AWS CloudFormation VPC Infrastructure Overview Create production-ready VPC infrastructure using AWS CloudFormation templates. This skill covers VPC components (Subnets, Route Tables, NAT Gateways, Internet Gateways), template structure best practices, parameter patterns, and cross-stack references for modular, reusable infrastructure as code. When to Use Use this skill when: Creating new VPCs with public and private subnets Configuring route tables for internet and NAT connectivity Setting up Internet Gateways and NAT Gateways Implementing template Parameters with AWS-specific types Creating Outputs for cross-stack references Organizing templates with Mappings and Conditions Designing reusable, modular CloudFormation templates Quick Start Basic VPC with Public Subnet AWSTemplateFormatVersion : 2010-09-09 Description : Simple VPC with public subnet Resources : VPC : Type : AWS : : EC2 : : VPC Properties : CidrBlock : 10.0.0.0/16 EnableDnsHostnames : true EnableDnsSupport : true Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - vpc PublicSubnet : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.1.0/24 AvailabilityZone : !Select [ 0 , !GetAZs '' ] MapPublicIpOnLaunch : true Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - public - subnet InternetGateway : Type : AWS : : EC2 : : InternetGateway Properties : Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - igw VPCGatewayAttachment : Type : AWS : : EC2 : : VPCGatewayAttachment Properties : VpcId : !Ref VPC InternetGatewayId : !Ref InternetGateway PublicRouteTable : Type : AWS : : EC2 : : RouteTable Properties : VpcId : !Ref VPC Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - public - rt DefaultPublicRoute : Type : AWS : : EC2 : : Route DependsOn : VPCGatewayAttachment Properties : RouteTableId : !Ref PublicRouteTable DestinationCidrBlock : 0.0.0.0/0 GatewayId : !Ref InternetGateway PublicSubnetRouteTableAssociation : Type : AWS : : EC2 : : SubnetRouteTableAssociation Properties : SubnetId : !Ref PublicSubnet RouteTableId : !Ref PublicRouteTable VPC with Public and Private Subnets AWSTemplateFormatVersion : 2010-09-09 Description : VPC with public and private subnets across multiple AZs Parameters : EnvironmentName : Type : String Default : production Description : Environment name for resource tagging VpcCidr : Type : String Default : 10.0.0.0/16 Description : CIDR block for the VPC Resources : VPC : Type : AWS : : EC2 : : VPC Properties : CidrBlock : !Ref VpcCidr EnableDnsHostnames : true EnableDnsSupport : true Tags : - Key : Environment Value : !Ref EnvironmentName - Key : Name Value : !Sub $ { AWS : : StackName } - vpc InternetGateway : Type : AWS : : EC2 : : InternetGateway Properties : Tags : - Key : Environment Value : !Ref EnvironmentName - Key : Name Value : !Sub $ { AWS : : StackName } - igw VPCGatewayAttachment : Type : AWS : : EC2 : : VPCGatewayAttachment Properties : VpcId : !Ref VPC InternetGatewayId : !Ref InternetGateway

Public Subnet 1

PublicSubnet1 : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.1.0/24 AvailabilityZone : !Select [ 0 , !GetAZs '' ] MapPublicIpOnLaunch : true Tags : - Key : Environment Value : !Ref EnvironmentName - Key : SubnetType Value : Public - Key : Name Value : !Sub $ { AWS : : StackName } - public - 1 PublicRouteTable1 : Type : AWS : : EC2 : : RouteTable Properties : VpcId : !Ref VPC Tags : - Key : Environment Value : !Ref EnvironmentName - Key : Name Value : !Sub $ { AWS : : StackName } - public - rt - 1 DefaultPublicRoute1 : Type : AWS : : EC2 : : Route DependsOn : VPCGatewayAttachment Properties : RouteTableId : !Ref PublicRouteTable1 DestinationCidrBlock : 0.0.0.0/0 GatewayId : !Ref InternetGateway PublicSubnetRouteTableAssociation1 : Type : AWS : : EC2 : : SubnetRouteTableAssociation Properties : SubnetId : !Ref PublicSubnet1 RouteTableId : !Ref PublicRouteTable1

