AWS CloudFormation Basics (and CloudFormation vs Terraform)

Infrastructure as code with CloudFormation: template anatomy, parameters and outputs, intrinsic functions, stacks, change sets, drift detection, rollbacks, SAM and CDK, and an honest comparison with Terraform.

Clicking through the console is a great way to learn AWS, and a terrible way to run it. When infrastructure lives in files, you can review changes, recreate environments, and roll back mistakes. AWS CloudFormation is AWS's native infrastructure-as-code service: you describe resources in a template and CloudFormation creates, updates and deletes them for you.

Template anatomy

AWSTemplateFormatVersion: "2010-09-09"
Description: Static site bucket
Parameters:
  Env:
    Type: String
    AllowedValues: [dev, prod]
Resources:
  SiteBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "acme-site-${Env}-${AWS::AccountId}"
      VersioningConfiguration:
        Status: Enabled
Outputs:
  BucketArn:
    Value: !GetAtt SiteBucket.Arn

Parameters: inputs that change between deployments (environment, instance size).
Mappings and Conditions: lookup tables and conditional creation (only create a NAT gateway in prod).
Resources: the only required section. Each has a logical ID, a type and properties.
Outputs: values to display or export to other stacks.

Intrinsic functions you will use daily

Function	Does
`!Ref`	Returns a parameter's value or a resource's primary identifier
`!GetAtt`	Returns an attribute, such as an ARN or DNS name
`!Sub`	String substitution with variables
`!If`, `!Equals`	Conditional values
`!ImportValue`	Uses an output exported by another stack

References also define dependencies: if a security group references a VPC, CloudFormation creates the VPC first and deletes it last.

Stacks, updates and change sets

A stack is a deployed template. When you update it, CloudFormation compares the new template with the current state and changes only what differs. Some property changes update in place; others replace the resource (for example renaming an S3 bucket or changing an RDS engine), which can mean data loss.

A change set previews exactly what will happen, including replacements, before you execute it. Always review change sets for production stacks.

When things go wrong

If creation or update fails, CloudFormation rolls back to the last working state. The Events tab shows the first failure; later errors are usually consequences.
UPDATE_ROLLBACK_FAILED means rollback itself failed (often a resource deleted outside CloudFormation); you can continue the rollback while skipping specific resources.
Drift detection compares the real resources with the template, revealing manual changes made in the console.
Stack policies prevent updates to critical resources, and DeletionPolicy: Retain or Snapshot protects data when a stack or resource is deleted.

Scaling up: nested stacks, StackSets and custom resources

Nested stacks split large templates into reusable components (network, data, app).
StackSets deploy the same stack across many accounts and Regions.
Custom resources backed by Lambda let CloudFormation do things it does not support natively.

SAM and CDK: friendlier ways to write CloudFormation

AWS SAM adds a short syntax for serverless resources (functions, APIs, tables) and a CLI for building, testing locally and deploying. It compiles to CloudFormation.
AWS CDK lets you define infrastructure in TypeScript, Python, Java or other languages, with loops and reusable constructs, and synthesizes CloudFormation templates.

CloudFormation vs Terraform

	CloudFormation	Terraform
Scope	AWS (plus registry extensions)	Multi-cloud and SaaS providers
State	Managed by AWS	State file you store and lock (S3 + locking, or a hosted backend)
Preview	Change sets	`terraform plan`
Rollback	Automatic on failure	No automatic rollback; you re-apply
New AWS features	Often supported at launch	Depends on provider release
Language	YAML/JSON (or CDK)	HCL (or CDKTF)

Both are excellent. Choose CloudFormation (or CDK/SAM) for AWS-only shops that want managed state and rollbacks; choose Terraform when you manage several clouds or SaaS tools with one workflow. AWS certification exams focus on CloudFormation.

Practice it

Deploy and update a serverless app in CloudFormation: Deploy a SAM Template and Update the Stack, then go further with CloudFormation Operations: Drift Detection, Change Sets and Stack Policies and Nested Stacks and a Lambda-Backed Custom Resource.

FAQ

Does CloudFormation cost anything?

No charge for AWS resource types; you pay for the resources it creates. Third-party registry resources can have handler operation charges.

Can I bring existing resources under CloudFormation?

Yes, with resource import, or by generating a template from existing resources with the IaC generator.

AWS CloudFormation Basics: Templates, Stacks and Change Sets (and How It Compares to Terraform)