CloudFormation — DVA-C02 Mastery Guide

• Sources: course chapter 11 (CloudFormation). The chapter serves as the syllabus only; all wording here is original. The module scope also covers change sets, nested stacks, drift detection, cfn-init/cfn-signal, UpdateReplacePolicy and dynamic references, which the chapter skips or only names.
• Verified against AWS documentation on 2026-10-12. The marker ⚠️ Changed: <current>. Older material may say <old>. flags a value or behaviour that differs from the course or older practice tests: learn the current value. ⚠️ unverified marks a value that current AWS documentation doesn't confirm: don't rely on it. Every change is listed in Changed vs older material; confirmed rows also go to notes/current-facts.md.
• Tier 2 (deployment and messaging), bank target 35 questions. Domain: Deployment.
• How to use it: /explain <topic> teaches from these sections (concept → exam facts → developer angle → traps → 3 check questions); /quiz cloudformation asks bank questions whose source_note links point at the ## N. headings below; /drill cloudformation fires short recall prompts from notes/cloudformation-cheat-sheet.md. Suggested loop: read a section and answer its practice questions before opening the answers → /explain what is still unclear → /quiz cloudformation → /drill cloudformation.

How CloudFormation appears on DVA-C02

DVA-C02 treats CloudFormation as the developer's deployment engine: you write or generate a template, ship it through a pipeline, and must predict what CloudFormation does when something goes wrong. Template trivia rarely appears on its own; it is wrapped in a deployment scenario.

• Authoring: which section or function solves a need (parameter vs mapping vs SSM parameter type, Ref vs Fn::GetAtt, Fn::Sub, conditions) and how stacks share values (exports vs nested stacks).
• Safe change: previewing with change sets, keeping data with DeletionPolicy and UpdateReplacePolicy, blocking updates with stack policies, blocking deletes with termination protection.
• Permissions: service roles plus iam:PassRole, the CAPABILITY_* acknowledgements, least-privilege pipelines.
• Troubleshooting: stack states (ROLLBACK_COMPLETE, UPDATE_ROLLBACK_FAILED, DELETE_FAILED), InsufficientCapabilities, an export still in use, a missing cfn-signal, a custom resource that never answers.
• Scale and extension: StackSets across accounts and Regions, custom resources, drift detection and resource import.

Typical question shapes: a failed deployment and its error to diagnose; "Which TWO actions…" around protection or permissions; "least operational overhead" choices between StackSets, nested stacks, exports and scripts; the exact CLI flag, attribute or pseudo parameter that does the job. Domain map: every topic maps to Deployment (prepare artifacts → §1, §5; automate and test deployments → §6–§8, §11; deploy across accounts → §12); security-flavoured (§6, §14) and troubleshooting-flavoured (§1, §8, §11) questions still count as Deployment in this bank.

Out of scope here: SAM syntax and the sam CLI (see notes/sam-guide.md), CDK (see notes/cdk-guide.md), the CodePipeline CloudFormation action and manual approvals (see notes/cicd-guide.md), Elastic Beanstalk's own stacks (see notes/beanstalk-guide.md), Parameter Store and Secrets Manager internals (see notes/security-encryption-guide.md), iam:PassRole mechanics (see notes/advanced-identity-guide.md), user data and Auto Scaling instance refresh (see notes/ec2-mastery-guide.md §3 and §10). Network design inside templates is out of the exam's scope.

1. Stacks and the deployment workflow

Concept

• A template (JSON or YAML) declares the resources you want; a stack is one deployed copy of a template, named uniquely per Region and managed as a unit: create, update and delete apply to every resource in it.
• CloudFormation is declarative: it derives a dependency graph from Ref, Fn::GetAtt, Fn::Sub and DependsOn, creates independent resources in parallel and deletes in reverse order.
• An update never edits the stored template in place: you submit a new template and/or new parameter values, CloudFormation compares them with the current stack and touches only what differs. Every property has a documented update behaviour: No interruption, Some interruption or Replacement.
• Deployment paths: the console (template studio), the CLI or SDK (create-stack, update-stack, deploy), CI/CD pipelines, and generators such as SAM and CDK that emit templates.
• Payoff: reviewable, version-controlled, repeatable environments that can be torn down when idle and rebuilt on demand, plus stack tags for cost tracking.

Exam facts

• Template size: an inline body (--template-body, TemplateBody) can be up to 51,200 bytes; larger templates, up to 1 MB, must be passed as an S3 https:// URL (--template-url). ⚠️ Changed: templates up to 51,200 bytes are accepted inline; only larger ones must sit in S3 (the console uploads a local file to a CloudFormation-managed bucket for you). Older material may say every template must first be uploaded to S3.
• Template quotas (per template; the fix is splitting, not a quota increase): 500 resources, 200 parameters, 200 outputs, 200 mappings with 200 attributes each, 60 dynamic references, description 1,024 bytes, parameter value 4,096 bytes, logical IDs and names 255 characters. ⚠️ Changed: since October 2020, 500 resources, 200 parameters, 200 outputs, 200 mappings and a 1 MB S3 template. Older material may say 200 resources, 60 parameters, 60 outputs, 100 mappings and 450 KB. Above 500 resources, split the template with nested stacks (§5).
• Account quota: 2,000 stacks per Region (adjustable); REVIEW_IN_PROGRESS stacks count. Stack names: up to 128 characters, letters, digits and hyphens, starting with a letter.
• Stack options: up to 50 stack tags (propagated to the resources), up to 5 SNS topics in NotificationARNs for stack events, --timeout-in-minutes to fail a creation that runs too long.
• States: CREATE_IN_PROGRESS → CREATE_COMPLETE; a failed create ends in ROLLBACK_COMPLETE, where the only allowed operation is delete. UPDATE_COMPLETE_CLEANUP_IN_PROGRESS means the update succeeded and replaced resources are being removed (the stack is usable). A failed update ends in UPDATE_ROLLBACK_COMPLETE (usable, update again) or UPDATE_ROLLBACK_FAILED (§8). Deleted stacks stay listed for 90 days.
• Replacement creates the new resource first, repoints references, then deletes the old one during cleanup, so it briefly needs quota for both. A resource with a custom name (BucketName, TableName, FunctionName, QueueName) can't be replaced: change the name or drop it.
• Lambda code in S3: a new object uploaded to the same key is not detected. Change S3Key or S3ObjectVersion; aws cloudformation package does this by uploading under a checksum-based key.
• package and deploy: package uploads local artifacts (Lambda code folders, nested templates, OpenAPI files) to S3 and writes a rewritten template; deploy creates and executes a change set for a new or existing stack. Useful flags: --no-execute-changeset (stop at the preview), --parameter-overrides Key=Value, --capabilities, --s3-bucket (needed when the template exceeds 51,200 bytes), --fail-on-empty-changeset (by default an empty change returns exit code 0).
• validate-template checks only JSON/YAML syntax and lists parameters, required capabilities and transforms; it doesn't check property values. Stack and change set operations add pre-deployment validation (§7).
• ⚠️ Changed: the console's visual editor is template studio (template text beside a live diagram; validate, convert YAML↔JSON, save to S3; you edit the text, not the diagram). The standalone AWS Infrastructure Composer console ends support on 2026-12-07; its full experience stays in the AWS Toolkit for VS Code. Older material may say to design templates in Infrastructure Composer or CloudFormation Designer.
• ⚠️ Changed: express mode (--deployment-config '{"mode": "EXPRESS"}' on create, update, delete, change sets and rollback-stack) reports each resource complete once its configuration is applied, without waiting for stabilization. Rollback is off by default in this mode (add "disableRollback": false to keep it), StackSets don't support it and custom resources still wait for their response: use it for development loops only. Older material may say every stack operation waits for each resource to stabilize.
• The total number of resource types is ⚠️ unverified: the course quotes "over 700", AWS publishes no current figure and the list keeps growing. Look types up in the CloudFormation Template Reference.
• Pricing: no CloudFormation charge for resource providers in the AWS::* and Alexa::* namespaces (you pay only for the resources); third-party registry resource types and Hooks are billed per handler operation (1,000 operations a month free).

Developer angle

aws cloudformation create-stack --stack-name orders-dev --template-body file://orders.yaml \
  --parameters ParameterKey=Env,ParameterValue=dev --capabilities CAPABILITY_IAM --tags Key=team,Value=orders
aws cloudformation wait stack-create-complete --stack-name orders-dev
aws cloudformation describe-stack-events --stack-name orders-dev --output table \
  --query "StackEvents[?contains(ResourceStatus, 'FAILED')].[LogicalResourceId,ResourceStatusReason]"
# new parameter value, same template
aws cloudformation update-stack --stack-name orders-dev --use-previous-template --capabilities CAPABILITY_IAM \
  --parameters ParameterKey=Env,UsePreviousValue=true ParameterKey=Size,ParameterValue=large
# upload local artifacts, then create or update through a change set in one command
aws cloudformation package --template-file orders.yaml --s3-bucket orders-artifacts-111122223333 \
  --output-template-file packaged.yaml
aws cloudformation deploy --template-file packaged.yaml --stack-name orders-dev \
  --parameter-overrides Env=dev --capabilities CAPABILITY_IAM

• SDK equivalents (boto3): create_stack(StackName=…, TemplateBody=…, Parameters=[…], Capabilities=["CAPABILITY_IAM"]), get_waiter("stack_create_complete").wait(StackName=…), describe_stacks(StackName=…)["Stacks"][0]["Outputs"].
• Errors to recognise: a duplicate stack name returns AlreadyExists (AlreadyExistsException in the CLI and SDKs); a quota returns LimitExceeded; an update-stack with identical template and parameters returns a ValidationError saying there are no updates to perform, while deploy just reports no changes.
• In describe-stack-events, the earliest *_FAILED event's ResourceStatusReason usually names the root cause; later failures are mostly knock-on cancellations.

Traps

• Trap: "Every template has to be uploaded to S3 before create-stack." → Reality: bodies up to 51,200 bytes go inline; S3 (up to 1 MB) is needed only above that.
• Trap: "Overwrite orders.zip in S3 and update the stack." → Reality: an unchanged S3Key/S3ObjectVersion is no change; use a new key or version (package does it).
• Trap: "validate-template passed, so the stack will deploy." → Reality: it checks syntax only; property errors surface in pre-deployment validation or during provisioning.
• Trap: "Fix a ROLLBACK_COMPLETE stack with update-stack." → Reality: delete it and create it again (or create with failure preservation next time, §8).
• Trap: "Change a replacement-only property of a table that has TableName set." → Reality: the update fails; give the table a new name or remove the custom name.
• Trap: "UPDATE_COMPLETE_CLEANUP_IN_PROGRESS means the update is failing." → Reality: the update succeeded; old physical resources are being deleted.
• Trap: "Use express mode in production to finish deployments faster." → Reality: it skips stabilization and disables rollback by default; production keeps the standard mode.

Practice questions

1. A build job uploads each new version of a Lambda function to s3://orders-artifacts/builds/orders.zip and then runs aws cloudformation update-stack with the unchanged template, whose AWS::Lambda::Function resource points S3Bucket and S3Key at that object. The job reports that there are no updates to perform, and the function keeps running the previous code. Which change fixes the pipeline with the LEAST effort?

   • A. Call update-stack with --use-previous-template instead of uploading the template again.
   • B. Run aws cloudformation package in the job to upload each build under a new checksum-based S3 key.
   • C. Run aws cloudformation detect-stack-drift on the stack before each update-stack call in the job.
   • D. Add a DependsOn attribute from the function to the artifact bucket resource in the template's Resources section.

2. A developer's first create-stack for a new service failed on a misconfigured resource, and the stack is now in ROLLBACK_COMPLETE. The template has been corrected. The service must be deployed with the corrected template, and the next failed creation must keep the successfully created resources for troubleshooting. Which TWO actions meet these requirements? (Select TWO.)

   • A. Run update-stack on the existing stack with the corrected template.
   • B. Delete the stack and run create-stack again with the corrected template.
   • C. Run continue-update-rollback on the stack, then update it.
   • D. Add --disable-rollback (Preserve successfully provisioned resources) to future create-stack calls.
   • E. Pass --enable-termination-protection on the next create-stack call.

2. Template sections and parameters

Concept

• A template is a set of top-level sections; only Resources is required:

• Parameters make one template reusable across environments and accounts. Rule of thumb: a value that differs per deployment and can't be derived is a parameter; a value derivable from the Region, account or environment is a mapping or a condition; a value managed elsewhere (latest AMI, shared settings) comes from Parameter Store.