Private Subnet 1

PrivateSubnet1 : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.10.0/24 AvailabilityZone : !Select [ 0 , !GetAZs '' ] Tags : - Key : Environment Value : !Ref EnvironmentName - Key : SubnetType Value : Private - Key : Name Value : !Sub $ { AWS : : StackName } - private - 1 PrivateRouteTable1 : Type : AWS : : EC2 : : RouteTable Properties : VpcId : !Ref VPC Tags : - Key : Environment Value : !Ref EnvironmentName - Key : Name Value : !Sub $ { AWS : : StackName } - private - rt - 1 PrivateSubnetRouteTableAssociation1 : Type : AWS : : EC2 : : SubnetRouteTableAssociation Properties : SubnetId : !Ref PrivateSubnet1 RouteTableId : !Ref PrivateRouteTable1 Outputs : VpcId : Description : VPC ID Value : !Ref VPC Export : Name : !Sub $ { AWS : : StackName } - VpcId PublicSubnet1Id : Description : Public Subnet 1 ID Value : !Ref PublicSubnet1 Export : Name : !Sub $ { AWS : : StackName } - PublicSubnet1Id PrivateSubnet1Id : Description : Private Subnet 1 ID Value : !Ref PrivateSubnet1 Export : Name : !Sub $ { AWS : : StackName } - PrivateSubnet1Id Template Structure Template Sections Overview AWS CloudFormation templates are JSON or YAML files with specific sections. Each section serves a purpose in defining your infrastructure. AWSTemplateFormatVersion : 2010-09-09

Required - template version

Description : Optional description string

Optional description

Section order matters for readability but CloudFormation accepts any order

Mappings : { }

Static configuration tables

Metadata : { }

Additional information about resources

Parameters : { }

Input values for customization

Rules : { }

Parameter validation rules

Conditions : { }

Conditional resource creation

Transform : { }

Macro processing (e.g., AWS::Serverless)

Resources : { }

AWS resources to create (REQUIRED)

Outputs : { }

Return values after stack creation

Format Version The AWSTemplateFormatVersion identifies the template version. Current version is 2010-09-09 . AWSTemplateFormatVersion : 2010-09-09 Description : My CloudFormation Template Description Add a description to document the template's purpose. Must appear after the format version. AWSTemplateFormatVersion : 2010-09-09 Description :

This template creates a VPC with public and private subnets for hosting web applications. It includes: - Internet Gateway for public access - NAT Gateway for private subnet outbound access - Security groups for web and database tiers Metadata Use Metadata for additional information about resources or parameters. Metadata : AWS::CloudFormation::Interface : ParameterGroups : - Label : default : Network Configuration Parameters : - VpcCidr - PublicSubnetCidr - PrivateSubnetCidr - Label : default : Tags Parameters : - EnvironmentName - ProjectName ParameterLabels : VpcCidr : default : VPC CIDR Block EnvironmentName : default : Environment Name Resources Section The Resources section is the only required section. It defines AWS resources to provision. Resources : MyVPC : Type : AWS : : EC2 : : VPC Properties : CidrBlock : 10.0.0.0/16 EnableDnsHostnames : true EnableDnsSupport : true Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - vpc Parameters Parameter Types Use AWS-specific parameter types for validation and easier selection in the console. Parameters : VpcId : Type : AWS : : EC2 : : VPC : : Id Description : Select an existing VPC SubnetId : Type : AWS : : EC2 : : Subnet : : Id Description : Select a subnet SecurityGroupIds : Type : List<AWS : : EC2 : : SecurityGroup : : Id

