AWS Cloud & DevOps Tutorial 0/70 lessons ~6 min read Lesson 29“IAM, VPC, EC2, Lambda, ECS, EKS, Terraform, CI/CD, and AWS operations”

Infrastructure as Code with CloudFormation

Pipelines promote artifacts; **Infrastructure as Code (IaC)** makes AWS resources themselves reviewable artifacts. **AWS CloudFormation** declares stacks from templates (YAML/JSON)

Course progress0%

Focus

15 guided sections

Practice signal

Examples included

Career prep

Interview Q&A included

Infrastructure as Code with CloudFormation

AWS Cloud & DevOps Engineering · Lesson 29 · DevOps Automation and IaC

Lesson Overview

Pipelines promote artifacts; Infrastructure as Code (IaC) makes AWS resources themselves reviewable artifacts. AWS CloudFormation declares stacks from templates (YAML/JSON) with parameters, conditions, mappings, outputs, and change sets. TechLearningPro uses CloudFormation (and later Terraform/CDK) so VPCs, IAM roles, ECS services, and queues are not snowflake console art.

This lesson teaches stack lifecycle, change sets for safe review, drift detection awareness, and nested stacks basics for reusable VPC and application layers. You will create reusable VPC and application stack patterns suitable for pipeline promotion. No invented intrinsic functions—stick to documented Ref, GetAtt, Sub, and standard resource types. Budget and delete stacks after labs; watch for Retention policies on stateful resources. Next: Terraform Fundamentals for AWS.

Learning Objectives

By the end of this lesson you will be able to:

Explain IaC benefits versus console clicking for TechLearningPro.
Structure templates: Resources, Parameters, Outputs, Conditions, Mappings, Metadata.
Use parameters and SSM/Secrets dynamic references carefully.
Create/update/delete stacks and read stack events.
Create and execute change sets; explain why preview matters.
Detect and reason about drift.
Apply nested stacks for VPC + app separation basics.
Handle stack policies and deletion protection concepts.
Pass outputs between stacks (exported values / nested outputs).
Integrate templates into CI validate + pipeline deploy.
Avoid anti-patterns: secrets in plaintext parameters, overbroad IAM in templates.
Tag stacks; budget; clean up.
Compare CloudFormation vs Terraform/CDK at a high level (later lessons deepen).
Produce lab evidence with change set screenshots and cleanup.

Prerequisites

Module 3 lessons 24–28 (delivery + pipelines)
VPC, IAM
Comfort reading YAML
Sandbox + budget alert
Git governance for template PRs

Detailed Core Concepts

Why IaC

Reviewability (PR diffs)
Repeatability (dev/stage/prod parity)
Recovery (recreate from template)
Auditability (who changed infra via Git + CloudTrail)

Console remains for break-glass—with retroactive template updates.

Templates and stacks

A template describes desired resources. A stack is an instantiated set of resources managed as a unit. Updates reconcile desired vs previous template; CloudFormation orchestrates creates/updates/deletes per dependency graph.

Core sections

AWSTemplateFormatVersion / Description
Parameters: typed inputs (environment name, CIDR)
Mappings: static lookups (AMI by region—prefer SSM parameters for AMIs when appropriate)
Conditions: optionally create resources
Resources: the actual AWS resources (required)
Outputs: export values for humans or other stacks

Intrinsic functions (documented essentials)

Ref — parameter or resource ref
Fn::GetAtt — attributes like ARN
Fn::Sub — string interpolation
Fn::Join, Fn::Select, Fn::If — common helpers

Use sparingly for readability; complex logic may belong in CDK later.

Change sets

A change set previews resource actions before execute. Production habit: pipeline creates change set → human or automated review → execute. Executing directly (update-stack) is faster but easier to surprise. Teach change sets as default for prod.

Drift

Drift means live resources differ from last template. Causes: console edits, scripts, other tools. Detection helps; remediation is update stack or accept into template. Drift is why break-glass without PR reconciliation hurts.

Nested stacks

A parent stack creates AWS::CloudFormation::Stack resources pointing at child templates (often in S3). Pattern: network nested stack + app nested stack. Benefits: reuse, smaller blast radius per template. Costs: debugging across stacks; parameter plumbing. Basics only here—do not over-nest.