Exam facts

• Type is the only required attribute. Base types: String, Number (validated as a number, but Ref returns a string), List<Number>, CommaDelimitedList (items are space-trimmed; Ref returns a list). Parameters are local to their template: other stacks can't Ref them (share values through outputs, §5).
• Constraints: AllowedValues, AllowedPattern (regex matching the whole value, or each item of a list), MinLength/MaxLength (String), MinValue/MaxValue (Number), ConstraintDescription (custom error text), Default, Description (up to 4,000 characters), NoEcho. YAML quirk: quote 'Yes'/'No' in AllowedValues, or the parser reads booleans.
• No Default and no value supplied → the operation fails with Parameters: [Name] must have values.
• AWS-specific types validate against existing resources in the deploying account and Region and give console drop-downs: AWS::EC2::KeyPair::KeyName, AWS::EC2::VPC::Id, AWS::EC2::Subnet::Id, AWS::EC2::SecurityGroup::Id, AWS::EC2::Image::Id, AWS::EC2::AvailabilityZone::Name, AWS::Route53::HostedZone::Id, plus List<…> variants. Values from another account → use String.
• SSM parameter types take a Parameter Store name and resolve its value at every create, update and change set: AWS::SSM::Parameter::Value<String>, AWS::SSM::Parameter::Value<List<String>>, AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> (latest AMI from a public parameter), AWS::SSM::Parameter::Name (existence check only). UsePreviousValue keeps the parameter key, not the old value. Constraints are checked against the key, not the value. A parameter shared from another account needs its full ARN. SecureString is not supported as a parameter type: use an ssm-secure dynamic reference (§14).
• NoEcho: true shows ***** in describe calls and events but doesn't mask a value you copy into Outputs, the Metadata section or a resource's Metadata attribute; AWS recommends dynamic references for secrets.
• Rules (optional RuleCondition plus required Assertions of Assert/AssertDescription) use rule functions (Fn::Contains, Fn::EachMemberEquals, Fn::EachMemberIn, Fn::RefAll, Fn::ValueOf, Fn::ValueOfAll, plus Fn::And, Fn::Or, Fn::Not, Fn::Equals, Fn::If); a failed assertion stops the operation before any resource is created or updated.
• Transform: a template with transforms is deployed through a change set (what deploy does) or directly with CAPABILITY_AUTO_EXPAND (§6). SAM resources and Globals: see notes/sam-guide.md.

Developer angle

Parameters with validation, an SSM parameter type and a rule:

Parameters:
  Env: {Type: String, AllowedValues: [dev, prod], Default: dev}
  InstanceType: {Type: String, Default: t3.micro, AllowedPattern: "^[a-z0-9]+\\.[a-z0-9]+$",
                 ConstraintDescription: "must look like family.size, for example t3.micro"}
  VpcId: {Type: "AWS::EC2::VPC::Id"}
  SubnetIds: {Type: "List<AWS::EC2::Subnet::Id>"}
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
Rules:
  ProdInstanceSize:
    RuleCondition: !Equals [!Ref Env, prod]
    Assertions:
      # x86_64 types, like the AMI (Graviton types such as m7g need the -arm64 AMI parameter)
      - Assert: {"Fn::Contains": [[m7i.large, m7i.xlarge], !Ref InstanceType]}
        AssertDescription: prod stacks must use m7i.large or m7i.xlarge
Resources:
  WorkerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: !Sub "Orders workers (${Env})"
      VpcId: !Ref VpcId

# list-type values: escape the commas
aws cloudformation create-stack --stack-name orders-workers --template-body file://workers.yaml \
  --parameters ParameterKey=VpcId,ParameterValue=vpc-0a1b2c3d4e5f67890 'ParameterKey=SubnetIds,ParameterValue=subnet-0a1b2c3d\,subnet-4e5f6a7b'
aws cloudformation get-template-summary --template-body file://workers.yaml --query Parameters

• Console drop-downs for AWS-specific types need describe permissions (ec2:DescribeVpcs, ec2:DescribeSubnets, ec2:DescribeKeyPairs, ec2:DescribeSecurityGroups); a missing Parameter Store name in an SSM parameter type fails the operation with a validation error before anything is created.

Traps

• Trap: "NoEcho hides the password everywhere." → Reality: it is visible again wherever you copy it (outputs, metadata); keep secrets out of parameters with dynamic references.
• Trap: "UsePreviousValue on an AMI parameter of an SSM type keeps last month's AMI." → Reality: it keeps the key and re-reads the latest value, which can replace instances on the next update.
• Trap: "Declare the database password as AWS::SSM::Parameter::Value<SecureString>." → Reality: not supported; use {{resolve:ssm-secure:…}} in a supported property.
• Trap: "Use AWS::EC2::Subnet::Id so users can pick a subnet from another account." → Reality: AWS-specific types only accept values from the deploying account and Region; use String.
• Trap: "Conditions reject invalid input." → Reality: conditions only include or skip resources; AllowedValues, AllowedPattern and Rules reject input.

Practice questions

1. A developer maintains a template that launches EC2 instances in several Regions. Every deployment must use the latest Amazon Linux 2023 AMI for its Region, without anyone editing the template or looking up AMI IDs. Which approach meets these requirements with the LEAST operational overhead?

   • A. A Mappings section keyed by Region that lists the current Amazon Linux 2023 AMI ID for every Region the company uses.
   • B. A String parameter with an AllowedPattern of ^ami-[0-9a-f]{17}$ and a ConstraintDescription that explains the format.
   • C. An AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> parameter that defaults to the public AL2023 parameter.
   • D. A parameter of type AWS::EC2::Image::Id whose default value is the AMI ID that is current at the time of each release.

2. A template takes Env (dev or prod) and InstanceType. CloudFormation must reject a create-stack request before any resource is created when Env is neither value, or when Env is prod and InstanceType isn't m7g.large. Which TWO template features meet these requirements? (Select TWO.)

   • A. AllowedValues on the Env parameter.
   • B. A condition IsProd attached to the instance resource.
   • C. NoEcho on the InstanceType parameter.
   • D. A Rules entry whose RuleCondition checks Env and whose assertion uses Fn::Contains on InstanceType.
   • E. An AWS::CloudFormation::WaitCondition that the instance depends on.

3. Mappings conditions and outputs

Concept

• Mappings are fixed lookup tables inside the template (Region → instance size, environment → log retention). Pick a mapping when the set of possible values is closed and the right entry follows from a key CloudFormation can supply: the Region, the account, an environment parameter.
• Conditions decide at create and update time whether a resource or output exists and which property value applies; typical drivers are the environment, the Region or an optional parameter left empty.
• Outputs publish values after the stack is built: shown in the console and describe-stacks, read by scripts and pipelines, exported to other stacks (§5).

Exam facts

• Mappings have two levels (map → top-level key → second-level key → value); keys are literal strings; values are strings or lists; the section can't contain parameters, pseudo parameters or functions. Read them with !FindInMap [MapName, TopLevelKey, SecondLevelKey], whose keys can use only Ref and nested Fn::FindInMap (more functions with AWS::LanguageExtensions). Mapping = known, static, keyed choices; parameter = user-specific input; Parameter Store = values that change outside the template (AWS recommends it over Region → AMI maps).
• ⚠️ Changed: an optional fourth argument DefaultValue returns a fallback instead of failing on a missing key, in any template. Older material may say DefaultValue requires the AWS::LanguageExtensions transform.
• Condition functions: Fn::Equals (two values), Fn::And and Fn::Or (2–10 conditions each), Fn::Not (one condition), Fn::If ([condition, value_if_true, value_if_false]) and Condition: Name to reuse a condition. Inputs: parameters, pseudo parameters, mappings and other conditions, never resource attributes.
• Apply a condition with the Condition attribute on a resource or output; use Fn::If in resource properties, outputs, the Metadata attribute and UpdatePolicy. Returning !Ref AWS::NoValue from Fn::If removes the property entirely.
• Conditions are re-evaluated on every update: a resource whose condition becomes false is deleted (its DeletionPolicy applies, §9). Anything that references a conditional resource needs the same condition or an Fn::If, otherwise the template fails when the condition is false.
• CloudFormation doesn't count edits that only touch conditions, outputs, DeletionPolicy or UpdatePolicy (or unused mapping values) as an update; include a resource change, for example in a resource's Metadata attribute.
• Outputs: up to 200 per template; Value required; Description a literal of up to 1,024 bytes; optional Export (§5) and Condition. Output values aren't redacted (never output secrets) and aren't available while the stack is in an *_IN_PROGRESS state.

Developer angle

Mapping with a fallback, conditions, a conditional resource, a removable property and outputs:

Parameters:
  Env: {Type: String, AllowedValues: [dev, prod]}
  AlarmEmail: {Type: String, Default: ""}
Mappings:
  EnvSettings:
    dev: {LogRetention: "7"}
    prod: {LogRetention: "365"}
Conditions:
  IsProd: !Equals [!Ref Env, prod]
  ProdWithEmail: !And [!Condition IsProd, !Not [!Equals [!Ref AlarmEmail, ""]]]
Resources:
  AppLogs:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: !FindInMap [EnvSettings, !Ref Env, LogRetention, {DefaultValue: "30"}]
  ReportsBucket:
    Type: AWS::S3::Bucket
    Properties:
      VersioningConfiguration: !If [IsProd, {Status: Enabled}, !Ref "AWS::NoValue"]
  AlarmTopic:
    Type: AWS::SNS::Topic
    Condition: ProdWithEmail
    Properties:
      Subscription: [{Protocol: email, Endpoint: !Ref AlarmEmail}]
Outputs:
  BucketName:
    Value: !Ref ReportsBucket
  AlarmTopicArn:
    Condition: ProdWithEmail
    Value: !Ref AlarmTopic

aws cloudformation describe-stacks --stack-name orders-prod \
  --query "Stacks[0].Outputs[?OutputKey=='BucketName'].OutputValue" --output text

Traps

• Trap: "Base a condition on whether a resource was created or on its attribute." → Reality: conditions see only parameters, pseudo parameters, mappings and other conditions.
• Trap: "Put !Ref Env inside a mapping value." → Reality: the Mappings section is static; select keys with !Ref inside Fn::FindInMap instead.
• Trap: "An output can reference a conditional resource on its own." → Reality: give the output the same Condition (or an Fn::If), or the stack fails when the condition is false.
• Trap: "Change only an output and run update-stack." → Reality: not treated as an update; pair it with a resource change.
• Trap: "Switching Env from prod to dev just hides the prod-only database." → Reality: the resource is deleted on that update unless its DeletionPolicy keeps it.

Practice questions

1. A developer uses one template for dev and prod stacks. Only prod stacks must contain an Amazon SQS dead-letter queue; dev stacks must not create it. Which approach meets this requirement with the LEAST template duplication?

   • A. Add a condition based on the Env parameter and set it as the queue's Condition attribute.
   • B. Maintain separate dev.yaml and prod.yaml templates and have the pipeline select the right one for each environment.
   • C. Put the queue's properties in a Mappings entry for prod and leave the dev entry empty.
   • D. Set DeletionPolicy: Delete on the queue and delete it by hand after each dev deployment.

2. In a shared template, an AWS::RDS::DBInstance named ReportsDb is created only when the IsProd condition is true. An output ReportsEndpoint returns !GetAtt ReportsDb.Endpoint.Address. Creating a dev stack from the template fails. Which TWO changes would each let the same template deploy in both environments? (Select TWO.)

   • A. Add DependsOn: ReportsDb to the ReportsEndpoint output.
   • B. Move the ReportsDb definition into a Mappings entry for prod.
   • C. Add Condition: IsProd to the ReportsEndpoint output.
   • D. Replace Fn::GetAtt with Fn::ImportValue in the output.
   • E. Change the output value to !If [IsProd, !GetAtt ReportsDb.Endpoint.Address, "not-deployed"].