Description : Select existing security groups InstanceType : Type : AWS : : EC2 : : InstanceType Description : EC2 instance type Default : t3.micro AllowedValues : - t3.micro - t3.small - t3.medium - t3.large AmiId : Type : AWS : : EC2 : : Image : : Id Description : Select an AMI KeyName : Type : AWS : : EC2 : : KeyPair : : KeyName Description : Select an existing key pair Parameter Constraints Add constraints to validate parameter values. Parameters : VpcCidr : Type : String Description : CIDR block for the VPC Default : 10.0.0.0/16 AllowedPattern : ^( [ 0 - 9 ] { 1 , 3 } .) { 3 } [ 0 - 9 ] { 1 , 3 } / [ 0 - 9 ] { 1 , 2 } $ ConstraintDescription : Must be a valid CIDR block (x.x.x.x/x) InstanceCount : Type : Number Description : Number of instances to launch Default : 1 MinValue : 1 MaxValue : 10 Environment : Type : String Description : Deployment environment Default : development AllowedValues : - development - staging - production ConstraintDescription : Must be development , staging , or production SSM Parameter Types Reference Systems Manager parameters for dynamic values. Parameters : LatestAmiId : Type : AWS : : SSM : : Parameter : : Value<AWS : : EC2 : : Image : : Id

Description : Latest AMI ID from SSM Default : /aws/service/ami - amazon - linux - latest/amzn2 - ami - hvm - x86_64 - gp2 Mappings Use Mappings for static configuration data based on regions or other factors. Mappings : RegionMap : us-east-1 : HVM64 : ami - 0ff8a95407f89df2f HVMG2 : ami - 0a0c776d80e2a1f3c us-west-2 : HVM64 : ami - 0a0c776d80e2a1f3c HVMG2 : ami - 0a0c776d80e2a1f3c eu-west-1 : HVM64 : ami - 0ff8a95407f89df2f HVMG2 : ami - 0a0c776d80e2a1f3c EnvironmentConfig : development : InstanceType : t3.micro MinInstances : 1 MaxInstances : 2 staging : InstanceType : t3.small MinInstances : 1 MaxInstances : 3 production : InstanceType : t3.medium MinInstances : 2 MaxInstances : 10 Resources : Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !FindInMap [ RegionMap , !Ref AWS : : Region , HVM64 ] InstanceType : !FindInMap [ EnvironmentConfig , !Ref Environment , InstanceType ] Conditions Use Conditions to conditionally create resources based on parameters. Parameters : DeployNatGateway : Type : String Default : true AllowedValues : - true - false Environment : Type : String Default : development AllowedValues : - development - staging - production Conditions : ShouldDeployNat : !Equals [ !Ref DeployNatGateway , true ] IsProduction : !Equals [ !Ref Environment , production ] Resources : NatGateway : Type : AWS : : EC2 : : NatGateway Condition : ShouldDeployNat Properties : AllocationId : !If - ShouldDeployNat - !GetAtt EIP.AllocationId - !Ref AWS : : NoValue SubnetId : !Ref PublicSubnet ProductionOnlyResource : Type : AWS : : EC2 : : VPCEndpoint Condition : IsProduction Properties : ServiceName : !Sub com.amazonaws.$ { AWS : : Region } .s3 VpcId : !Ref VPC Transform Use Transform for macros like AWS::Serverless for SAM templates. AWSTemplateFormatVersion : 2010-09-09 Transform : AWS : : Serverless - 2016-10-31 Description : SAM template for serverless application Resources : MyFunction : Type : AWS : : Serverless : : Function Properties : Handler : index.handler Runtime : nodejs18.x CodeUri : function/ Events : ApiEvent : Type : Api Properties : Path : / { proxy+ } Method : ANY Outputs and Cross-Stack References Basic Outputs Outputs : VpcId : Description : VPC ID Value : !Ref VPC PublicSubnetId : Description : Public Subnet ID Value : !Ref PublicSubnet VpcCidr : Description : VPC CIDR Block Value : !GetAtt VPC.CidrBlock Exporting Values for Cross-Stack References Export values so other stacks can import them. Outputs : VpcId : Description : VPC ID for other stacks Value : !Ref VPC Export : Name : !Sub $ { AWS : : StackName } - VpcId PublicSubnetIds : Description : Comma - separated public subnet IDs Value : !Join [ "," , [ !Ref PublicSubnet1 , !Ref PublicSubnet2 ] ] Export : Name : !Sub $ { AWS : : StackName } - PublicSubnetIds PrivateSubnetIds : Description : Comma - separated private subnet IDs Value : !Join [ "," , [ !Ref PrivateSubnet1 , !Ref PrivateSubnet2 ] ] Export : Name : !Sub $ { AWS : : StackName } - PrivateSubnetIds Importing Values in Another Stack Parameters : VpcId : Type : AWS : : EC2 : : VPC : : Id Description : VPC ID from network stack