Stack policies and termination protection

Termination protection prevents accidental delete. Stack policies can protect critical resources from replacement during updates. Use thoughtfully—over-protection blocks legitimate updates.

Dynamic references

Templates can reference SSM Parameter Store / Secrets Manager values via dynamic references so secrets are not stored in template plaintext. Still control who can read those secrets via IAM. Never put long-lived AWS keys in template defaults.

Integration with pipelines

CI: cfn-lint, cloudformation validate-template (capabilities awareness). CD: package templates that use local paths (aws cloudformation package), upload to S3, deploy/change-set. CODEOWNERS on infra/**.

Architecture and Design Diagrams

mermaid
flowchart TB
  T[Template in Git]
  Lint[cfn-lint / validate]
  S3[Packaged template S3]
  CS[Change set]
  Rev[Review / approval]
  Stack[CloudFormation stack]
  AWS[AWS resources]
  Drift[Drift detection]

  T --> Lint --> S3 --> CS --> Rev --> Stack --> AWS
  AWS --> Drift
  Drift -->|reconcile| T

mermaid
flowchart TB
  Parent[Parent stack]
  Net[Nested: network]
  App[Nested: application]
  Parent --> Net
  Parent --> App
  Net -->|outputs subnet IDs| App

mermaid
sequenceDiagram
  participant Dev
  participant Git
  participant Pipe
  participant CFN as CloudFormation
  Dev->>Git: PR template
  Git->>Pipe: validate
  Pipe->>CFN: create change set
  Pipe->>Dev: approve
  Dev->>CFN: execute change set
  CFN->>CFN: stack UPDATE_COMPLETE

Technical Explanation

Illustrative snippet — parameterized S3 bucket (lab-safe)

yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: TechLearningPro lab bucket
Parameters:
  EnvName:
    Type: String
    AllowedValues: [dev, staging, prod]
Resources:
  LabBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      Tags:
        - Key: Project
          Value: tlp-lesson29
        - Key: Environment
          Value: !Ref EnvName
Outputs:
  BucketName:
    Value: !Ref LabBucket

Verify property names against current resource docs when implementing. Delete lab buckets/stacks after.

Nested stack sketch

Parent passes VpcCidr into network child; network outputs PrivateSubnetIds; app child receives subnet IDs as parameters. Store child templates in S3; parent references URLs. Version child templates deliberately—mutable “latest” template objects recreate promotion bugs from lesson 26.

Change set workflow CLI (verify flags)

Conceptual flow: create-change-set → describe-change-set → review → execute-change-set. On failure, read stack events. Do not invent parameters; check AWS CLI reference at lab time.

Capabilities

Some templates require capabilities (named IAM resources, auto-expand macros/nested). Understand why IAM capability is a deliberate acknowledgment—pipelines should not silently widen without review.

Rollback

Failed updates roll back by default (typical). Understand rollback triggers and how retained resources behave. Test in sandbox before prod.

Practical Implementation or Design Walkthrough

Problem

Create reusable VPC and application stacks for TechLearningPro sandbox.

Steps

Budget alert.
Author network template (VPC, subnets, route tables—minimal).
Author app template (security group + stub resource, e.g., log group or ECS service stub).
Parent nested stack or sequential deploy using outputs.
Validate + lint in CI mindset.
Create change set for an update (e.g., add tag); review; execute.
Introduce deliberate console drift; run drift detection; reconcile via template.
Enable termination protection on “prod-like” sandbox stack; practice the delete path carefully.
Tear down: disable protection; delete stacks in dependency order; confirm no orphan EIPs/ENIs; check bill.

Failure paths

Missing capability for IAM → update fails; add capability knowingly.
Wrong subnet export → app stack fails create; fix outputs.
Delete order wrong → export still in use; delete app first.

Enterprise Real-World Scenarios

Console-only VPC

Nobody can recreate networking after account issue. Fix: import or rebuild as template; protect with CODEOWNERS.

Secret in parameter default

Committed password. Fix: dynamic reference; rotate; history incident.

Giant monolith template

Unreviewable 5k-line YAML. Fix: nested/modularize; later CDK/Terraform modules.