4. Intrinsic functions and pseudo parameters

Concept

• Intrinsic functions compute values during stack operations. They are allowed in resource properties, outputs, the Metadata attribute, UpdatePolicy and conditions; not in Parameters, mapping keys or AWSTemplateFormatVersion.
• Pseudo parameters are always available without declaration: AWS::AccountId, AWS::Region, AWS::StackName, AWS::StackId (stack ARN), AWS::Partition (aws, aws-cn, aws-us-gov), AWS::URLSuffix (amazonaws.com), AWS::NotificationARNs and AWS::NoValue (removes a property).
• References through Ref, Fn::GetAtt and Fn::Sub also create the dependencies that order creation; DependsOn is only for hidden dependencies (for example an Elastic IP that needs the internet gateway attachment, or a resource that must wait for a separate IAM policy).

Exam facts

• What Ref returns for common resources: AWS::EC2::Instance → instance ID; AWS::S3::Bucket → bucket name; AWS::SQS::Queue → queue URL (ARN via !GetAtt Queue.Arn); AWS::SNS::Topic → topic ARN; AWS::Lambda::Function → function name (ARN via !GetAtt Fn.Arn); AWS::IAM::Role → role name (!GetAtt Role.Arn); AWS::DynamoDB::Table → table name (!GetAtt Table.Arn, !GetAtt Table.StreamArn); AWS::EC2::EIP → IP address. The resource's Template Reference page lists Ref and GetAtt values.
• ⚠️ Changed: the function is named Ref (JSON {"Ref": "Name"}, YAML Ref: Name or !Ref Name); there is no Fn:: prefix. Older material may say Fn::Ref.
• Fn::Sub needs no variable map for parameters, resources, attributes and pseudo parameters; ${!Literal} writes a literal ${Literal} (inside launch template data write \${!Literal}, or it resolves to an empty string); the template string itself can't contain functions (use the variable map).
• Without the language extensions, the Fn::GetAtt logical name must be a literal and the attribute name can use only Ref.
• Short-form YAML rule: a short-form function can't directly wrap another short-form function: !Base64 !Sub …, !GetAZs !Ref … and !ImportValue !Sub … are invalid. Write the outer one in full form (Fn::Base64: !Sub |).
• Language extensions: Fn::ForEach replicates resources, outputs or conditions over a list (quotas apply to the expanded template); use full names (Fn::Length, not !Length); with SAM, list AWS::LanguageExtensions before AWS::Serverless-2016-10-31; avoid --use-previous-template because the stored processed template holds already-resolved literals.

Developer angle

Parameters:
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
Resources:
  ReportsBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "reports-${AWS::AccountId}-${AWS::Region}"
  WorkerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: t3.micro
      AvailabilityZone: !Select [0, !GetAZs ""]
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          echo "STACK=${AWS::StackName} BUCKET=${ReportsBucket}" > /etc/worker.env
          echo 'Literal kept for the shell: ${!HOME}' >> /etc/worker.env
Outputs:
  DailyReportsArn:
    Value: !Sub "${ReportsBucket.Arn}/daily/*"

# physical ID behind a logical ID (what Ref returned)
aws cloudformation describe-stack-resource --stack-name reports --logical-resource-id ReportsBucket \
  --query StackResourceDetail.PhysicalResourceId --output text

Traps

• Trap: "!Ref MyQueue gives the ARN for an IAM policy." → Reality: it gives the queue URL; use !GetAtt MyQueue.Arn.
• Trap: "!Ref MyFunction is the function ARN." → Reality: it is the name; !GetAtt MyFunction.Arn for ARNs (permissions, event sources).
• Trap: "UserData: !Base64 !Sub | is fine." → Reality: two consecutive short forms are invalid; use Fn::Base64: !Sub |.
• Trap: "Put !GetAtt inside the Fn::Sub string." → Reality: write ${Resource.Attribute} in the string, or pass functions through the variable map.
• Trap: "Use Fn::ForEach in any template." → Reality: it needs Transform: AWS::LanguageExtensions.
• Trap: "Write ARNs as arn:aws:… with a literal account ID and Region." → Reality: use ${AWS::Partition}, ${AWS::AccountId} and ${AWS::Region} so the template works in every account, Region and partition (China, GovCloud).
• Trap: "In JSON, reference a parameter with {"Fn::Ref": "Env"}." → Reality: the function is Ref: {"Ref": "Env"}.

Practice questions

1. A template creates an AWS::SQS::Queue with the logical ID JobsQueue and an inline IAM policy that must allow sqs:SendMessage on that queue. With Resource: !Ref JobsQueue, the stack fails because IAM rejects the policy document. Which value should the Resource element use?

   • A. !Sub "arn:aws:sqs:::${JobsQueue}"
   • B. !Ref JobsQueue.Arn
   • C. !GetAtt JobsQueue.QueueUrl
   • D. !GetAtt JobsQueue.Arn

2. A developer writes UserData: !Base64 !Sub | followed by a script that uses ${AWS::StackName} and ${AWS::Region}, and CloudFormation rejects the template. The script must keep its substitutions. Which TWO rewrites are valid? (Select TWO.)

   • A. UserData: !Base64 !Join followed by a list that rebuilds the script line by line.
   • B. UserData: followed by an indented Fn::Base64: !Sub | block.
   • C. UserData: !Sub !Base64 | followed by the script.
   • D. UserData: !Sub | followed by the script, because CloudFormation base64-encodes UserData automatically.
   • E. UserData: !Base64 followed by an indented "Fn::Sub": | block.

5. Exports and nested stacks

Concept

• Cross-stack references (exports): a producer stack exports an output (Export: Name); consumers read it with Fn::ImportValue. Stacks keep separate lifecycles and owners (the platform team's network stack, each app team's stack), and CloudFormation enforces the link.
• Nested stacks: a parent declares AWS::CloudFormation::Stack resources pointing to child templates in S3; the root and all children deploy, update and delete as one unit. Use them for reusable components (a standard load balancer, a hardened bucket) and to get past the 500-resource limit.
• ⚠️ Changed: Fn::GetStackOutput reads an output of any stack — same account, another Region or another account (through RoleArn) — without an export, as a weak reference resolved at deploy time. Older material may say stack outputs can be shared only within one account and Region.

Exam facts

• Export names are unique per account per Region; Fn::ImportValue works only within the same account and Region.
• While any stack imports an export, CloudFormation refuses to delete the exporting stack or to change or remove that output. list-imports --export-name shows the consumers; remove their imports first.
• An export Name and an ImportValue argument may use functions (typically !Sub "${NetworkStackName}-VpcId") but not Ref or GetAtt on resources.
• !ImportValue can't wrap the !Sub short form: write Fn::ImportValue: !Sub "…".
• Nested stacks: TemplateURL (S3; aws cloudformation package uploads local child templates and rewrites it) and string Parameters for the child; the parent reads child outputs with !GetAtt ChildStack.Outputs.OutputName. Updates, change sets and deletes start from the root stack (only changed children are updated); updating a nested stack directly is discouraged. Termination protection is set on the root and inherited. One nested-stack operation can touch at most 2,500 resources.
• Choosing: share values with other, independently managed stacks → exports; reuse a component inside one deployment unit → nested stacks; a value from another account or Region → Fn::GetStackOutput.
• Fn::GetStackOutput takes StackName, OutputName, optional Region and optional RoleArn (a role in the producer account with cloudformation:DescribeStacks, assumable by the consumer stack's execution role). It gives no referential integrity (protect the producer yourself), consumers see a new value only on their next update, cross-partition references aren't supported, and it currently works as a direct property value or inside Fn::Join, Fn::If and Fn::Select (not as an Outputs value or inside an Fn::Sub map).

Developer angle

Producer exports; the consumer imports, nests a component and reads a cross-account output:

# network.yaml (producer)
Resources:
  Vpc:
    Type: AWS::EC2::VPC
    Properties: {CidrBlock: 10.0.0.0/16}
Outputs:
  VpcId:
    Value: !Ref Vpc
    Export:
      Name: !Sub "${AWS::StackName}-VpcId"

# app.yaml (consumer)
Parameters:
  NetworkStackName: {Type: String, Default: network-prod}
Resources:
  AppSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: App tier
      VpcId:
        Fn::ImportValue: !Sub "${NetworkStackName}-VpcId"
  ArtifactBucketStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: ./templates/hardened-bucket.yaml  # package rewrites this to an S3 URL
      Parameters: {RetentionDays: "30"}
  ReportsQueue:
    Type: AWS::SQS::Queue
    Properties:
      KmsMasterKeyId:
        Fn::GetStackOutput:
          StackName: shared-keys
          OutputName: QueueKeyArn
          Region: eu-west-1
          RoleArn: arn:aws:iam::111111111111:role/ReadSharedOutputs
Outputs:
  ArtifactBucketName:
    Value: !GetAtt ArtifactBucketStack.Outputs.BucketName

aws cloudformation list-exports --query "Exports[].[Name,Value]" --output table
aws cloudformation list-imports --export-name network-prod-VpcId

Traps

• Trap: "Delete the network stack first; the app stacks keep working." → Reality: deletion is refused while any stack imports its exports.
• Trap: "Change an exported value in place." → Reality: refused while imported; add a new export, move consumers, then remove the old one.
• Trap: "Fn::ImportValue across Regions or accounts." → Reality: same account and Region only; use Fn::GetStackOutput (weak) or pass values another way.
• Trap: "Update a child nested stack directly." → Reality: update the root; it updates the children that changed.
• Trap: "Nest every app stack inside the network stack to share the VPC." → Reality: independent teams and lifecycles call for exports.
• Trap: "Fn::GetStackOutput protects the producer like an export." → Reality: it is a weak reference; a deleted producer breaks the consumer's next update.

Practice questions

1. A platform team owns a VPC stack. Twelve application teams deploy their own stacks on their own schedules and need the VPC ID and private subnet IDs. The platform team must be prevented from accidentally deleting or changing those values while any application uses them. Which approach meets these requirements?

   • A. Nest each application stack inside the VPC stack as an AWS::CloudFormation::Stack resource.
   • B. Export the IDs as VPC stack outputs and use Fn::ImportValue in each application template.
   • C. Copy the IDs into each application template as String parameter defaults and update them when the network changes.
   • D. Read the IDs in each application template with Fn::GetStackOutput, which needs no export declaration.

2. A developer wants to delete an old shared-network stack, but CloudFormation blocks the deletion because another stack imports one of its exports. The network stack must be deleted without leaving the consuming stacks broken. Which TWO actions should the developer take? (Select TWO.)

   • A. Run aws cloudformation list-imports --export-name with the export's name to find the importing stacks.
   • B. Run delete-stack with --retain-resources, listing the logical IDs of the outputs that other stacks import.
   • C. Update each importing stack to stop using that export, then delete the network stack.
   • D. Disable termination protection on the network stack.
   • E. Rename the export in the network stack's Outputs section and update the network stack.

6. Service roles and capabilities

Concept

• Without a service role, CloudFormation acts with a temporary session made from the caller's credentials, so the caller needs permissions for every resource in the template plus the CloudFormation actions.
• A service role is an IAM role that cloudformation.amazonaws.com assumes for stack operations. Developers then need only CloudFormation permissions and iam:PassRole on that role: they can deploy approved infrastructure without holding the underlying permissions (least privilege).
• Capabilities are explicit acknowledgements for templates that can change permissions or rewrite themselves: CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND. A missing one stops the operation before anything is created.

