AWS CloudFormation

AWS CloudFormation is Amazon Web Services' infrastructure as code service, provisioning AWS and third-party resources from templates for teams on AWS.

AWS CloudFormation creates, updates and deletes cloud resources from a template, and treats everything one template describes as a single unit called a stack. Amazon Web Services, a unit of Amazon.com, Inc., operates the engine itself, so there is nothing to install or host. A stack can hold AWS resources alongside third-party resources registered as extensions. Teams describe an environment once and let the service build it the same way every time. Before an update runs, change sets list what each proposed change will do to running resources. Executing a change set is a separate step, so the review happens first. Drift detection compares a stack with its template and reports the drift status of each resource, with drift-aware change sets alongside. Resource import and the IaC generator bring resources created elsewhere under a stack without recreating them. Git sync watches a repository branch, deploys from its commits and can comment on pull requests with the changes it will make. CloudFormation Hooks inspect resources, stacks and change sets before provisioning and can stop the operation, while CloudFormation Guard checks templates against policy rules. It suits teams whose infrastructure runs mainly on AWS and who would rather not maintain a provisioning tool of their own. Developers who would rather write TypeScript, Python, Java, C# or Go than a template use AWS CDK, an open-source framework from AWS that deploys through CloudFormation. Security staff gain a checkpoint in Hooks, and IAM policies can name a single stack, so a production stack can be closed to updates and deletion. Teams that already review code through pull requests bring infrastructure changes into the same review with Git sync. Platform teams publish private extensions and modules to the CloudFormation registry in their account for others to reuse. A common job is standing up a new environment from a template, then changing it through a change set that someone reads before it runs. Another is adopting resources first built by hand in the AWS console, either by importing them or by generating a template with the IaC generator. Stacks pass values to each other through output exports, Fn::ImportValue and, across accounts and Regions, Fn::GetStackOutput. Amazon EventBridge receives an event when a stack's drift status changes, so a drift finding can start other work. Every stack in the estate can then be traced back to the template that defines it.