AWS CloudFormation EC2 Infrastructure Overview Create production-ready EC2 infrastructure using AWS CloudFormation templates. This skill covers EC2 instances (On-Demand and SPOT), Security Groups, IAM roles and instance profiles, Application Load Balancers (ALB), Target Groups, template structure best practices, parameter patterns, and cross-stack references for modular, reusable infrastructure as code. When to Use Use this skill when: Creating new EC2 instances (On-Demand or SPOT) Configuring Security Groups for network access control Creating IAM roles and instance profiles for EC2 Setting up Application Load Balancers (ALB) with target groups Implementing template Parameters with AWS-specific types Creating Outputs for cross-stack references Organizing templates with Mappings and Conditions Designing reusable, modular CloudFormation templates Quick Start Basic EC2 Instance with Secure Configuration AWSTemplateFormatVersion : 2010-09-09 Description : Simple EC2 instance with secure SSH access Parameters : LatestAmiId : Type : AWS : : SSM : : Parameter : : Value<AWS : : EC2 : : Image : : Id

Default : /aws/service/ami - amazon - linux - latest/amzn2 - ami - hvm - x86_64 - gp2 InstanceType : Type : String Default : t3.micro AllowedValues : - t3.micro - t3.small - t3.medium KeyName : Type : AWS : : EC2 : : KeyPair : : KeyName Description : SSH key pair name SshLocation : Type : String Description : CIDR block for SSH access Default : 10.0.0.0/16 AllowedPattern : ^( [ 0 - 9 ] { 1 , 3 } .) { 3 } [ 0 - 9 ] { 1 , 3 } / [ 0 - 9 ] { 1 , 2 } $ Resources : InstanceSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupDescription : Security group for EC2 instance VpcId : !Ref VpcId SecurityGroupIngress : - IpProtocol : tcp FromPort : 22 ToPort : 22 CidrIp : !Ref SshLocation - IpProtocol : tcp FromPort : 80 ToPort : 80 CidrIp : 0.0.0.0/0 Ec2Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !Ref LatestAmiId InstanceType : !Ref InstanceType KeyName : !Ref KeyName SecurityGroupIds : - !Ref InstanceSecurityGroup SubnetId : !Ref SubnetId Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - instance Outputs : InstanceId : Description : EC2 Instance ID Value : !Ref Ec2Instance PublicIp : Description : Public IP address Value : !GetAtt Ec2Instance.PublicIp EC2 Instance with IAM Role AWSTemplateFormatVersion : 2010-09-09 Description : EC2 instance with IAM role for S3 access Resources :

IAM Role for EC2 with least privilege permissions

Ec2Role : Type : AWS : : IAM : : Role Properties : AssumeRolePolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Principal : Service : ec2.amazonaws.com Action : sts : AssumeRole ManagedPolicyArns : [ ] Policies : - PolicyName : S3WriteAccess PolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Action : - s3 : PutObject - s3 : GetObject Resource : !Sub "arn:aws:s3:::${S3BucketName}/*"

Instance Profile

Ec2InstanceProfile : Type : AWS : : IAM : : InstanceProfile Properties : Roles : - !Ref Ec2Role InstanceProfileName : !Sub $ { AWS : : StackName } - profile

EC2 Instance

Ec2Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !Ref LatestAmiId InstanceType : !Ref InstanceType IamInstanceProfile : !Ref Ec2InstanceProfile

... other properties

Template Structure Template Sections Overview AWS CloudFormation templates are JSON or YAML files with specific sections. Each section serves a purpose in defining your infrastructure. AWSTemplateFormatVersion : 2010-09-09

Required - template version

Description : Optional description string

Optional description

Section order matters for readability but CloudFormation accepts any order

Mappings : { }

Static configuration tables

Metadata : { }

Additional information about resources

Parameters : { }

Input values for customization

Rules : { }

Parameter validation rules

Conditions : { }

Conditional resource creation

Transform : { }

Macro processing (e.g., AWS::Serverless)

Resources : { }

AWS resources to create (REQUIRED)

Outputs : { }

Return values after stack creation

Format Version The AWSTemplateFormatVersion identifies the template version. Current version is 2010-09-09 . AWSTemplateFormatVersion : 2010-09-09 Description : My CloudFormation Template Description Add a description to document the template's purpose. Must appear after the format version. AWSTemplateFormatVersion : 2010-09-09 Description :

