backend / cloud aws / management and governance / README.md

AWS CloudFormation

6 min read index source

AWS CloudFormation

Overview

AWS CloudFormation is a service that helps you model and set up your Amazon Web Services resources so you can spend less time managing those resources and more time focusing on your applications.

Key Features

  • Infrastructure as Code: Define infrastructure using JSON or YAML templates
  • Declarative: Describe desired state, AWS handles the implementation
  • Version Control: Track changes to infrastructure
  • Rollback: Automatic rollback on deployment failures
  • Cross-Region: Deploy resources across multiple regions
  • Nested Stacks: Modular template design

Interview Topics

1. CloudFormation Templates

  • Template Structure: AWSTemplateFormatVersion, Description, Parameters, Resources, Outputs
  • Intrinsic Functions: Ref, Fn::GetAtt, Fn::Join, Fn::Sub
  • Pseudo Parameters: AWS::Region, AWS::AccountId, AWS::StackName
  • Template Validation: Validate templates before deployment

2. Stack Management

  • Stack Creation: Deploy new infrastructure
  • Stack Updates: Modify existing infrastructure
  • Stack Deletion: Remove all resources
  • Stack Drift: Detect configuration drift
  • Stack Sets: Deploy across multiple accounts/regions

3. Resource Types

  • AWS Resources: EC2, VPC, RDS, Lambda, etc.
  • Custom Resources: Extend with Lambda functions
  • Resource Dependencies: DependsOn, implicit dependencies
  • Resource Properties: Configuration options for each resource

4. Parameters and Conditions

  • Parameters: Input values for templates
  • Parameter Types: String, Number, CommaDelimitedList, etc.
  • Conditions: Conditional resource creation
  • Parameter Constraints: AllowedValues, MinLength, MaxLength

5. Outputs and Exports

  • Outputs: Return values from stacks
  • Exports: Share values between stacks
  • Cross-Stack References: Import values from other stacks
  • Export Dependencies: Handle export dependencies

Common Interview Questions

Basic Questions

  1. What is AWS CloudFormation and what are its benefits?

    • Infrastructure as Code service
    • Benefits: Version control, repeatability, rollback, cost tracking
    • Declarative approach vs imperative

  2. What are the main sections of a CloudFormation template?

    AWSTemplateFormatVersion: '2010-09-09'
Description: 'My CloudFormation template'
Parameters:
  # Input parameters
Resources:
  # AWS resources
Outputs:
  # Output values

  3. How do you create a CloudFormation stack?

    aws cloudformation create-stack \
  --stack-name my-stack \
  --template-body file://template.yaml \
  --parameters ParameterKey=KeyName,ParameterValue=my-key

Advanced Questions

  1. What are intrinsic functions and give examples?

    • Ref: Reference resources and parameters
    • Fn::GetAtt: Get attributes of resources
    • Fn::Join: Join strings
    • Fn::Sub: Substitute variables
    Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${AWS::StackName}-bucket'

  2. How do you handle dependencies between resources?

    • Implicit dependencies: When one resource references another
    • Explicit dependencies: Using DependsOn attribute
    • Circular dependencies: Use custom resources or redesign

  3. What are nested stacks and when would you use them?

    • Modular template design
    • Reusable components
    • Separate concerns (networking, compute, storage)
    • Easier maintenance and testing

Troubleshooting Questions

  1. What if a CloudFormation deployment fails?

    • Check CloudFormation events
    • Review resource-specific errors
    • Use rollback or continue update rollback
    • Check IAM permissions

  2. How do you handle sensitive data in CloudFormation?

    • Use NoEcho for sensitive parameters
    • Store secrets in AWS Secrets Manager
    • Use Systems Manager Parameter Store
    • Implement proper IAM roles

Best Practices

1. Template Design

  • Use meaningful resource names
  • Implement proper tagging strategy
  • Use conditions for environment-specific resources
  • Keep templates modular with nested stacks

2. Parameter Management

  • Use appropriate parameter types
  • Set default values where possible
  • Implement parameter constraints
  • Use NoEcho for sensitive data