Exam facts

• Pass the role with --role-arn (create-stack, update-stack, delete-stack, create-change-set, deploy). Once associated, CloudFormation uses it for all later operations on the stack, including for users who couldn't pass it themselves; it can be replaced on an update but not removed. A powerful service role is therefore a privilege-escalation path: keep it least privilege.
• If no role is given, CloudFormation reuses the role already associated with the stack, otherwise the caller's session. That reuse doesn't satisfy a cloudformation:RoleARN condition: the key is set only when the request passes --role-arn, so under the developer policy below, an update-stack or create-change-set without it is implicitly denied. A deleted or under-privileged role makes operations fail with access-denied status reasons.
• Long operations (RDS, Auto Scaling groups, nested stacks) can outlast the caller's session; AWS's fix for such stabilization timeouts is to deploy with a service role.
• iam:PassRole on the service role ARN is required to associate it; narrow it with iam:PassedToService = cloudformation.amazonaws.com. PassRole mechanics: see notes/advanced-identity-guide.md.
• CloudFormation condition keys (evaluated on create and update): cloudformation:RoleARN (force a specific service role), cloudformation:TemplateUrl (only approved template URLs), cloudformation:StackPolicyUrl, cloudformation:ResourceTypes (allowed types; callers must send --resource-types), cloudformation:ImportResourceTypes, cloudformation:ChangeSetName. Don't use aws:SourceIp: CloudFormation calls other services from its own addresses.
• CAPABILITY_IAM: the template creates or changes IAM resources (AWS::IAM::Role, User, Group, Policy, ManagedPolicy, InstanceProfile, AccessKey, UserToGroupAddition) with generated names.
• CAPABILITY_NAMED_IAM: required as soon as one of them has a custom name (RoleName, UserName, GroupName, ManagedPolicyName…); it also covers the unnamed case.
• CAPABILITY_AUTO_EXPAND: needed to create or update a stack directly (without reviewing a change set) from a template that contains macros or transforms (AWS::Serverless, AWS::Include, custom macros), including templates that combine macros and nested stacks; on create-change-set it has no effect. ⚠️ Changed: nested stacks on their own don't need it; it is about macros. Older material may say any template with nested stacks needs CAPABILITY_AUTO_EXPAND.
• Capabilities are acknowledged per request: every update-stack, create-change-set or deploy of a template that still contains IAM resources must send the IAM capability again (and a direct update-stack of a template with macros needs CAPABILITY_AUTO_EXPAND again).
• A missing capability returns the API error InsufficientCapabilities (HTTP 400; the CLI prints InsufficientCapabilitiesException and names the capability). validate-template returns the required Capabilities and a CapabilitiesReason. Console equivalent: the "I acknowledge that this template may create IAM resources" check box.
• Custom-named IAM resources are global per account: the same template with a fixed RoleName in two Regions collides. Add ${AWS::Region} to the name or let CloudFormation generate it.

Developer angle

Trust policy of the service role, then a developer policy that only allows stacks deployed through that role:

{"Version": "2012-10-17",
 "Statement": [{"Effect": "Allow",
                "Principal": {"Service": "cloudformation.amazonaws.com"},
                "Action": "sts:AssumeRole"}]}

{
  "Version": "2012-10-17",
  "Statement": [
    {"Effect": "Allow",
     "Action": ["cloudformation:CreateStack", "cloudformation:UpdateStack", "cloudformation:CreateChangeSet"],
     "Resource": "arn:aws:cloudformation:eu-west-1:111122223333:stack/orders-*/*",
     "Condition": {"StringEquals": {"cloudformation:RoleARN": "arn:aws:iam::111122223333:role/cfn-orders-deployer"}}},
    {"Effect": "Allow",
     "Action": ["cloudformation:ExecuteChangeSet", "cloudformation:DescribeStacks", "cloudformation:DescribeStackEvents"],
     "Resource": "arn:aws:cloudformation:eu-west-1:111122223333:stack/orders-*/*"},
    {"Effect": "Allow",
     "Action": "iam:PassRole",
     "Resource": "arn:aws:iam::111122223333:role/cfn-orders-deployer",
     "Condition": {"StringEquals": {"iam:PassedToService": "cloudformation.amazonaws.com"}}}
  ]
}

aws cloudformation validate-template --template-body file://orders.yaml --query "[Capabilities,CapabilitiesReason]"
aws cloudformation create-stack --stack-name orders-prod \
  --template-url https://orders-templates-111122223333.s3.eu-west-1.amazonaws.com/orders.yaml \
  --role-arn arn:aws:iam::111122223333:role/cfn-orders-deployer --capabilities CAPABILITY_NAMED_IAM

Traps

• Trap: "Give developers the S3, Lambda and IAM permissions the template needs." → Reality: give the permissions to a service role; developers get CloudFormation actions plus iam:PassRole.
• Trap: "CAPABILITY_IAM is enough for a role with RoleName." → Reality: custom names need CAPABILITY_NAMED_IAM.
• Trap: "Every nested-stack template needs CAPABILITY_AUTO_EXPAND." → Reality: macros and transforms do, when you skip the change set.
• Trap: "Remove the service role from the stack later." → Reality: it can be replaced, not removed.
• Trap: "Only users who can pass the role can use it after creation." → Reality: anyone allowed to operate on the stack uses the associated role.
• Trap: "Restrict deployments with aws:SourceIp." → Reality: CloudFormation calls services from its own IP addresses.

Practice questions

1. A company wants developers to deploy approved templates that create S3 buckets and Lambda functions. Developers must not hold permissions to create those resources directly. Which solution meets the requirement and follows least privilege?

   • A. Create a service role with the S3 and Lambda permissions, and let developers pass only that role to CloudFormation.
   • B. Attach AmazonS3FullAccess and AWSLambda_FullAccess to the developers' IAM role for the duration of each deployment window.
   • C. Have developers deploy with access keys of a shared IAM user that holds the S3 and Lambda permissions.
   • D. Add CAPABILITY_NAMED_IAM to every deployment that creates the S3 buckets and Lambda functions.

2. A pipeline runs aws cloudformation create-stack on a template that declares Transform: AWS::Serverless-2016-10-31 and an AWS::IAM::Role with RoleName: orders-worker. The call fails with InsufficientCapabilitiesException. Which TWO changes allow the stack creation to succeed? (Select TWO.)

   • A. Add CAPABILITY_IAM to --capabilities.
   • B. Add CAPABILITY_NAMED_IAM to --capabilities.
   • C. Add --role-arn with a service role that allows iam:CreateRole.
   • D. Add CAPABILITY_AUTO_EXPAND to --capabilities.
   • E. Add --enable-termination-protection to the call.

7. Change sets

Concept

• A change set previews an update (or a creation or import): CloudFormation compares the submitted template and parameters with the current stack and lists what it would add, modify, remove or import, including whether each modification replaces the resource. Nothing changes until you execute it.
• Several change sets can coexist for one stack; executing one deletes the others because they no longer match the stack.
• Typical use: a reviewer approves the change set (often a manual approval in CodePipeline, see notes/cicd-guide.md) before production changes apply.

Exam facts

• Commands: create-change-set (types UPDATE by default, CREATE for a new stack, which sits in REVIEW_IN_PROGRESS, and IMPORT, §13), describe-change-set (--include-property-values for before and after values), execute-change-set, delete-change-set, list-change-sets. A change set is ready when its status is CREATE_COMPLETE and ExecutionStatus is AVAILABLE; one without differences ends in FAILED.
• Reading a change: Action (Add, Modify, Remove, Import, Dynamic = exact action known only at execution, SyncWithActual = only CloudFormation's metadata changes), Replacement (True, False, Conditional = may replace, decided at execution), Details[].Target.RequiresRecreation (Never, Conditionally, Always), Evaluation (Static, Dynamic), ChangeSource (for example DirectModification, ParameterReference, ResourceReference, Automatic).
• Change sets don't guarantee success. ⚠️ Changed: pre-deployment validation runs on create-stack, update-stack and create-change-set: property syntax and resource-name conflicts fail the operation before anything is provisioned; change set creation also warns (without failing) about non-empty S3 buckets to delete, service quotas, AWS Config recorder conflicts and non-empty ECR repositories. --disable-validation skips it; describe-events shows the results. Older material may say change sets only diff templates and catch nothing before execution.
• ⚠️ Changed: drift-aware change sets (--deployment-mode REVERT_DRIFT) compare desired, previous-deployment and actual state and overwrite out-of-band changes, except AWS-managed properties (such as an Auto Scaling group's desired capacity), write-only properties and immutable properties; a failed execution rolls back to the actual pre-deployment state. Older material may say change sets compare only the new template with the last one and ignore drift.
• Nested stacks: the console enables nested change sets by default; the CLI needs --include-nested-stacks. Execute or delete only from the root change set.
• execute-change-set --disable-rollback preserves successful resources on failure (§8); express mode is chosen when creating the change set (--deployment-config).
• Templates with transforms (SAM, AWS::Include, AWS::LanguageExtensions) are processed in change sets; the processed template is visible in the change set. aws cloudformation deploy = create plus execute a change set.
• Parameter Store values (SSM parameter types and ssm references) are read when the change set is created; values changed before execution aren't picked up.
• IAM: cloudformation:CreateChangeSet, DescribeChangeSet, ExecuteChangeSet, DeleteChangeSet; the cloudformation:ChangeSetName condition key limits which change sets a user may execute or delete (separation of duties: developers create, approvers execute).

Developer angle

aws cloudformation create-change-set --stack-name orders-prod --change-set-name add-gsi-2026-10-12 \
  --template-body file://orders.yaml --parameters ParameterKey=Env,UsePreviousValue=true --capabilities CAPABILITY_IAM
aws cloudformation wait change-set-create-complete --stack-name orders-prod --change-set-name add-gsi-2026-10-12
aws cloudformation describe-change-set --stack-name orders-prod --change-set-name add-gsi-2026-10-12 --output table \
  --query "Changes[].ResourceChange.[Action,LogicalResourceId,ResourceType,Replacement]"
aws cloudformation execute-change-set --stack-name orders-prod --change-set-name add-gsi-2026-10-12
# overwrite console edits back to the template values
aws cloudformation create-change-set --stack-name orders-prod --change-set-name revert-console-edits \
  --use-previous-template --deployment-mode REVERT_DRIFT

A pipeline gate that stops when a change set would replace anything:

import boto3

cfn = boto3.client("cloudformation")
changes = cfn.describe_change_set(StackName="orders-prod", ChangeSetName="add-gsi-2026-10-12")["Changes"]
replaced = [c["ResourceChange"]["LogicalResourceId"] for c in changes
            if c["Type"] == "Resource" and c["ResourceChange"].get("Replacement") in ("True", "Conditional")]
if replaced:
    raise SystemExit(f"Change set replaces resources: {replaced}")

Traps

• Trap: "A successful change set guarantees a successful update." → Reality: it previews changes; runtime failures (permissions, quotas, custom resources) can still occur.
• Trap: "Replacement: Conditional means no replacement." → Reality: the resource may be replaced depending on a value resolved at execution; treat it as possible.
• Trap: "Execute a nested change set on its own." → Reality: execute the root change set; it applies the whole hierarchy.
• Trap: "create-change-set from the CLI includes nested stacks." → Reality: add --include-nested-stacks.
• Trap: "Other change sets stay usable after one is executed." → Reality: CloudFormation deletes them.
• Trap: "A standard change set shows console edits that the update will overwrite." → Reality: only a drift-aware change set compares against actual state.

Practice questions

1. Before updating a production stack, a developer must see which resources would be replaced without changing anything, and a reviewer must approve before the changes apply. What should the developer do?

   • A. Run update-stack with --disable-rollback, inspect the stack events, and roll back manually if needed.
   • B. Run detect-stack-drift on the stack and review the drift results with the reviewer before updating.
   • C. Create a change set, review its Replacement values, and execute it after approval.
   • D. Run validate-template on the new template and share the returned capabilities with the reviewer.

2. A root stack contains two nested stacks. A developer runs aws cloudformation create-change-set on the root stack with an updated child template and sees only an AWS::CloudFormation::Stack modification, with no detail about the child's resources. Which TWO statements are correct? (Select TWO.)

   • A. The developer must create a separate change set on each nested stack and execute them one by one.
   • B. Adding --include-nested-stacks creates nested change sets that show the child resources' changes.
   • C. The nested change sets are executed by executing the root change set.
   • D. Change sets don't support stacks that contain nested stacks.
   • E. Running execute-change-set on a nested change set applies only that child's changes.

8. Rollbacks and stack failure options

Concept

• By default a failure undoes the operation: a failed create deletes what it made (ROLLBACK_COMPLETE), a failed update returns to the last working state (UPDATE_ROLLBACK_COMPLETE).
• You can trade automatic cleanup for debuggability (preserve successfully provisioned resources), add alarms that force a rollback (rollback triggers), and repair stacks stuck in failed states (UPDATE_ROLLBACK_FAILED, DELETE_FAILED).

