501 — Deploy and Manage Infrastructure with CloudFormation

Intermediate

Deploy an IAM role, S3 bucket, and Lambda function as a CloudFormation stack, preview updates safely with a change set, and clean up with delete-stack — from the CLI.

Learning Objectives

Explain the relationship between a CloudFormation template, a stack, and the resources it manages

Write a YAML CloudFormation template with Parameters, Resources, and Outputs sections

Use intrinsic functions (!Ref, !GetAtt, !Sub) to reference parameters and resource attributes

Validate a template with aws cloudformation validate-template before deploying

Create a stack with CAPABILITY_NAMED_IAM and wait for CREATE_COMPLETE

Read stack outputs to discover provisioned resource identifiers

Preview a parameter change with a change set before applying it

Execute a change set and confirm the stack reaches UPDATE_COMPLETE

Delete the stack and verify all stack-managed resources are removed atomically

Step 1

Understand the CloudFormation model

Before writing any template, understand the three core CloudFormation concepts: template, stack, and change set.

Instructions

No commands in this step — read the explanation before writing the template

What This Does

A CloudFormation template is a declarative YAML (or JSON) document that describes the desired state of your AWS infrastructure.

You declare what resources you want; CloudFormation figures out the creation order and handles dependencies automatically.

A stack is a live deployment of a template.

Every resource listed in the template becomes a member of the stack.

CloudFormation creates, updates, and deletes resources as a group — if any resource fails to create, the entire stack rolls back automatically.

A change set is a preview of what would change if you applied an updated template to a running stack.

You inspect the change set before executing it, catching destructive replacements before they happen.

Template sections used in this lesson:

- Parameters: user-supplied values that customize the deployment (Stage, ProjectPrefix)

- Resources (required): the actual AWS resources to create

- Outputs: values exported from the stack for easy retrieval (bucket name, function ARN)

Expected Outcome

No output — this step is conceptual.

Proceed to step 2 to design the capstone architecture.

Pro Tips

1
Billing callout: CloudFormation itself is free. You pay only for the resources it creates. This capstone creates IAM (free), an empty S3 bucket, Lambda (always-free allowance), and a small CloudWatch Logs log group with 7-day retention — negligible cost on any account type.
2
Templates are the source of truth. Changing resources outside of CloudFormation (via the console or direct CLI calls) causes drift — the live state no longer matches the template. CloudFormation does not detect or correct drift automatically.

Was this step helpful?