This template creates an EC2 instance with a security group and IAM role for running web applications. It includes: - EC2 instance configuration - Security group with HTTP/HTTPS access - IAM role with S3 access permissions Metadata Use Metadata for additional information about resources or parameters. Metadata : AWS::CloudFormation::Interface : ParameterGroups : - Label : default : EC2 Configuration Parameters : - InstanceType - KeyName - Label : default : Network Configuration Parameters : - VpcId - SubnetId ParameterLabels : InstanceType : default : EC2 Instance Type KeyName : default : SSH Key Pair Resources Section The Resources section is the only required section. It defines AWS resources to provision. Resources : MyInstance : Type : AWS : : EC2 : : Instance Properties : ImageId : ami - 0ff8a95407f89df2f InstanceType : t3.micro KeyName : my - key - pair Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - instance Parameters Parameter Types Use AWS-specific parameter types for validation and easier selection in the console. Parameters : VpcId : Type : AWS : : EC2 : : VPC : : Id Description : Select an existing VPC SubnetId : Type : AWS : : EC2 : : Subnet : : Id Description : Select a subnet SecurityGroupIds : Type : List<AWS : : EC2 : : SecurityGroup : : Id

Description : Select existing security groups InstanceType : Type : AWS : : EC2 : : InstanceType Description : EC2 instance type Default : t3.micro AllowedValues : - t3.micro - t3.small - t3.medium - t3.large AmiId : Type : AWS : : EC2 : : Image : : Id Description : Select an AMI KeyName : Type : AWS : : EC2 : : KeyPair : : KeyName Description : Select an existing key pair AlbArn : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer : : Arn Description : Select an ALB SSM Parameter Types Reference Systems Manager parameters for dynamic values. Parameters : LatestAmiId : Type : AWS : : SSM : : Parameter : : Value<AWS : : EC2 : : Image : : Id

Description : Latest AMI ID from SSM Default : /aws/service/ami - amazon - linux - latest/amzn2 - ami - hvm - x86_64 - gp2 LatestAmiIdARM : Type : AWS : : SSM : : Parameter : : Value<AWS : : EC2 : : Image : : Id