Exam facts

• OnFailure for creates: ROLLBACK (default), DO_NOTHING, DELETE; --disable-rollback equals DO_NOTHING and can't be combined with --on-failure (change sets use --on-stack-failure with the same values). StackSets create stack instances with DELETE behaviour.
• Preserve successfully provisioned resources (console) = --disable-rollback on create-stack, update-stack, execute-change-set and deploy: CloudFormation stops at the first failure on each provisioning path and leaves the stack in CREATE_FAILED or UPDATE_FAILED. Then Retry (cause fixed outside the template, e.g. IAM), Update (template fixed; keep preservation selected) or Roll back (rollback-stack, which deletes the stack if it never had a stable state). Not supported when the update replaces (immutable update) the failing resource.
• ⚠️ Changed: --retain-except-on-create (RetainExceptOnCreate) deletes resources that the failed operation newly created during rollback, even if their DeletionPolicy is Retain. Older material may say the only failure settings are rollback on or off and OnFailure.
• UPDATE_ROLLBACK_FAILED (a resource changed or deleted outside CloudFormation, missing signals, permissions, quotas, an expired token): the stack can't be updated, only deleted or rolled forward to UPDATE_ROLLBACK_COMPLETE. Fix the cause and run continue-update-rollback (missing signals: send them with signal-resource first); if it can't be fixed, skip resources with --resources-to-skip (logical IDs, NestedStackName.LogicalId for children; only resources that failed during the rollback). Skipped resources are marked UPDATE_COMPLETE but no longer match the template: reconcile before the next update.
• ⚠️ Changed: continue-update-rollback --force-rollback skips every resource that failed to roll back, across nested stacks, in one call (not combinable with --resources-to-skip; drift detection later reports skipped resources as NOT_CHECKED). Older material may say each resource must be listed in --resources-to-skip.
• Rollback triggers: up to 5 CloudWatch alarms (AWS::CloudWatch::Alarm or AWS::CloudWatch::CompositeAlarm) watched during the create or update and for 0–180 minutes afterwards (MonitoringTimeInMinutes, default 0); an alarm in ALARM rolls back the whole operation. INSUFFICIENT_DATA doesn't trigger unless missing data is treated as breaching; triggers aren't watched during a rollback; a missing alarm fails the operation.
• cancel-update-stack stops an update in UPDATE_IN_PROGRESS and rolls it back.
• DELETE_FAILED (non-empty S3 bucket, resource still in use, missing permission): fix and retry, or delete-stack --retain-resources LogicalId to finish deleting the stack while keeping the failing resources. ⚠️ Changed: --deletion-mode FORCE_DELETE_STACK (May 2024) force-deletes a stack stuck in DELETE_FAILED, keeping whatever failed to delete. Older material may say --retain-resources is the only way out. Retained resources show DELETE_SKIPPED and keep costing money.

Developer angle

# keep what worked, fix the template, retry in place (or give up with rollback-stack)
aws cloudformation create-stack --stack-name orders-dev --template-body file://orders.yaml --capabilities CAPABILITY_IAM --disable-rollback
aws cloudformation update-stack --stack-name orders-dev --template-body file://orders-fixed.yaml --capabilities CAPABILITY_IAM --disable-rollback
aws cloudformation rollback-stack --stack-name orders-dev
# a stack stuck in UPDATE_ROLLBACK_FAILED
aws cloudformation continue-update-rollback --stack-name orders-prod \
  --resources-to-skip LegacyQueue orders-prod-Storage-1A2B3C4D5E6F.ReportsDb
aws cloudformation continue-update-rollback --stack-name orders-prod --force-rollback
# roll back if the 5xx alarm fires during the update or the next 15 minutes
aws cloudformation update-stack --stack-name orders-prod --use-previous-template \
  --parameters ParameterKey=Env,UsePreviousValue=true --capabilities CAPABILITY_IAM \
  --rollback-configuration "RollbackTriggers=[{Arn=arn:aws:cloudwatch:eu-west-1:111122223333:alarm:orders-5xx,Type=AWS::CloudWatch::Alarm}],MonitoringTimeInMinutes=15"
# a stack stuck in DELETE_FAILED
aws cloudformation delete-stack --stack-name orders-dev --retain-resources UploadsBucket
aws cloudformation delete-stack --stack-name orders-dev --deletion-mode FORCE_DELETE_STACK

• Permissions: cloudformation:RollbackStack, cloudformation:ContinueUpdateRollback, cloudformation:CancelUpdateStack; make sure the deploying identity can cancel and roll back before starting risky nested updates.

Traps

• Trap: "continue-update-rollback recovers a failed create." → Reality: it is only for UPDATE_ROLLBACK_FAILED; a failed create ends in ROLLBACK_COMPLETE (delete) or, with preservation, CREATE_FAILED.
• Trap: "--resources-to-skip can skip resources that failed in the forward update." → Reality: only resources whose rollback failed.
• Trap: "Preservation works for any failing update." → Reality: not when the failing change replaces the resource.
• Trap: "Rollback triggers react to INSUFFICIENT_DATA." → Reality: only ALARM, unless the alarm treats missing data as breaching.
• Trap: "FORCE_DELETE_STACK is a faster delete for healthy stacks." → Reality: it is a recovery option for stacks stuck in DELETE_FAILED.
• Trap: "--retain-resources cleans up the bucket for you." → Reality: the bucket stays, outside the stack, and keeps billing.

Practice questions

1. A stack update failed and the stack is now in UPDATE_ROLLBACK_FAILED, because an operator deleted an SQS queue that CloudFormation is trying to roll back to. The queue can't be recreated with its original identity. What should the developer do to return the stack to a usable state?

   • A. Run update-stack with the original template and the original parameter values.
   • B. Run rollback-stack on the stack to return it to its last known stable state.
   • C. Run delete-stack with --retain-resources for the queue, then create the stack again.
   • D. Run continue-update-rollback and skip the queue with --resources-to-skip.

2. While iterating on a template, a developer sees an EC2 instance fail during creation, and every rollback deletes the instance before its logs can be read. The developer wants to keep the successfully created resources, read /var/log/cfn-init.log, and then continue with the same stack after fixing the template. Which TWO actions meet these requirements? (Select TWO.)

   • A. Create the stack with --disable-rollback (Preserve successfully provisioned resources).
   • B. Create the stack with --on-failure DELETE and a longer --timeout-in-minutes value.
   • C. Add DeletionPolicy: Retain to the instance resource and to its security group resource.
   • D. Pass --enable-termination-protection when creating the stack again.
   • E. After fixing the template, run update-stack on the stack in CREATE_FAILED with failure preservation still selected.

9. Protecting resources and stacks

Concept

Four separate safety nets, each for a different event:

Exam facts

• DeletionPolicy values: Delete (default for most types), Retain (any type; the resource leaves the stack and keeps costing money; the stack ends DELETE_COMPLETE and the resource shows DELETE_SKIPPED), Snapshot (final snapshot, then delete; snapshots remain and are billed), RetainExceptOnCreate (like Retain, except when the operation that created the resource rolls back).
• ⚠️ Changed: the default is Snapshot for AWS::RDS::DBCluster and for AWS::RDS::DBInstance without DBClusterIdentifier; Delete for everything else. Older material may say Delete is always the default.
• ⚠️ Changed: RetainExceptOnCreate is a fourth DeletionPolicy value (the same behaviour can be requested per operation with --retain-except-on-create). Older material may list only Delete, Retain and Snapshot.
• Snapshot is supported for AWS::EC2::Volume, AWS::ElastiCache::CacheCluster, AWS::ElastiCache::ReplicationGroup, AWS::RDS::DBInstance, AWS::RDS::DBCluster, AWS::Redshift::Cluster, AWS::Neptune::DBCluster and AWS::DocDB::DBCluster. An UpdateReplacePolicy: Snapshot on an unsupported type falls back to Delete.
• UpdateReplacePolicy values: Delete (default), Retain, Snapshot. It applies only when an update replaces the resource (new physical ID), for direct updates and change sets. DeletionPolicy doesn't cover replacement, so set both on stateful resources. For S3 buckets, Delete under either policy fails while the bucket holds objects (DELETE_FAILED): empty it first (custom resource, §10) or retain it.
• Stack policy: JSON statements with Effect, Action (Update:Modify, Update:Replace, Update:Delete, Update:*), Principal: "*" (the only value), Resource (LogicalResourceId/Name, wildcards allowed) or NotResource, and an optional Condition on ResourceType (StringEquals, or StringLike for wildcards). No policy → everything can be updated; once a policy is set, everything not explicitly allowed is denied; an explicit Deny wins; one policy per stack, the same for every user. It applies only to updates: it doesn't block stack deletion and isn't IAM access control.
• Set a stack policy at creation (--stack-policy-body or --stack-policy-url, up to 16 KB) or later with set-stack-policy (needs cloudformation:SetStackPolicy). It can't be deleted, only replaced (an allow-all policy lifts protection); --stack-policy-during-update-body overrides it for one update (the caller also needs cloudformation:SetStackPolicy). Use an explicit Deny rather than NotResource with Allow, which doesn't reliably protect a resource.
• Termination protection: off by default; enable with --enable-termination-protection at creation or update-termination-protection later (needs cloudformation:UpdateTerminationProtection). Set on the root stack and inherited by nested stacks (can't be changed on a child, and an update that removes a nested stack still deletes it). A delete attempt fails and leaves the stack unchanged. It doesn't block updates or resource deletions done through updates.
• Service-level deletion protection (DeletionProtectionEnabled on DynamoDB tables, DeletionProtection on RDS) complements these: it blocks deletion by anyone, CloudFormation included.

Developer angle

Resources:
  OrdersDb:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Properties: {Engine: postgres, DBInstanceClass: db.t4g.medium, AllocatedStorage: "50",
                 MasterUsername: orders_admin, ManageMasterUserPassword: true}
  UploadsBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain

Stack policy that blocks replacement or removal of the database and allows everything else:

{
  "Statement": [
    {"Effect": "Deny", "Action": ["Update:Replace", "Update:Delete"], "Principal": "*",
     "Resource": "LogicalResourceId/OrdersDb"},
    {"Effect": "Allow", "Action": "Update:*", "Principal": "*", "Resource": "*"}
  ]
}

aws cloudformation set-stack-policy --stack-name orders-prod --stack-policy-body file://stack-policy.json
aws cloudformation update-stack --stack-name orders-prod --template-body file://orders.yaml --capabilities CAPABILITY_IAM \
  --stack-policy-during-update-body file://allow-db-replace.json
aws cloudformation update-termination-protection --stack-name orders-prod --enable-termination-protection
aws cloudformation describe-stacks --stack-name orders-prod --query "Stacks[0].EnableTerminationProtection"

Traps

• Trap: "DeletionPolicy: Retain also keeps the old database when an update replaces it." → Reality: replacement is governed by UpdateReplacePolicy.
• Trap: "Termination protection stops updates from deleting resources." → Reality: it only blocks deleting the stack; use a stack policy for updates.
• Trap: "A stack policy prevents deleting the stack." → Reality: stack policies cover updates; deletes need termination protection.
• Trap: "Delete the stack policy when it gets in the way." → Reality: it can't be removed; replace it or override it for one update.
• Trap: "Different stack policies per user." → Reality: one policy per stack, applied to everyone; per-user control is IAM.
• Trap: "DeletionPolicy: Snapshot on an S3 bucket." → Reality: buckets don't support snapshots; use Retain.
• Trap: "An RDS instance in the template is deleted with the stack by default." → Reality: without DBClusterIdentifier, its default DeletionPolicy is Snapshot.

Practice questions

1. A production stack contains an AWS::RDS::DBInstance. If a future template change forces CloudFormation to replace the instance, the old instance's data must be kept as a snapshot. Which attribute meets this requirement?

   • A. DeletionPolicy: Snapshot
   • B. UpdateReplacePolicy: Snapshot
   • C. A stack policy that denies Update:Modify on the instance
   • D. Termination protection on the stack

2. A team must guarantee that nobody can delete the production stack by accident, and that stack updates can never replace or remove the OrdersTable resource while every other resource stays updatable. Which TWO actions meet these requirements? (Select TWO.)

   • A. Add DeletionPolicy: Retain to every resource in the template.
   • B. Set UpdateReplacePolicy: Retain on OrdersTable.
   • C. Enable termination protection on the stack.
   • D. Apply a stack policy that denies Update:Replace and Update:Delete on LogicalResourceId/OrdersTable and allows Update:* on everything else.
   • E. Attach an IAM policy that denies cloudformation:UpdateStack to all users.

10. Custom resources

Concept

• A custom resource runs your code (a Lambda function, or a consumer of an SNS topic) whenever the custom resource is created, updated or deleted. CloudFormation sends a JSON request that includes a presigned S3 ResponseURL and waits until your code uploads a SUCCESS or FAILED response there.
• Uses: services or settings CloudFormation doesn't support, external systems (on-premises, third-party APIs), lifecycle chores (empty a bucket before deletion, seed a table, look up a value for other resources).
• Alternative for reusable, shared types: registry resource types (private extensions), which support create, read, update, delete and list plus drift detection, without wiring a function into every template.