3. Resource Organization

  • Group related resources together
  • Use logical resource naming
  • Implement proper dependencies
  • Consider resource limits

4. Security

  • Follow principle of least privilege
  • Use IAM roles instead of access keys
  • Implement proper security groups
  • Encrypt sensitive data

5. Monitoring and Logging

  • Set up CloudTrail for API logging
  • Use CloudWatch for monitoring
  • Implement proper error handling
  • Monitor stack drift

Use Cases

1. Multi-Environment Deployment

  • Development, staging, production
  • Environment-specific configurations
  • Consistent infrastructure across environments

2. Disaster Recovery

  • Cross-region deployment
  • Backup and restore procedures
  • Failover automation

3. Compliance and Governance

  • Standardized infrastructure
  • Policy enforcement
  • Audit trails

Integration Patterns

1. CI/CD Integration

  • Automated deployments
  • Infrastructure testing
  • Blue-green deployments

2. Monitoring Integration

  • CloudWatch integration
  • Custom metrics
  • Alerting and notification

3. Security Integration

  • IAM integration
  • Security group management
  • Encryption configuration

Security Considerations

1. IAM Permissions

  • Use least privilege principle
  • Implement proper role-based access
  • Regular permission reviews

2. Network Security

  • Proper VPC configuration
  • Security group rules
  • Network ACLs

3. Data Protection

  • Encryption at rest and in transit
  • Key management
  • Data classification

Cost Optimization

1. Resource Optimization

  • Right-size resources
  • Use appropriate instance types
  • Implement auto-scaling

2. Template Optimization

  • Remove unused resources
  • Use spot instances where appropriate
  • Implement cost allocation tags

3. Monitoring Costs

  • Track resource costs
  • Set up billing alerts
  • Regular cost reviews

Performance Optimization

1. Template Performance

  • Optimize template size
  • Use nested stacks for large templates
  • Minimize resource dependencies

2. Deployment Performance

  • Parallel resource creation
  • Optimize resource ordering
  • Use change sets for validation

3. Resource Performance

  • Choose appropriate resource types
  • Implement caching strategies
  • Optimize network configuration

Disaster Recovery

1. Backup Strategies

  • Template version control
  • Resource backup policies
  • Cross-region replication

2. Recovery Procedures

  • Automated recovery scripts
  • Manual recovery procedures
  • Testing and validation

3. Monitoring and Alerting

  • Health check monitoring
  • Automated alerting
  • Incident response procedures

Migration Strategies

1. From Manual Infrastructure

  • Document existing infrastructure
  • Create equivalent templates
  • Gradual migration approach

2. From Other IaC Tools

  • Template conversion
  • Feature mapping
  • Testing and validation

3. Application Modernization

  • Containerization support
  • Serverless architecture
  • Microservices patterns

Common Pitfalls

1. Template Complexity

  • Overly complex templates
  • Poor resource organization
  • Difficult maintenance

2. Security Issues

  • Inadequate IAM permissions
  • Exposed sensitive data
  • Poor network security

3. Cost Management

  • Unused resources
  • Over-provisioned resources
  • Lack of cost monitoring

Resources

Interview angle

  • “CloudFormation or Terraform?” - CloudFormation for AWS-only shops that want native drift detection, no state file to manage and same-day support for new services. Terraform or OpenTofu when you span providers or the team already knows HCL. Mention the 2023 Terraform BSL relicense and the OpenTofu fork - it is a live consideration, not trivia.
  • “What is a change set for?” - previewing what a stack update will create, modify or replace before it happens. The critical part is spotting replacement: some property changes destroy and recreate the resource, which for a database means data loss.
  • “How do you handle a failed update?” - CloudFormation rolls back automatically. The failure mode people hit is UPDATE_ROLLBACK_FAILED, which needs manual intervention with ContinueUpdateRollback and skipped resources.
  • “How do you structure large infrastructure?” - nested stacks or separate stacks per lifecycle boundary, wired with exports and imports or SSM parameters. One monolithic template is slow to update and makes every change high-blast-radius. CDK is the option when the logic genuinely needs a programming language.