User selects from exported values in console

Or use Fn::ImportValue for programmatic access

Resources : SecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : VpcId : !ImportValue Fn::Sub : $ { NetworkStackName } - VpcId GroupDescription : Security group for application Cross-Stack Reference Pattern Create a dedicated network stack that exports values:

network-stack.yaml

AWSTemplateFormatVersion : 2010-09-09 Description : Network infrastructure stack Resources : VPC : Type : AWS : : EC2 : : VPC Properties : CidrBlock : 10.0.0.0/16 Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - vpc PublicSubnets : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.1.0/24 AvailabilityZone : !Select [ 0 , !GetAZs '' ] MapPublicIpOnLaunch : true Outputs : VpcId : Value : !Ref VPC Export : Name : !Sub $ { AWS : : StackName } - VpcId PublicSubnetIds : Value : !Ref PublicSubnets Export : Name : !Sub $ { AWS : : StackName } - PublicSubnetIds Application stack imports these values:

application-stack.yaml

AWSTemplateFormatVersion : 2010-09-09 Description : Application stack that imports from network Parameters : NetworkStackName : Type : String Description : Name of the network stack Default : network - stack Resources : Instance : Type : AWS : : EC2 : : Instance Properties : SubnetId : !ImportValue Fn::Sub : $ { NetworkStackName } - PublicSubnetIds InstanceType : t3.micro VPC Components VPC with All Components AWSTemplateFormatVersion : 2010-09-09 Description : Complete VPC with public/private subnets , NAT , and IGW Parameters : EnvironmentName : Type : String Default : production Resources :

VPC

VPC : Type : AWS : : EC2 : : VPC Properties : CidrBlock : 10.0.0.0/16 EnableDnsHostnames : true EnableDnsSupport : true Tags : - Key : Name Value : !Sub $ { EnvironmentName } - vpc - Key : Environment Value : !Ref EnvironmentName

Internet Gateway

InternetGateway : Type : AWS : : EC2 : : InternetGateway Properties : Tags : - Key : Name Value : !Sub $ { EnvironmentName } - igw - Key : Environment Value : !Ref EnvironmentName InternetGatewayAttachment : Type : AWS : : EC2 : : VPCGatewayAttachment Properties : VpcId : !Ref VPC InternetGatewayId : !Ref InternetGateway

NAT Gateway (with EIP)

NatGatewayEIP : Type : AWS : : EC2 : : EIP DependsOn : InternetGatewayAttachment Properties : Domain : vpc Tags : - Key : Name Value : !Sub $ { EnvironmentName } - nat - eip NatGateway : Type : AWS : : EC2 : : NatGateway Properties : AllocationId : !GetAtt NatGatewayEIP.AllocationId SubnetId : !Ref PublicSubnet1 Tags : - Key : Name Value : !Sub $ { EnvironmentName } - nat - gw - Key : Environment Value : !Ref EnvironmentName

Public Subnets

PublicSubnet1 : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.1.0/24 AvailabilityZone : !Select [ 0 , !GetAZs '' ] MapPublicIpOnLaunch : true Tags : - Key : Name Value : !Sub $ { EnvironmentName } - public - 1 - Key : SubnetType Value : Public PublicSubnet2 : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.2.0/24 AvailabilityZone : !Select [ 1 , !GetAZs '' ] MapPublicIpOnLaunch : true Tags : - Key : Name Value : !Sub $ { EnvironmentName } - public - 2 - Key : SubnetType Value : Public