Exam facts

• Declare as Custom::MyName (recommended; type names up to 60 characters) or AWS::CloudFormation::CustomResource. ServiceToken (required) is the Lambda function ARN or SNS topic ARN, in the same Region as the stack. Other properties arrive as ResourceProperties (plus OldResourceProperties on updates).
• Request fields: RequestType (Create, Update, Delete), RequestId, StackId, LogicalResourceId, ResourceType, ResponseURL, PhysicalResourceId (updates and deletes).
• Response fields: Status, RequestId, StackId, LogicalResourceId (copied from the request), PhysicalResourceId (required, up to 1 KB, stable), Reason (required with FAILED), Data (read with !GetAtt MyCustom.Key), NoEcho (masks Data returned by GetAtt). The whole body is limited to 4,096 bytes.
• PhysicalResourceId sets update behaviour: the same ID means an in-place update; a new ID means a replacement, and CloudFormation later sends Delete for the old ID.
• No response → CloudFormation waits until the timeout, then fails the operation. ⚠️ Changed: the ServiceTimeout property (1–3,600 seconds, default 3,600) sets how long CloudFormation waits. Older material may say a stuck custom resource always blocks the stack for one hour.
• Your code must respond on every path, including exceptions and Delete requests (answer SUCCESS when there is nothing to delete), or deletes and rollbacks hang.
• The cfn-response module (import cfnresponse in Python, require('cfn-response') in Node.js) is available only for inline ZipFile code; code loaded from S3 must send the HTTPS PUT itself. ⚠️ Changed: CloudFormation zips inline ZipFile code into a package of up to 4 MB. Older material may say inline code is limited to 4,096 characters.
• A function in a VPC needs a route to S3 to send the response (with interface endpoints, allow the CloudFormation-specific S3 buckets).
• Secure dynamic references (ssm-secure, secretsmanager) aren't supported in custom resource properties; plain ssm references are resolved before the request is sent. Let the function read secrets with its own role.

Developer angle

Empty a bucket before CloudFormation deletes it (the custom resource references the bucket, so it is deleted first):

Resources:
  ArtifactBucket:
    Type: AWS::S3::Bucket
  EmptyBucketRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - {Effect: Allow, Principal: {Service: lambda.amazonaws.com}, Action: "sts:AssumeRole"}
      ManagedPolicyArns: ["arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"]
      Policies:
        - PolicyName: empty-artifact-bucket
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - {Effect: Allow, Action: ["s3:ListBucket", "s3:ListBucketVersions"], Resource: !GetAtt ArtifactBucket.Arn}
              - {Effect: Allow, Action: ["s3:DeleteObject", "s3:DeleteObjectVersion"], Resource: !Sub "${ArtifactBucket.Arn}/*"}
  EmptyBucketFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.13
      Handler: index.handler
      Timeout: 300
      Role: !GetAtt EmptyBucketRole.Arn
      Code:
        ZipFile: |
          import boto3
          import cfnresponse

          def handler(event, context):
              bucket = event["ResourceProperties"]["BucketName"]
              physical_id = event.get("PhysicalResourceId", f"empty-{bucket}")
              try:
                  if event["RequestType"] == "Delete":
                      boto3.resource("s3").Bucket(bucket).object_versions.delete()
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, {}, physical_id)
              except Exception as exc:
                  cfnresponse.send(event, context, cfnresponse.FAILED, {}, physical_id, reason=str(exc))
  EmptyArtifactBucket:
    Type: Custom::EmptyBucket
    Properties:
      ServiceToken: !GetAtt EmptyBucketFunction.Arn
      ServiceTimeout: 360  # a little above the function's 300-second timeout
      BucketName: !Ref ArtifactBucket

• The function passes a stable physical ID; by default cfnresponse uses the Lambda log stream name, which can differ between invocations and would turn an update into a replacement.
• Debug a hanging custom resource from the function's CloudWatch Logs; the default Reason from cfnresponse points to the log stream.
• The template creates an unnamed IAM role, so deploy it with CAPABILITY_IAM.

Traps

• Trap: "Let the exception propagate; CloudFormation sees the Lambda error." → Reality: CloudFormation only reads the S3 response; without one it waits until ServiceTimeout.
• Trap: "Let cfn-response choose the physical ID." → Reality: a changed ID means replacement, and CloudFormation then sends Delete for the old one (emptying a bucket, deleting a record).
• Trap: "Point ServiceToken at the shared function in us-east-1 from every Region." → Reality: the function or topic must be in the stack's Region.
• Trap: "Return a large configuration document in Data." → Reality: the response is capped at 4,096 bytes; store it elsewhere and return a pointer.
• Trap: "Pass a {{resolve:secretsmanager:…}} value as a custom resource property." → Reality: secure references aren't supported there; read the secret inside the function.
• Trap: "Use import cfnresponse in code deployed from S3." → Reality: the module is injected only for inline ZipFile code.

Practice questions

1. A stack creates an S3 bucket that collects build logs. Deleting the stack fails with DELETE_FAILED because the bucket isn't empty, and the bucket must be deleted together with the stack. Which solution meets this requirement with the LEAST manual effort?

   • A. Set DeletionPolicy: Retain on the bucket and delete the bucket by hand later.
   • B. Add an S3 Lifecycle rule that expires objects after one day, and retry the deletion the next day.
   • C. Add a Lambda-backed custom resource that empties the bucket on Delete requests.
   • D. Run delete-stack with --deletion-mode FORCE_DELETE_STACK whenever the first deletion attempt fails.

2. A Lambda-backed custom resource sometimes leaves a stack in CREATE_IN_PROGRESS for about an hour before it fails. Logs show that the function times out while calling an external API. Which TWO changes make such failures surface quickly? (Select TWO.)

   • A. Wrap the handler logic in try/except and send a FAILED response with a Reason before the function times out.
   • B. Set ServiceTimeout on the custom resource to a value slightly above the function's timeout.
   • C. Increase the function's memory to 10,240 MB.
   • D. Add a CreationPolicy with a ResourceSignal Timeout of PT5M to the custom resource.
   • E. Change the ServiceToken to the ARN of an SNS topic that the function subscribes to.

11. Helper scripts and creation policies

Concept

• A resource reaches CREATE_COMPLETE when the service says it exists: an EC2 instance is complete once it is running, not when your application is installed. A creation policy makes CloudFormation wait for success signals instead.
• Helper scripts (Python package aws-cfn-bootstrap, preinstalled in /opt/aws/bin on Amazon Linux AMIs; nothing runs unless your user data calls it):
  • cfn-init reads the resource's AWS::CloudFormation::Init metadata and installs packages, writes files, runs commands and manages services.
  • cfn-signal reports success or failure to a CreationPolicy (or to a wait condition handle).
  • cfn-hup is a daemon that polls the metadata and runs hooks (typically cfn-init again) after a stack update.
  • cfn-get-metadata prints a resource's metadata.
• User data mechanics (run once, as root, base64, logs): see notes/ec2-mastery-guide.md §3.

Exam facts

• AWS::CloudFormation::Init order inside one config: packages → groups → users → sources → files → commands → services; commands run in alphabetical order of their keys. Use configSets to order several config keys; without --configsets, cfn-init uses the default configset or the single config key.
• CreationPolicy applies to AWS::EC2::Instance, AWS::AutoScaling::AutoScalingGroup and AWS::CloudFormation::WaitCondition (and AppStream fleets): ResourceSignal.Count (default 1) and ResourceSignal.Timeout in ISO 8601 (default PT5M, maximum 12 hours); Auto Scaling groups add AutoScalingCreationPolicy.MinSuccessfulInstancesPercent (default 100). Too few signals in time, or one failure signal → CREATE_FAILED → rollback.
• Standard user data: install the latest aws-cfn-bootstrap, run cfn-init -v --stack ${AWS::StackName} --resource X --region ${AWS::Region}, then cfn-signal -e $? --stack … --resource X --region … so that cfn-init's exit code becomes the signal. cfn-signal's --region defaults to us-east-1: always pass the stack's Region. Logs on the instance: /var/log/cfn-init.log, /var/log/cloud-init.log, /var/log/cloud-init-output.log.
• Credentials: none required. Without credentials CloudFormation checks stack membership and scopes the call to the instance's own stack; with explicit credentials, cfn-signal needs cloudformation:SignalResource and the others cloudformation:DescribeStackResource.
• The instance must reach the CloudFormation endpoint (internet path or VPC endpoint), and S3 for wait condition handles; otherwise signals never arrive and the stack times out. Signal data is limited to 4,096 bytes.
• Rolling updates of Auto Scaling groups: UpdatePolicy.AutoScalingRollingUpdate with WaitOnResourceSignals: true waits for each new instance's signal; PauseTime is the wait (maximum PT1H, default PT5M when waiting for signals), MaxBatchSize (default 1), MinInstancesInService (default 0), MinSuccessfulInstancesPercent, SuspendProcesses. AutoScalingReplacingUpdate (WillReplace: true) builds a new group and keeps the old one on rollback. AutoScalingInstanceRefresh uses an instance refresh instead and doesn't support cfn-signal (see notes/ec2-mastery-guide.md §10).
• cfn-hup: /etc/cfn/cfn-hup.conf (stack, region, interval in minutes, default 15) plus hook files in /etc/cfn/hooks.d/ (triggers=post.update, path=Resources.X.Metadata.AWS::CloudFormation::Init, action=…cfn-init…, runas=root). Without it, metadata changed by a stack update never reaches running instances.
• Wait conditions (AWS::CloudFormation::WaitCondition with an AWS::CloudFormation::WaitConditionHandle presigned URL, Timeout up to 43,200 seconds) coordinate with work outside the stack; for EC2 instances and Auto Scaling groups AWS recommends a CreationPolicy. A wait condition added in an update needs a new handle.

Developer angle

An Auto Scaling group that waits for two healthy instances at creation and for each new instance during rolling updates; the cfn-hup files let running instances reapply metadata changes (SubnetIds and LatestAmiId are parameters as in §2):

Resources:
  AppLaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Metadata:
      AWS::CloudFormation::Init:
        config:
          packages: {yum: {nginx: []}}
          files:
            /etc/cfn/cfn-hup.conf:
              content: !Sub |
                [main]
                stack=${AWS::StackId}
                region=${AWS::Region}
                interval=5
            /etc/cfn/hooks.d/cfn-auto-reloader.conf:
              content: !Sub |
                [cfn-auto-reloader-hook]
                triggers=post.update
                path=Resources.AppLaunchTemplate.Metadata.AWS::CloudFormation::Init
                action=/opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource AppLaunchTemplate --region ${AWS::Region}
                runas=root
          services:
            sysvinit:
              nginx: {enabled: "true", ensureRunning: "true"}
              cfn-hup: {enabled: "true", ensureRunning: "true", files: [/etc/cfn/cfn-hup.conf, /etc/cfn/hooks.d/cfn-auto-reloader.conf]}
    Properties:
      LaunchTemplateData:
        ImageId: !Ref LatestAmiId
        InstanceType: t3.micro
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash
            yum install -y aws-cfn-bootstrap
            /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource AppLaunchTemplate --region ${AWS::Region}
            /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource AppGroup --region ${AWS::Region}
  AppGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    CreationPolicy:
      ResourceSignal: {Count: 2, Timeout: PT15M}
    UpdatePolicy:
      AutoScalingRollingUpdate: {MaxBatchSize: 1, MinInstancesInService: 1, WaitOnResourceSignals: true, PauseTime: PT15M}
    Properties:
      MinSize: "2"
      MaxSize: "4"
      VPCZoneIdentifier: !Ref SubnetIds
      LaunchTemplate: {LaunchTemplateId: !Ref AppLaunchTemplate, Version: !GetAtt AppLaunchTemplate.LatestVersionNumber}

• Manual signal, for example to let a stuck update rollback continue: aws cloudformation signal-resource --stack-name orders-prod --logical-resource-id AppGroup --unique-id i-0123456789abcdef0 --status SUCCESS.
• cfn-init package keys are apt, msi, python, rpm, rubygems, yum and zypper; services runs through systemd on Amazon Linux 2 and later (aws-cfn-bootstrap 2.0-29+), and a service such as cfn-hup needs a systemd unit file to be managed there.