Change set skipped for speed

Surprise resource replacement drops DB. Fix: mandatory change set review for stateful resources; stack policies.

Drift ignored

Security group opened in console; template still shows closed. Audit fails. Fix: drift alarms + culture.

Best Practices

All prod infra in Git.
Change sets for prod updates.
Lint/validate in CI.
Least-privilege IAM in templates.
Block public access defaults for data stores.
Tags on stacks and resources.
Termination protection for prod.
Nested stacks for clear domains.
No secrets in templates.
Reconcile drift quickly.
Package/version templates in S3 immutably.
Pipeline deploy roles least privilege.
Document delete order.
Budget and cleanup labs.
CODEOWNERS on infra paths.

Common Mistakes and Anti-Patterns

Clickops without template updates.
Secrets in plaintext parameters.
Overusing * IAM policies in examples copied to prod.
Skipping change sets on stateful stacks.
Circular dependencies / bad exports.
Leaving lab stacks forever.
Mutable template objects in S3 as “latest.”
Nested stacks ten layers deep.

Troubleshooting and Design Review

UPDATE_ROLLBACK_IN_PROGRESS. Read events bottom-up for first failure; fix template; retry.

Export in use. Delete importing stack first or update to remove dependency.

No changes in change set. Template identical; or wrong stack/parameters.

Design review: stateful replacement risk? IAM capability justified? Secrets? Drift process? Cleanup?

Interview Questions and Answers

Q1: Stack vs template? Template is declaration; stack is live managed instance.

Q2: Why change sets? Preview impact before mutation—especially replacements.

Q3: What is drift? Live config differs from last known template.

Q4: Nested stacks use? Modular reuse (network/app); share outputs.

Q5: How do pipelines deploy CFN? Validate → package → change set → approve → execute.

Q6: Secrets handling? Dynamic references / Secrets Manager; never plaintext defaults.

Q7: Termination protection? Prevents accidental stack delete.

Q8: CFN vs Terraform? Both IaC; different state models/ecosystems—later lessons.

Q9: Why CODEOWNERS on templates? Infra blast radius equals production change risk.

Q10: Rollback behavior? Failed updates typically roll back; know exceptions you configure.

Q11: Outputs purpose? Share ARNs/IDs; documentation; cross-stack refs.

Q12: Cleanup importance? Orphan resources cost money and confuse audits.

Hands-On Exercises

Exercise: Create reusable VPC and application stacks

Build network + app (nested or sequenced). Evidence: templates in Git, change set review, drift exercise, delete proof, budget alert.

Challenge ADR

Multi-account: share network via Transit Gateway later vs per-account VPCs now; constrain monthly budget; dual approval for IAM-capable templates. Choose nested vs separate pipelines per stack.

Lab evidence checklist

Supplemental deep practice for lesson 29

Practice block 1

Author a parameter design for EnvName and VpcCidr with AllowedPattern/AllowedValues to prevent accidental prod CIDR collisions in TechLearningPro sandboxes.

Practice block 2

Walk through a change set that would replace a database resource; explain how reviewers spot Replacement in the change set and when to stop execution.

Practice block 3

Perform drift detection after a console security group rule change; reconcile by either reverting console or updating the template—document which you chose and why.

Practice block 4

Implement nested stacks where network outputs feed application subnet parameters; describe delete order and Export in-use errors with the correct remediation sequence.

Practice block 5

Add termination protection to a prod-like stack and practice the deliberate disable-then-delete path so engineers do not confuse protection with backup.

Practice block 6

Use dynamic references conceptually for a secret ARN used by an application resource; emphasize IAM read restrictions and rotation responsibilities.

Practice block 7

Integrate cfn-lint in PR checks and map findings to merge blockers for IAM policies containing Action wildcard with Resource wildcard in prod templates.

Practice block 8

Package nested templates to S3 with version IDs; parent stack references a specific version so 'latest object overwrite' cannot change prod silently.

Practice block 9

Write stack tags and resource tags consistent with FinOps; show how cost allocation reports attribute orphaned lab stacks to learners who forgot cleanup.