Description : Latest ARM AMI ID from SSM Default : /aws/service/ami - amazon - linux - latest/amzn2 - ami - hvm - arm64 - gp2 Parameter Constraints Add constraints to validate parameter values. Parameters : VpcCidr : Type : String Description : CIDR block for the VPC Default : 10.0.0.0/16 AllowedPattern : ^( [ 0 - 9 ] { 1 , 3 } .) { 3 } [ 0 - 9 ] { 1 , 3 } / [ 0 - 9 ] { 1 , 2 } $ ConstraintDescription : Must be a valid CIDR block (x.x.x.x/x) InstanceCount : Type : Number Description : Number of instances to launch Default : 1 MinValue : 1 MaxValue : 10 Environment : Type : String Description : Deployment environment Default : development AllowedValues : - development - staging - production ConstraintDescription : Must be development , staging , or production VolumeSize : Type : Number Description : EBS volume size in GB Default : 20 MinValue : 8 MaxValue : 1000 Mappings Use Mappings for static configuration data based on regions or other factors. Mappings : RegionMap : us-east-1 : HVM64 : ami - 0ff8a95407f89df2f HVMG2 : ami - 0a0c776d80e2a1f3c us-west-2 : HVM64 : ami - 0a0c776d80e2a1f3c HVMG2 : ami - 0a0c776d80e2a1f3c eu-west-1 : HVM64 : ami - 0ff8a95407f89df2f HVMG2 : ami - 0a0c776d80e2a1f3c EnvironmentConfig : development : InstanceType : t3.micro MinInstances : 1 MaxInstances : 2 EnableAutoScaling : false staging : InstanceType : t3.small MinInstances : 1 MaxInstances : 3 EnableAutoScaling : false production : InstanceType : t3.medium MinInstances : 2 MaxInstances : 10 EnableAutoScaling : true Resources : Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !FindInMap [ RegionMap , !Ref AWS : : Region , HVM64 ] InstanceType : !FindInMap [ EnvironmentConfig , !Ref Environment , InstanceType ] Conditions Use Conditions to conditionally create resources based on parameters. Parameters : DeployAlb : Type : String Default : true AllowedValues : - true - false Environment : Type : String Default : development AllowedValues : - development - staging - production UseSpotInstance : Type : String Default : false AllowedValues : - true - false Conditions : ShouldDeployAlb : !Equals [ !Ref DeployAlb , true ] IsProduction : !Equals [ !Ref Environment , production ] ShouldUseSpot : !Equals [ !Ref UseSpotInstance , true ] IsNotDevelopment : !Not [ !Equals [ !Ref Environment , development ] ] Resources : ApplicationLoadBalancer : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer Condition : ShouldDeployAlb Properties : Scheme : internet - facing SecurityGroups : - !Ref AlbSecurityGroup Subnets : !Ref PublicSubnetIds ProductionScalingPolicy : Type : AWS : : AutoScaling : : ScalingPolicy Condition : IsProduction Properties : AutoScalingGroupName : !Ref AutoScalingGroup PolicyType : TargetTrackingScaling TargetTrackingConfiguration : PredefinedMetricSpecification : PredefinedMetricType : ASGAverageCPUUtilization TargetValue : 70.0 Transform Use Transform for macros like AWS::Serverless for SAM templates. AWSTemplateFormatVersion : 2010-09-09 Transform : AWS : : Serverless - 2016-10-31 Description : SAM template for serverless application with EC2 Resources : MyFunction : Type : AWS : : Serverless : : Function Properties : Handler : index.handler Runtime : nodejs18.x CodeUri : function/ Outputs and Cross-Stack References Basic Outputs Outputs : InstanceId : Description : EC2 Instance ID Value : !Ref Ec2Instance PublicIp : Description : Public IP address Value : !GetAtt Ec2Instance.PublicIp PrivateIp : Description : Private IP address Value : !GetAtt Ec2Instance.PrivateIp AvailabilityZone : Description : Availability Zone Value : !GetAtt Ec2Instance.AvailabilityZone Exporting Values for Cross-Stack References Export values so other stacks can import them. Outputs : InstanceId : Description : EC2 Instance ID for other stacks Value : !Ref Ec2Instance Export : Name : !Sub $ { AWS : : StackName } - InstanceId SecurityGroupId : Description : Security Group ID for other stacks Value : !Ref InstanceSecurityGroup Export : Name : !Sub $ { AWS : : StackName } - SecurityGroupId InstanceRoleArn : Description : IAM Role ARN for other stacks Value : !GetAtt Ec2Role.Arn Export : Name : !Sub $ { AWS : : StackName } - InstanceRoleArn TargetGroupArn : Description : Target Group ARN for other stacks Value : !Ref ApplicationTargetGroup Export : Name : !Sub $ { AWS : : StackName } - TargetGroupArn Importing Values in Another Stack Parameters : VpcId : Type : AWS : : EC2 : : VPC : : Id Description : VPC ID from network stack SecurityGroupId : Type : AWS : : EC2 : : SecurityGroup : : Id Description : Security Group ID from security stack InstanceRoleArn : Type : String Description : IAM Role ARN from security stack

Or use Fn::ImportValue for programmatic access

Resources : SecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : VpcId : !ImportValue Fn::Sub : $ { NetworkStackName } - VpcId GroupDescription : Security group for application Instance : Type : AWS : : EC2 : : Instance Properties : IamInstanceProfile : !ImportValue Fn::Sub : $ { SecurityStackName } - InstanceRoleArn Cross-Stack Reference Pattern Create a dedicated security stack that exports values:

security-stack.yaml

AWSTemplateFormatVersion : 2010-09-09 Description : Security resources stack Resources : InstanceSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupDescription : Security group for EC2 instances VpcId : !Ref VpcId SecurityGroupIngress : - IpProtocol : tcp FromPort : 80 ToPort : 80 CidrIp : 0.0.0.0/0 Ec2Role : Type : AWS : : IAM : : Role Properties : AssumeRolePolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Principal : Service : ec2.amazonaws.com Action : sts : AssumeRole Outputs : SecurityGroupId : Value : !Ref InstanceSecurityGroup Export : Name : !Sub $ { AWS : : StackName } - SecurityGroupId InstanceRoleArn : Value : !GetAtt Ec2Role.Arn Export : Name : !Sub $ { AWS : : StackName } - InstanceRoleArn Application stack imports these values:

