CloudFormation updates, drift and StackSets
Infrastructure as code is at the core of DOP-C02. The exam asks how to change stacks safely, find manual changes and scale a template across accounts.
Safe updates
| Feature | Purpose |
|---|---|
| Change set | Preview changes before executing |
| Stack policy | Block updates to chosen resources during a stack update |
| Termination protection | Prevent stack deletion |
| Rollback triggers | Roll back if a CloudWatch alarm fires during the update |
| DeletionPolicy | Retain or snapshot a resource on delete |
| UpdateReplacePolicy | Same, but when an update replaces the resource |
If an update fails, CloudFormation rolls back to the last good state. A stack in UPDATE_ROLLBACK_FAILED can be continued with ContinueUpdateRollback, optionally skipping resources.
Waiting for resources
A CreationPolicy with cfn-signal makes CloudFormation wait until an EC2 instance or Auto Scaling group reports success. A WaitCondition does a similar job for external steps. An UpdatePolicy on an Auto Scaling group controls rolling or replacing updates.
Custom resources backed by Lambda handle work CloudFormation does not support. The function must send a response to the pre-signed URL, or the stack hangs until timeout.
Drift detection
Drift happens when someone changes a resource outside CloudFormation. Run drift detection on a stack or StackSet, and use AWS Config rules or EventBridge to react. Import existing resources into a stack with resource import.
Reuse
- Nested stacks break up large templates. The parent owns the lifecycle.
- Exports and
Fn::ImportValueshare outputs across stacks. An exported value cannot be changed or deleted while another stack imports it. - Parameters from Systems Manager such as
AWS::SSM::Parameter::Value<String>fetch the latest AMI ID. - Modules and the registry package reusable patterns.
Resources:
Bucket:
Type: AWS::S3::Bucket
DeletionPolicy: RetainStackSets
A StackSet deploys one template to many accounts and Regions.
- Service-managed permissions use AWS Organizations. Turn on automatic deployment and new accounts in the chosen OUs receive the stack.
- Self-managed permissions need an administration role in the admin account and an execution role in each target account.
Set maximum concurrent accounts and failure tolerance to control the rollout. AWS Control Tower can add customizations to new accounts through Customizations for Control Tower or Account Factory for Terraform.
Exam traps
- A change set only previews. You still must execute it.
- Stack policies apply to updates, not to deletes. Use termination protection and DeletionPolicy for that.
- Drift detection reports differences but does not fix them.
- Exports cannot be modified while imported by another stack.
- Service-managed StackSets need trusted access enabled between CloudFormation and Organizations.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Template changes must be reviewed before they reach production, with little operational overhead. What is the best approach?
Show answer
Answer: B.A change set previews the exact resource changes so a reviewer can approve before you execute it.
2. A security group was edited manually after deployment. How do you find which stack resources no longer match the template?
Show answer
Answer: A.Drift detection compares the actual resource properties with the template and reports differences.
3. A baseline template must be deployed to every account in an organization, including accounts created later. Which feature does this?
Show answer
Answer: B.Service-managed StackSets integrate with AWS Organizations and automatically deploy to new accounts in the target organizational units.
4. A stack deletion fails because an S3 bucket is not empty. Which attribute keeps the bucket when the stack is deleted?
Show answer
Answer: B.DeletionPolicy Retain leaves the resource in place. Otherwise a non-empty bucket blocks deletion until you empty it.