline from having broad reach and lets you review permissions as a single artefact. Combine this with:
- Linting with cfn-lint and policy-as-code checks such as cfn-guard before deployment.
- Parameters that reference Secrets Manager or Systems Manager rather than literal values; avoid putting secrets in
NoEchoparameters and treating that as protection. - CloudTrail for an audit record of stack operations.
- Short-lived federated credentials for the CI system.
Cost and capacity
CloudFormation itself carries no charge for standard AWS resource types. Costs come from the resources you create and, for some third-party or extension types, handler operations. The practical cost to manage is human: large raw YAML templates are tedious, and teams often hit stack resource limits or struggle with Fn:: intrinsic functions. Tagging through stack-level tags, plus budgets by tag, gives cost visibility. We avoid quoting savings, since they depend on what is deployed.
Day-2 operations
Drift and rollback
Run drift detection on a schedule for critical stacks, and investigate differences rather than overwriting them. Learn the failure states: UPDATE_ROLLBACK_FAILED happens when AWS cannot restore a previous state, usually because someone changed a dependent resource out of band. Knowing how to continue a rollback and skip resources safely is part of our runbooks.
Template evolution
Templates drift in quality over time. We add automated checks, split oversized templates, retire unused parameters and move repeated patterns into modules or the CDK where a team prefers code. The reasoning on choosing between them is in our note on Pulumi.
Common failure modes
- Monolithic stacks. Slow updates and a wide blast radius.
- Export lock-in. An exported value cannot be changed while another stack imports it.
- Surprise replacement. An unreviewed change replaces a stateful resource.
- Custom resources without error handling. A Lambda-backed resource that never signals success hangs a stack for a long time.
- Out-of-band edits. Console changes cause failed updates and rollbacks.
When CloudFormation is the wrong choice
If you operate on multiple clouds or manage SaaS providers alongside AWS, Terraform offers one workflow for all of it. If your team dislikes writing long YAML and wants real programming constructs, consider CDK or Pulumi. If you need to configure software on servers, use Ansible.
If you already have CloudFormation in production and want out, we work stack by stack using our CloudFormation to Terraform migration approach, with no resource recreated along the way. You can contact us to scope it.
Official documentation: docs.aws.amazon.com/cloudformation