CloudFormation

Templates, stacks, change sets, safe updates.

Infrastructure as Code is central to DevOps, and CloudFormation is AWS’s native IaC service. Defining infrastructure declaratively as version-controlled templates is what makes environments reproducible, reviewable, and safe to change.

Templates, stacks, and change sets

A CloudFormation template declares the resources you want; deploying it creates a stack that CloudFormation manages as a unit. Because the template is code, it lives in git, goes through review, and produces the same infrastructure every time — no click-ops drift. Before applying an update you generate a change set to preview exactly what will be added, modified, or replaced, avoiding the surprise of an update that unexpectedly replaces your database. If an update fails, CloudFormation automatically rolls back to the last known-good state, keeping the stack consistent. This declarative, previewable, self-rolling-back model is why IaC is safer than manual changes.

# A template declares resources; a stack manages them together.
Resources:
  AppBucket:
    Type: AWS::S3::Bucket
    Properties: { BucketName: !Sub "app-${Env}" }
 
# Preview before applying — see what will change, avoid surprise replacements:
aws cloudformation create-change-set --stack-name app --change-set-name preview ...
aws cloudformation describe-change-set --change-set-name preview   # review, then execute
# A failed update auto-rolls-back to the previous good state.

Protecting critical resources

IaC gives you powerful safety features to configure deliberately. A stack policy protects critical resources (like a production database) from accidental update or replacement during a stack update. Deletion protection prevents an accidental stack delete. Parameters and mappings make templates reusable across environments, and outputs/exports let stacks reference each other. Managing infrastructure this way means changes are versioned, peer-reviewed, previewed, and reversible — the same rigor DevOps applies to application code, now applied to the environment itself. Every environment (dev, staging, prod) can be stood up identically from the same templates, eliminating the "works in dev" class of problems.