Private Subnets

PrivateSubnet1 : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.10.0/24 AvailabilityZone : !Select [ 0 , !GetAZs '' ] Tags : - Key : Name Value : !Sub $ { EnvironmentName } - private - 1 - Key : SubnetType Value : Private PrivateSubnet2 : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.11.0/24 AvailabilityZone : !Select [ 1 , !GetAZs '' ] Tags : - Key : Name Value : !Sub $ { EnvironmentName } - private - 2 - Key : SubnetType Value : Private

Public Route Table

PublicRouteTable : Type : AWS : : EC2 : : RouteTable Properties : VpcId : !Ref VPC Tags : - Key : Name Value : !Sub $ { EnvironmentName } - public - rt DefaultPublicRoute : Type : AWS : : EC2 : : Route DependsOn : InternetGatewayAttachment Properties : RouteTableId : !Ref PublicRouteTable DestinationCidrBlock : 0.0.0.0/0 GatewayId : !Ref InternetGateway PublicSubnetRouteTableAssociation1 : Type : AWS : : EC2 : : SubnetRouteTableAssociation Properties : SubnetId : !Ref PublicSubnet1 RouteTableId : !Ref PublicRouteTable PublicSubnetRouteTableAssociation2 : Type : AWS : : EC2 : : SubnetRouteTableAssociation Properties : SubnetId : !Ref PublicSubnet2 RouteTableId : !Ref PublicRouteTable

Private Route Table (with NAT)

PrivateRouteTable : Type : AWS : : EC2 : : RouteTable Properties : VpcId : !Ref VPC Tags : - Key : Name Value : !Sub $ { EnvironmentName } - private - rt DefaultPrivateRoute : Type : AWS : : EC2 : : Route Properties : RouteTableId : !Ref PrivateRouteTable DestinationCidrBlock : 0.0.0.0/0 NatGatewayId : !Ref NatGateway PrivateSubnetRouteTableAssociation1 : Type : AWS : : EC2 : : SubnetRouteTableAssociation Properties : SubnetId : !Ref PrivateSubnet1 RouteTableId : !Ref PrivateRouteTable PrivateSubnetRouteTableAssociation2 : Type : AWS : : EC2 : : SubnetRouteTableAssociation Properties : SubnetId : !Ref PrivateSubnet2 RouteTableId : !Ref PrivateRouteTable Outputs : VpcId : Value : !Ref VPC Export : Name : !Sub $ { EnvironmentName } - VpcId InternetGatewayId : Value : !Ref InternetGateway Export : Name : !Sub $ { EnvironmentName } - InternetGatewayId PublicSubnetIds : Value : !Join [ "," , [ !Ref PublicSubnet1 , !Ref PublicSubnet2 ] ] Export : Name : !Sub $ { EnvironmentName } - PublicSubnetIds PrivateSubnetIds : Value : !Join [ "," , [ !Ref PrivateSubnet1 , !Ref PrivateSubnet2 ] ] Export : Name : !Sub $ { EnvironmentName } - PrivateSubnetIds NatGatewayId : Value : !Ref NatGateway Export : Name : !Sub $ { EnvironmentName } - NatGatewayId Best Practices Use AWS-Specific Parameter Types Always use AWS-specific parameter types for validation and easier selection. Parameters : VpcId : Type : AWS : : EC2 : : VPC : : Id Description : Select a VPC SubnetIds : Type : List<AWS : : EC2 : : Subnet : : Id

Description : Select subnets SecurityGroupIds : Type : List<AWS : : EC2 : : SecurityGroup : : Id

Description : Select security groups Organize by Lifecycle Separate resources that change at different rates into different stacks.