Traps

• Trap: "CREATE_COMPLETE on the instance means the app is installed." → Reality: only a CreationPolicy plus cfn-signal makes the stack wait for the app.
• Trap: "CloudFormation runs cfn-init automatically when metadata exists." → Reality: your user data must call it.
• Trap: "Updating AWS::CloudFormation::Init metadata reconfigures running instances." → Reality: only if cfn-hup runs with a hook; otherwise only new instances get it.
• Trap: "Set Timeout: PT24H for a slow install." → Reality: the maximum is 12 hours (PauseTime for rolling updates: 1 hour).
• Trap: "Instances in a private subnet with no internet path or endpoint can still signal." → Reality: the signal can't reach CloudFormation; the stack times out and rolls back.
• Trap: "cfn-signal -e $? --stack … --resource … is enough in eu-west-1." → Reality: without --region the signal goes to the us-east-1 endpoint and the creation policy times out.

Practice questions

1. A stack launches an EC2 instance whose user data installs an application. The instance reaches CREATE_COMPLETE before the installation finishes, and a dependent resource then fails its health checks. Which solution makes CloudFormation wait until the application is installed?

   • A. Add a CreationPolicy to the instance and call cfn-signal -e $? after cfn-init.
   • B. Add a DependsOn attribute from the dependent resource to the instance resource.
   • C. Pass --timeout-in-minutes 30 to the create-stack call that launches the instance.
   • D. Add a rollback trigger on the instance's StatusCheckFailed alarm with a 15-minute monitoring time.

2. A developer adds a configuration file to the AWS::CloudFormation::Init metadata of a launch template and updates the stack. Instances that are already running don't receive the file. Which TWO changes make running instances apply future metadata changes? (Select TWO.)

   • A. Add UpdateReplacePolicy: Retain to the launch template.
   • B. Configure and start the cfn-hup daemon on the instances through /etc/cfn/cfn-hup.conf.
   • C. Run aws cloudformation signal-resource for every instance after each stack update completes.
   • D. Add a cfn-hup hook file that runs cfn-init on post.update for the launch template's metadata path.
   • E. Increase ResourceSignal.Count in the creation policy.

12. StackSets

Concept

• A StackSet deploys one template as stack instances into many accounts and Regions from one administrator account (the organization's management account or a delegated administrator). Updating the StackSet pushes the change to every instance; instances can differ only by parameter overrides, never by template.
• Permission models: self-managed (you create AWSCloudFormationStackSetAdministrationRole in the administrator account and AWSCloudFormationStackSetExecutionRole in every target account; any accounts) or service-managed (AWS Organizations trusted access; StackSets creates the roles; targets OUs or the whole organization; automatic deployment to accounts that join a target OU).
• A StackSet is a regional resource: it is visible only in the Region where it was created, even though it deploys elsewhere.

Exam facts

• Self-managed: the administration role trusts cloudformation.amazonaws.com and may sts:AssumeRole the execution role; the execution role (that exact name unless you pass a custom ExecutionRoleName) trusts the administrator account and holds CloudFormation permissions plus whatever the template creates. The caller needs iam:PassRole on the administration role.
• Service-managed: the management account activates trusted access; up to 5 delegated administrators (member accounts calling with --call-as DELEGATED_ADMIN); stacks are never deployed to the management account; targets are OUs (child OUs included) with optional account filters (INTERSECTION, DIFFERENCE, UNION); templates with macros, transforms or nested stacks aren't supported; automatic deployment is set per StackSet with --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=true|false.
• Operations: create-stack-set (the container), create-stack-instances (--accounts for self-managed or --deployment-targets OrganizationalUnitIds=…, plus --regions), update-stack-set, update-stack-instances --parameter-overrides, delete-stack-instances --retain-stacks or --no-retain-stacks, delete-stack-set (only when it has no instances), describe-stack-set-operation.
• Operation preferences: MaxConcurrentCount or MaxConcurrentPercentage (accounts at a time; percentages round down), FailureToleranceCount or FailureTolerancePercentage (failures per Region before the operation stops), RegionConcurrencyType SEQUENTIAL (default) or PARALLEL, RegionOrder, ConcurrencyMode.
• ⚠️ Changed: ConcurrencyMode (November 2023) adds SOFT_FAILURE_TOLERANCE, which keeps the configured concurrency regardless of failures; the default STRICT_FAILURE_TOLERANCE caps actual concurrency at failure tolerance + 1 and lowers it as failures occur. Older material may say maximum concurrent accounts can never exceed failure tolerance + 1.
• Stack instance status: CURRENT, OUTDATED or INOPERABLE (a failed delete; remove it with RetainStacks set to true); per-operation detail: PENDING, RUNNING, SUCCEEDED, FAILED, CANCELLED, FAILED_IMPORT, SKIPPED_SUSPENDED_ACCOUNT. Operation statuses: RUNNING, SUCCEEDED, FAILED, QUEUED, STOPPING, STOPPED. StackSet drift: detect-stack-set-drift.
• A failed stack instance creation deletes that stack (StackSets set OnFailure to DELETE).
• Quotas: 1,000 StackSets per administrator account and 100,000 stack instances per StackSet (both adjustable); 10,000 stack instance operations running at once per Region per administrator account.
• Choose StackSets for "the same baseline in every account and Region" (IAM roles, AWS Config rules, logging buckets, alarms); choose per-account pipelines when applications differ.

Developer angle

# service-managed StackSet for one OU, two Regions in parallel
aws cloudformation create-stack-set --stack-set-name baseline-logging --permission-model SERVICE_MANAGED \
  --template-url https://templates-111122223333.s3.eu-west-1.amazonaws.com/logging.yaml \
  --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false --capabilities CAPABILITY_NAMED_IAM
aws cloudformation create-stack-instances --stack-set-name baseline-logging \
  --deployment-targets OrganizationalUnitIds=ou-ab12-34cd5678 --regions eu-west-1 eu-central-1 \
  --operation-preferences RegionConcurrencyType=PARALLEL,MaxConcurrentPercentage=25,FailureTolerancePercentage=10
aws cloudformation describe-stack-set-operation --stack-set-name baseline-logging \
  --operation-id 11111111-2222-3333-4444-555555555555
# self-managed StackSet with a per-instance parameter override
aws cloudformation create-stack-set --stack-set-name app-alarms --template-body file://alarms.yaml --permission-model SELF_MANAGED
aws cloudformation create-stack-instances --stack-set-name app-alarms --accounts 222233334444 555566667777 \
  --regions us-east-1 --parameter-overrides ParameterKey=Threshold,ParameterValue=80

• In each target account, the trust policy of AWSCloudFormationStackSetExecutionRole names the administrator account ("Principal": {"AWS": "arn:aws:iam::111122223333:root"}); scope its permissions to cloudformation:* plus the resource types the template creates (AWS's sample role grants full admin).

Traps

• Trap: "A service-managed StackSet also covers the management account." → Reality: it never deploys there; manage that account separately.
• Trap: "Any member account can create organization-wide StackSets." → Reality: only the management account or a registered delegated administrator (up to 5).
• Trap: "Delete the StackSet and its stacks in one step." → Reality: delete the stack instances first (retaining or deleting their stacks), then the StackSet.
• Trap: "Use a SAM template with a service-managed StackSet." → Reality: macros, transforms and nested stacks aren't supported there.
• Trap: "Custom execution role names work automatically." → Reality: only AWSCloudFormationStackSetExecutionRole is found automatically; pass any other name.
• Trap: "MaxConcurrentCount=10 with FailureToleranceCount=0 deploys 10 accounts at once." → Reality: in the default strict mode actual concurrency is capped at 1.

Practice questions

1. A company uses AWS Organizations. The same logging resources must be deployed to every existing account and to every account added in the future. Which solution meets these requirements with the LEAST operational overhead?

   • A. A CodePipeline pipeline in each account that runs aws cloudformation deploy whenever the template changes.
   • B. A StackSet with self-managed permissions and execution roles created in each account.
   • C. A nested stack in the management account that declares one child stack for every member account.
   • D. A service-managed StackSet that targets the organization root with automatic deployment.

2. A developer creates a StackSet with self-managed permissions in account 111122223333 to deploy into accounts 222233334444 and 555566667777. Stack instance creation fails because the StackSet can't assume a role in the target accounts. Which TWO configurations are required? (Select TWO.)

   • A. Activate trusted access with AWS Organizations from the organization's management account.
   • B. Register account 111122223333 as a delegated administrator for StackSets with aws organizations register-delegated-administrator.
   • C. Create AWSCloudFormationStackSetExecutionRole in each target account with a trust policy that allows account 111122223333.
   • D. Pass --operation-preferences FailureToleranceCount=2 to create-stack-instances.
   • E. Create AWSCloudFormationStackSetAdministrationRole in account 111122223333 with permission to assume the execution role in the target accounts.

13. Drift detection and resource import

Concept

• Drift: a resource's actual configuration differs from what the stack expects because someone changed it outside CloudFormation (console, CLI, another tool). Drift detection compares and reports; it never changes anything.
• Import: brings existing resources under a stack's management (adopt console-built resources, move resources between stacks, nest an existing stack) without recreating them.

Exam facts

• Drift detection runs on stacks in CREATE_COMPLETE, UPDATE_COMPLETE, UPDATE_ROLLBACK_COMPLETE or UPDATE_ROLLBACK_FAILED and can take several minutes. It is asynchronous: detect-stack-drift returns a StackDriftDetectionId; poll describe-stack-drift-detection-status (DetectionStatus DETECTION_IN_PROGRESS, DETECTION_COMPLETE or DETECTION_FAILED, plus StackDriftStatus and DriftedStackResourceCount); read details with describe-stack-resource-drifts (--stack-resource-drift-status-filters MODIFIED DELETED). One resource: detect-stack-resource-drift.
• Stack drift status: DRIFTED, IN_SYNC, NOT_CHECKED; resource drift status: IN_SYNC, MODIFIED, DELETED, NOT_CHECKED (unsupported type or skipped by a forced rollback); property differences ADD, REMOVE, NOT_EQUAL, with expected and actual values.
• Only property values set explicitly in the template (directly or through parameters) are compared, not service defaults: set a property explicitly to track it. Not compared: KMSKeyId, write-only values such as passwords, and values that can't be mapped back (Lambda code). Attachments managed from another stack (AWS::EC2::SecurityGroupIngress, AWS::IAM::Policy) can show false drift. Dynamic references aren't drift-checked.
• A stack's drift check doesn't include its nested stacks: run it on each nested stack. StackSets: detect-stack-set-drift.
• Permissions: cloudformation:DetectStackDrift, cloudformation:DetectStackResourceDrift, cloudformation:BatchDescribeTypeConfigurations, plus read permissions for each resource type (for example ec2:DescribeInstances).
• Remediation options: change the resource back, update the template to match and update the stack, overwrite drift with a drift-aware change set (REVERT_DRIFT, §7), or remove the resource and import it again. Continuous checks: the AWS Config managed rule cloudformation-stack-drift-detection-check (periodic and on configuration changes; needs a cloudformationRoleArn with drift permissions) flags DRIFTED stacks as non-compliant.
• Resource import (create-change-set --change-set-type IMPORT --resources-to-import file://…): the template must describe the whole stack plus the imported resources; each imported resource needs a DeletionPolicy (any value) and its identifier (for example BucketName); the import can't create, delete or modify other resources; a resource can belong to only one stack per Region; CloudFormation doesn't check that the template matches the real configuration, so run drift detection afterwards. Statuses: IMPORT_IN_PROGRESS, IMPORT_COMPLETE, IMPORT_ROLLBACK_IN_PROGRESS, IMPORT_ROLLBACK_FAILED, IMPORT_ROLLBACK_COMPLETE. Restrict types with cloudformation:ImportResourceTypes. Import supports one level of nesting.
• Auto-import: create-change-set --import-existing-resources adopts resources whose static custom name in the template matches an existing resource (needs DeletionPolicy Retain or RetainExceptOnCreate), useful after a deployment failed because a named resource already exists.
• Related adoption tools: the IaC generator scans a Region of an account and generates a template from unmanaged resources (the CDK CLI's cdk migrate can turn it into a CDK app); stack refactoring (create-stack-refactor, execute-stack-refactor) moves resources between stacks or renames logical IDs without replacing them. The classic move: set DeletionPolicy: Retain, remove the resource from the source stack (it stays), then import it into the target stack.