Practice block 10

Explain CAPABILITY_NAMED_IAM as an intentional acknowledgment in pipelines; require dual review when templates create IAM users or broad roles—prefer roles with boundaries.

Practice block 11

Design a pipeline stage that creates a change set and pauses for approval before execute, tying lesson 27/28 identity models to CloudFormation deploy permissions only.

Practice block 12

Compare CloudFormation and Terraform at interview depth: state storage, plan vs change set, AWS-native vs multi-cloud—without dismissing either for TechLearningPro.

Practice block 13

Create a rollback narrative when an update fails midway through adding a listener rule; read stack events; confirm prior healthy state restored.

Practice block 14

Forbid plaintext password Parameter defaults in CODEOWNERS review comments bank; require Secrets Manager; treat violations as security incidents with rotation.

Practice block 15

Model a shared services stack exporting a Hosted Zone ID versus hardcoding zone IDs in app templates; discuss coupling and change coordination.

Practice block 16

Schedule quarterly drift scans for production stacks; auto-open tickets on drifted security groups and public bucket ACLs.

Practice block 17

Document lab cleanup including retained resources with DeletionPolicy; explain why Retain on a lab bucket surprises learners with leftover spend.

Practice block 18

Build a mini-project: VPC + public ALB stub + empty target group entirely in templates; record change set for adding tags; delete all; screenshot empty stack list.

Practice block 19

Link Module 2 services: show how an ECS task definition or Lambda permission appears in templates and how image digests remain parameters supplied by pipelines—not hardcoded latest.

Practice block 20

Prepare oral exam answers for change set vs update-stack, drift vs skew between accounts, and nested vs monolithic templates using enrollment platform examples.

Enrollment-week rehearsal

Narrate aloud a TechLearningPro incident involving CloudFormation IaC: detection signals, which Git SHA and artifact digest are suspect, which IAM principal performed the change, how you halt promotions, how you roll back, and which gate you will add. Include budget and cleanup reminders so labs never leave orphan spend. Cross-check /learn/git and /learn/ci-cd-automation only for vocabulary—keep AWS specifics here. Peer-review your narration for hand-waving. Continue only when the story names concrete AWS services and evidence locations.

Enrollment-week rehearsal

Additional design drill

Write a one-page ADR addendum for CloudFormation IaC covering multi-account isolation, dual approval, OIDC-not-keys where relevant, immutable artifacts, observe hooks, and cleanup. List ten binary definition-of-done checks. Map Module 2 targets (Lambda, ECS, ECR, EventBridge, Step Functions, Secrets Manager) into the design. Score yourself on the course rubric axes. Next lesson preview: Terraform Fundamentals for AWS.

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Enrollment-week rehearsal

Additional design drill

Final CloudFormation lab closeout

Confirm every sandbox stack is deleted or intentionally retained with an owner tag and budget acceptance. Confirm change set evidence and drift evidence are in your submission. Confirm no plaintext secrets remain in templates. Confirm CODEOWNERS covers infra paths. Confirm the pipeline identity that can execute change sets is least privilege. Write five sentences connecting this lesson to Terraform next: state backends, plan vs change set, and why TechLearningPro may run both tools in different domains without declaring a single winner. Peer-initial your cleanup checklist before you call the lesson complete. Keep the delivery loop from lesson 24 intact as templates move through change sets into observed stacks. Tag Project=tlp-lesson29 on every lab stack before you submit final evidence.

Binary definition of done for lesson 29

Templates are in Git under review; validate/lint notes attached; at least one change set reviewed and executed in sandbox; drift detected and reconciled once; nested or sequenced VPC+app pattern demonstrated; termination protection exercised; stacks deleted with proof; budget alert confirmed; no plaintext secrets; CODEOWNERS path listed; peer initials on cleanup. If any box is unchecked, the lab is incomplete regardless of how green a single stack create looked in the console.

Lesson Summary

CloudFormation makes TechLearningPro infrastructure reviewable and repeatable through templates, stacks, parameters/outputs, change sets, drift awareness, and nested stack modularity. Integrate with CI validation and pipeline promotion; never store secrets in templates; protect production with change set review and termination protection; always clean up lab stacks.

Next: Terraform Fundamentals for AWS expands IaC with Terraform’s workflow and provider model.