Network stack - rarely changes

AWSTemplateFormatVersion : 2010-09-09 Description : Network infrastructure (VPC , subnets , routes) Resources : VPC : AWS : : EC2 : : VPC Subnets : AWS : : EC2 : : Subnet RouteTables : AWS : : EC2 : : RouteTable

Application stack - changes frequently

AWSTemplateFormatVersion : 2010-09-09 Description : Application resources Parameters : NetworkStackName : Type : String Resources : Instances : AWS : : EC2 : : Instance Use Meaningful Names Use AWS::StackName and parameters for consistent naming. Resources : VPC : Type : AWS : : EC2 : : VPC Properties : Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - vpc - Key : Environment Value : !Ref EnvironmentName Use Pseudo Parameters Use pseudo parameters for region-agnostic templates. Resources : S3Bucket : Type : AWS : : S3 : : Bucket Properties : BucketName : !Sub $ { AWS : : StackName } - $ { AWS : : AccountId } - $ { AWS : : Region } LambdaFunction : Type : AWS : : Lambda : : Function Properties : Runtime : nodejs18.x Handler : index.handler Role : !GetAtt LambdaExecutionRole.Arn Validate Before Deployment

Validate template

aws cloudformation validate-template --template-body file://template.yaml

Check for syntax errors

aws cloudformation validate-template \ --template-body file://template.yaml \ --query 'Description'

Use cfn-lint for advanced validation

pip

install

cfn-lint

cfn-lint template.yaml

Stack Policies

Stack Policies prevent unintentional updates to critical resources. Use them to protect production infrastructure.

{

"Statement"

:

[

{

"Effect"

:

"Allow"

,

"Action"

:

"Update:*"

,

"Principal"

:

"*"

,

"Resource"

:

"*"

}

,

{

"Effect"

:

"Deny"

,

"Action"

:

[

"Update:Replace"

,

"Update:Delete"

]

,

"Principal"

:

"*"

,

"Resource"

:

"LogicalId=ProductionDatabase"

}

,

{

"Effect"

:

"Deny"

,

"Action"

:

"Update:Replace"

,

"Principal"

:

"*"

,

"Resource"

:

"LogicalId=VPC"

}

]

}

Apply the stack policy:

aws cloudformation set-stack-policy

\

--stack-name my-production-stack

\

--stack-policy-body file://stack-policy.json

Common Stack Policy Use Cases:

Protect database resources

Prevent accidental replacement of RDS instances

Protect VPC infrastructure

Prevent changes that could disrupt connectivity

Protect IAM roles

Prevent modifications that could break authorization Termination Protection Enable termination protection to prevent accidental stack deletion. This is critical for production environments. Enable via AWS Console: Go to CloudFormation > Stacks Select your stack Click "Stack actions" > "Enable termination protection" Enable via AWS CLI:

Enable termination protection

aws cloudformation update-termination-protection \ --stack-name my-production-stack \ --enable-termination-protection

Disable termination protection (requires console access)

aws cloudformation update-termination-protection \ --stack-name my-production-stack \ --no-enable-termination-protection Enable via CloudFormation (for new stacks): Resources : ProductionStack : Type : AWS : : CloudFormation : : Stack Properties : TemplateURL : https : //s3.amazonaws.com/my - bucket/production.yaml TerminationProtection : true Important Considerations: Termination protection does not prevent stack updates To delete a protected stack, you must first disable termination protection Nested stacks inherit termination protection from parent stacks Always enable for production and staging environments Drift Detection Drift detection identifies differences between your CloudFormation stack and the actual infrastructure. Run regular drift checks to ensure compliance. Detect Drift on a Stack:

Detect drift on a stack

aws cloudformation detect-drift \ --stack-name my-vpc-stack

Check drift status

aws cloudformation describe-stack-drift-detection-status \ --stack-drift-detection-id < detection-id

Get drift detection results

aws cloudformation describe-stack-resource-drifts

\

--stack-name my-vpc-stack

Drift Status Values:

IN_SYNC

Resource matches the template

DRIFTED

Resource has been modified outside CloudFormation

NOT_CHECKED

Resource was not checked

UNKNOWN

Drift status could not be determined Automated Drift Detection with Events:

Use AWS Config for continuous drift monitoring

Resources : ConfigRule : Type : AWS : : Config : : ConfigRule Properties : ConfigRuleName : cloudformation - drift - detection Scope : ComplianceResourceTypes : - AWS : : EC2 : : VPC - AWS : : EC2 : : Subnet - AWS : : EC2 : : SecurityGroup Source : Owner : CUSTOM_LAMBDA SourceIdentifier : Fn::GetAtt : [ DriftDetectionFunction , Arn ] Best Practices for Drift Detection: Run drift detection weekly for production stacks Set up CloudWatch Events to trigger drift detection on schedule Document and address all drift immediately Use drift detection as part of change management process Change Sets Change Sets allow you to preview stack changes before applying them. This is essential for production deployments. Create and Review a Change Set:

Create a change set

aws cloudformation create-change-set \ --stack-name my-vpc-stack \ --template-body file://updated-template.yaml \ --change-set-name vpc-update-changeset \ --capabilities CAPABILITY_IAM

List change sets

aws cloudformation list-change-sets \ --stack-name my-vpc-stack

Describe change set

aws cloudformation describe-change-set \ --stack-name my-vpc-stack \ --change-set-name vpc-update-changeset

Execute change set

aws cloudformation execute-change-set \ --stack-name my-vpc-stack \ --change-set-name vpc-update-changeset

Delete change set (if not executing)

aws cloudformation delete-change-set \ --stack-name my-vpc-stack \ --change-set-name vpc-update-changeset Change Set Types: Type Description Use Case UPDATE Standard update Regular changes CREATE Creates new stack Initial deployment IMPORT Imports existing resources Lift-and-shift Change Set Output Example: { "ChangeSetId" : "arn:aws:cloudformation:us-east-1:123456789:changeSet/..." , "Changes" : [ { "Type" : "Resource" , "ResourceChange" : { "Action" : "Modify" , "LogicalResourceId" : "VPC" , "PhysicalResourceId" : "vpc-12345678" , "Replacement" : "False" , "Details" : [ { "Target" : { "Attribute" : "Tags" , "RequiresRecreation" : "Never" } , "Evaluation" : "Static" , "ChangeSource" : "DirectModification" } ] } } ] , "ExecutionStatus" : "AVAILABLE" , "Status" : "CREATE_COMPLETE" } Best Practices for Change Sets: Always create a change set before updating production stacks Review all changes carefully before execution Use meaningful change set names (e.g., vpc-security-update-2024-01 ) Execute change sets promptly after review Set a TTL on change sets if your organization requires approval workflows CI/CD Integration with Change Sets

GitHub Actions workflow for safe deployments

name : Deploy CloudFormation on : push : branches : [ main ] jobs : deploy : runs-on : ubuntu - latest steps : - uses : actions/checkout@v4 - name : Configure AWS Credentials uses : aws - actions/configure - aws - credentials@v4 with : role-to-assume : arn : aws : iam : : 123456789 : role/GitHubActionsRole aws-region : us - east - 1 - name : Create Change Set id : changeset run : | aws cloudformation create-change-set \ --stack-name ${{ env.STACK_NAME }} \ --template-body file://template.yaml \ --change-set-name preview-changes \ --capabilities CAPABILITY_IAM \ --query 'Id' \ --output text - name : Describe Change Set run : | aws cloudformation describe-change-set \ --stack-name ${{ env.STACK_NAME }} \ --change-set-name preview-changes - name : Execute Change Set (Manual approval required) if : github.event_name == 'push' && github.ref == 'refs/heads/main' run : | aws cloudformation execute-change-set \ --stack-name ${{ env.STACK_NAME }} \ --change-set-name preview-changes Related Resources For advanced patterns: See EXAMPLES.md For reference: See REFERENCE.md AWS CloudFormation User Guide: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/ AWS VPC Documentation: https://docs.aws.amazon.com/vpc/latest/userguide/