Developer angle

DRIFT_ID=$(aws cloudformation detect-stack-drift --stack-name orders-prod --query StackDriftDetectionId --output text)
aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id "$DRIFT_ID" \
  --query "[DetectionStatus,StackDriftStatus,DriftedStackResourceCount]"
aws cloudformation describe-stack-resource-drifts --stack-name orders-prod --stack-resource-drift-status-filters MODIFIED DELETED \
  --query "StackResourceDrifts[].[LogicalResourceId,StackResourceDriftStatus]"

Import a hand-made bucket (import.json, then a template that adds LegacyUploads with a DeletionPolicy):

[{"ResourceType": "AWS::S3::Bucket", "LogicalResourceId": "LegacyUploads",
  "ResourceIdentifier": {"BucketName": "orders-legacy-uploads"}}]

aws cloudformation create-change-set --stack-name orders-prod --change-set-name import-legacy-uploads \
  --change-set-type IMPORT --resources-to-import file://import.json --template-body file://orders-with-legacy-bucket.yaml
aws cloudformation execute-change-set --stack-name orders-prod --change-set-name import-legacy-uploads

Traps

• Trap: "Drift detection fixes drifted resources." → Reality: it only reports; remediation is a separate step.
• Trap: "A changed service default is detected as drift." → Reality: only properties set explicitly in the template are compared.
• Trap: "Checking the root stack covers its nested stacks." → Reality: run detection on each nested stack.
• Trap: "Import works without touching DeletionPolicy." → Reality: every imported resource needs one.
• Trap: "Import a bucket and add a new queue in the same operation." → Reality: import operations can't create, delete or modify other resources.
• Trap: "A DRIFTED stack can't be updated." → Reality: it can; the update may overwrite the out-of-band change.

Practice questions

1. An operator changed the visibility timeout of an SQS queue in the console. The queue belongs to a stack whose template sets VisibilityTimeout: 60. The developer must find which resources in the stack differ from the template, without changing any resource. What should the developer do?

   • A. Create a change set from the template that is currently deployed and review the changes it lists.
   • B. Run detect-stack-drift and review describe-stack-resource-drifts.
   • C. Run update-stack --use-previous-template and read the stack events for the modified resources.
   • D. Run validate-template against the deployed template retrieved with get-template.

2. A team created an S3 bucket named orders-legacy-uploads and a DynamoDB table by hand, and now wants an existing stack to manage them without recreating them. Which TWO steps are required? (Select TWO.)

   • A. Add both resources to the stack's template, each with a DeletionPolicy attribute.
   • B. Delete the resources and let CloudFormation recreate them with the same names.
   • C. Run detect-stack-drift on the stack with the resource identifiers of both resources.
   • D. Create a change set of type IMPORT whose --resources-to-import lists each resource's identifier, then execute it.
   • E. Add the resources to the template and point their properties at the existing ARNs with Fn::ImportValue.

14. Dynamic references

Concept

• A dynamic reference is a placeholder string {{resolve:service:…}} inside a resource property. CloudFormation resolves it during stack and change set operations from Systems Manager Parameter Store or Secrets Manager, so sensitive or externally managed values never live in the template, its parameters or version control.
• Parameter Store tiers and SecureString encryption, Secrets Manager rotation and KMS details: see notes/security-encryption-guide.md (its §11 covers dynamic references from the secrets angle).

Exam facts

• {{resolve:ssm:name}} or {{resolve:ssm:name:version}}: String and StringList parameters, public parameters included (latest AMI). Without a version, CloudFormation uses the latest version at each create or update; in the Parameters section a version is required.
• {{resolve:ssm-secure:name}} or with :version: SecureString values. CloudFormation never stores or returns the plaintext (APIs show the reference itself) and change sets compare only the reference string. Only properties that support it accept it, for example MasterUserPassword of AWS::RDS::DBInstance, AWS::RDS::DBCluster and AWS::Redshift::Cluster, LoginProfile.Password of AWS::IAM::User, AuthToken of AWS::ElastiCache::ReplicationGroup, Directory Service passwords. No public parameters, no other accounts, no labels; if a rollback needs a version that no longer exists, the rollback fails.
• {{resolve:secretsmanager:secret-id:SecretString:json-key:version-stage:version-id}}: every segment after secret-id is optional (default AWSCURRENT, whole SecretString without json-key); usable in all resource properties (the value may still surface in the target service); a secret in another account needs its full ARN. AWS recommends versionless references combined with rotation.
• Values are fetched only when the resource that contains them is created or updated: rotating a secret or changing a parameter doesn't touch the stack until that resource changes. CloudFormation doesn't track which secret version it used.
• Limits and restrictions: 60 dynamic references per template; secure references aren't supported in custom resources; dynamic references aren't supported in AWS::CloudFormation::Init metadata or EC2 UserData; a reference can't end with a backslash; keep them out of properties that form a resource's primary identifier (the plaintext may appear in the ID); with transforms they are resolved when the change set executes; no drift detection on them; ssm and ssm-secure references can't read parameters shared from other accounts.
• Permissions for the deploying identity or service role: ssm:GetParameters for Parameter Store, secretsmanager:GetSecretValue for Secrets Manager, plus kms:Decrypt when a customer managed key protects the value.
• Prefer them over NoEcho parameters (§2) for secrets. For RDS, the service can also keep the master password in Secrets Manager itself (ManageMasterUserPassword; see notes/rds-guide.md).

Developer angle

Resources:
  OrdersDb:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Properties:
      Engine: mysql
      DBInstanceClass: db.t4g.micro
      AllocatedStorage: "20"
      MasterUsername: "{{resolve:secretsmanager:orders/db:SecretString:username}}"
      MasterUserPassword: "{{resolve:secretsmanager:orders/db:SecretString:password}}"
  WorkerTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        ImageId: "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64}}"
        InstanceType: t3.micro
  SupportUser:
    Type: AWS::IAM::User
    Properties:
      LoginProfile:
        Password: "{{resolve:ssm-secure:/orders/support-initial-password:3}}"
        PasswordResetRequired: true

Read permissions for the stack's service role:

{"Version": "2012-10-17",
 "Statement": [
   {"Effect": "Allow", "Action": "ssm:GetParameters",
    "Resource": "arn:aws:ssm:eu-west-1:111122223333:parameter/orders/*"},
   {"Effect": "Allow", "Action": "secretsmanager:GetSecretValue",
    "Resource": "arn:aws:secretsmanager:eu-west-1:111122223333:secret:orders/db-*"}]}

• To pick up a changed secret or parameter, change the resource that holds the reference (or rely on the service's own rotation for the database side); a plain re-run with no resource change doesn't re-read it.
• The template creates an unnamed IAM user, so it needs CAPABILITY_IAM.

Traps

• Trap: "Rotate the secret and CloudFormation updates the database password." → Reality: CloudFormation reads it only on resource create or update; Secrets Manager rotation keeps the database and the secret in sync.
• Trap: "A NoEcho parameter is as safe as a dynamic reference." → Reality: the value is still passed as a parameter and leaks wherever it is copied; dynamic references keep it out of the stack.
• Trap: "{{resolve:ssm:…}} reads a SecureString." → Reality: ssm reads String/StringList; secure strings need ssm-secure in a supported property.
• Trap: "Use ssm-secure in any property." → Reality: only properties that support the pattern; Secrets Manager references work in all properties.
• Trap: "Put {{resolve:secretsmanager:…}} in UserData." → Reality: unsupported; fetch the secret at boot with the instance role.
• Trap: "Reference a Parameter Store value shared from another account with {{resolve:ssm:…}}." → Reality: not supported; use an SSM parameter type with the full ARN, or a Secrets Manager secret ARN.

Practice questions

1. A developer is writing a template for an Amazon RDS for MySQL instance. The master password is stored in AWS Secrets Manager as JSON with username and password keys. The password must not appear in the template, its parameters or the stack outputs. Which value should the MasterUserPassword property use?

   • A. !Ref DbPassword, where DbPassword is a NoEcho parameter.
   • B. {{resolve:ssm:/orders/db-password}}, where the parameter is a SecureString.
   • C. {{resolve:secretsmanager:orders/db:SecretString:password}}
   • D. A Mappings entry that holds the password, read with !FindInMap.

2. A stack sets an RDS MasterUserPassword to {{resolve:secretsmanager:orders/db:SecretString:password}}. A security engineer changed the secret's value in Secrets Manager, but the database still accepts the old password. Which TWO statements are correct? (Select TWO.)

   • A. CloudFormation re-resolves dynamic references every 15 minutes and updates the database password.
   • B. CloudFormation resolves the reference only when it creates or updates the resource that contains it.
   • C. Running detect-stack-drift will report the password as drifted.
   • D. Changing the reference to {{resolve:ssm-secure:/orders/db-password}} makes CloudFormation refresh the value automatically.
   • E. Configuring Secrets Manager rotation for the secret keeps the database password and the secret in sync without stack updates.

Quick decision rules

• If you see a template larger than 51,200 bytes, think S3 and --template-url (up to 1 MB), or deploy --s3-bucket.
• If you see a Lambda function that keeps old code after a stack update, think a new S3Key/S3ObjectVersion, or aws cloudformation package.
• If you see a stack in ROLLBACK_COMPLETE, think delete and recreate.
• If you see "the latest AMI in every Region without template edits", think AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> with the public parameter (or {{resolve:ssm:…}}).
• If you see "validate parameter combinations before anything is created", think the Rules section.
• If you see "resource only in prod", think a condition plus the Condition attribute (Fn::If with AWS::NoValue for single properties).
• If you see an IAM policy that needs a queue ARN, think !GetAtt Queue.Arn (Ref returns the URL).
• If you see a rejected !Base64 !Sub, think Fn::Base64: !Sub |.
• If you see independent stacks that must share a VPC ID safely, think Export plus Fn::ImportValue.
• If you see a reusable component inside one deployment, or more than 500 resources, think nested stacks.
• If you see an output needed from another account or Region, think Fn::GetStackOutput (weak reference).
• If you see "export cannot be deleted, in use", think list-imports, migrate the consumers, then delete.
• If you see developers who must deploy resources they can't create directly, think a service role plus iam:PassRole.
• If you see InsufficientCapabilities with a named role, think CAPABILITY_NAMED_IAM; with a transform on create-stack, think CAPABILITY_AUTO_EXPAND (or a change set).
• If you see "preview whether the update replaces the database", think a change set and its Replacement value.
• If you see nested stacks missing from a CLI change set, think --include-nested-stacks, executed from the root.
• If you see "overwrite console changes back to the template", think a drift-aware change set (--deployment-mode REVERT_DRIFT).
• If you see "keep the resources that worked and retry after fixing", think --disable-rollback (Preserve successfully provisioned resources).
• If you see UPDATE_ROLLBACK_FAILED, think fix the cause, then continue-update-rollback (--resources-to-skip or --force-rollback).
• If you see DELETE_FAILED on a non-empty bucket, think empty it (custom resource), --retain-resources, or --deletion-mode FORCE_DELETE_STACK.
• If you see "roll back when the error alarm fires after the deployment", think rollback triggers with MonitoringTimeInMinutes.
• If you see "keep the data when the stack is deleted", think DeletionPolicy; "keep the old resource when an update replaces it", think UpdateReplacePolicy.
• If you see "no update may replace one critical resource", think a stack policy with an explicit Deny; "no accidental stack deletion", think termination protection.
• If you see a step CloudFormation can't do natively, think a Lambda-backed custom resource that always answers the ResponseURL (and sets ServiceTimeout).
• If you see "wait until the software on the instance is installed", think CreationPolicy plus cfn-signal -e $? … --region; for running instances that must pick up metadata changes, think cfn-hup.
• If you see the same baseline in every account of an organization, including future ones, think a service-managed StackSet with automatic deployment.
• If you see a self-managed StackSet that can't assume roles, think AWSCloudFormationStackSetAdministrationRole plus AWSCloudFormationStackSetExecutionRole.
• If you see "which resources were changed outside CloudFormation", think detect-stack-drift and describe-stack-resource-drifts.
• If you see "bring a hand-made resource under a stack", think an IMPORT change set with a DeletionPolicy on the resource.
• If you see a database password that must not appear in the template, think {{resolve:secretsmanager:…}} (or ssm-secure in a supported property).

Changed vs older material

Learn the Current column; older practice material may still show the Older material may say value. After confirmation, the same rows (with verification dates) go to notes/current-facts.md.