application-stack.yaml

AWSTemplateFormatVersion : 2010-09-09 Description : Application stack that imports from security stack Parameters : SecurityStackName : Type : String Description : Name of the security stack Default : security - stack Resources : Ec2Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !Ref AmiId InstanceType : !Ref InstanceType SecurityGroupIds : - !ImportValue Fn::Sub : $ { SecurityStackName } - SecurityGroupId IamInstanceProfile : !ImportValue Fn::Sub : $ { SecurityStackName } - InstanceRoleArn EC2 Instances Basic Instance Configuration Resources : Ec2Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !Ref AmiId InstanceType : !Ref InstanceType KeyName : !Ref KeyName SubnetId : !Ref SubnetId SecurityGroupIds : - !Ref SecurityGroup UserData : Fn::Base64 : |

!/bin/bash

yum update -y yum install -y httpd systemctl start httpd Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - instance - Key : Environment Value : !Ref EnvironmentName Instance with Multiple Volumes Resources : Ec2Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !Ref AmiId InstanceType : !Ref InstanceType BlockDeviceMappings : - DeviceName : /dev/xvda Ebs : VolumeSize : 20 DeleteOnTermination : true VolumeType : gp3 - DeviceName : /dev/xvdh Ebs : VolumeSize : 50 DeleteOnTermination : false VolumeType : gp3 - DeviceName : /dev/xvdi Ebs : VolumeSize : 100 DeleteOnTermination : false VolumeType : st1 Instance with Detailed Monitoring Resources : Ec2Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !Ref AmiId InstanceType : !Ref InstanceType Monitoring : true Metrics : CollectionInterval : 60 Instance with Placement Resources : Ec2Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !Ref AmiId InstanceType : !Ref InstanceType Placement : AvailabilityZone : !Select [ 0 , !GetAZs '' ] GroupName : !Ref PlacementGroup Tenancy : default SPOT Instances SPOT Fleet AWSTemplateFormatVersion : 2010-09-09 Description : SPOT Fleet for cost - optimized instances Parameters : MaxPrice : Type : Number Default : 0.05 Description : Maximum price per instance hour Resources : SpotFleet : Type : AWS : : EC2 : : SpotFleet Properties : SpotFleetRequestConfigData : TargetCapacity : 10 IamFleetRole : !GetAtt SpotFleetRole.Arn LaunchSpecifications : - InstanceType : t3.micro ImageId : !Ref AmiId SubnetId : !Ref SubnetId WeightedCapacity : 1 - InstanceType : t3.small ImageId : !Ref AmiId SubnetId : !Ref SubnetId WeightedCapacity : 2 AllocationStrategy : lowestPrice SpotPrice : !Sub $ { MaxPrice } SpotFleetRole : Type : AWS : : IAM : : Role Properties : AssumeRolePolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Principal : Service : spotfleet.amazonaws.com Action : sts : AssumeRole Policies : - PolicyName : SpotFleetPolicy PolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Action : - ec2 : DescribeInstances - ec2 : DescribeImages Resource : "" SPOT Instance Request Resources : SpotRequest : Type : AWS : : EC2 : : SpotFleet Properties : SpotFleetRequestConfigData : TargetCapacity : 1 IamFleetRole : !GetAtt SpotFleetRole.Arn LaunchSpecifications : - InstanceType : t3.medium ImageId : !Ref AmiId SubnetId : !Ref SubnetId KeyName : !Ref KeyName Type : persistent SPOT Instance with Fallback Resources : OnDemandInstance : Type : AWS : : EC2 : : Instance Condition : IsNotSpot Properties : ImageId : !Ref AmiId InstanceType : !Ref InstanceType SpotInstance : Type : AWS : : EC2 : : SpotFleet Condition : UseSpot Properties : SpotFleetRequestConfigData : TargetCapacity : 1 IamFleetRole : !GetAtt SpotFleetRole.Arn LaunchSpecifications : - InstanceType : t3.medium ImageId : !Ref AmiId SubnetId : !Ref SubnetId Security Groups Basic Security Group Resources : WebSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupDescription : Security group for web servers VpcId : !Ref VpcId SecurityGroupIngress : - IpProtocol : tcp FromPort : 80 ToPort : 80 CidrIp : 0.0.0.0/0 - IpProtocol : tcp FromPort : 443 ToPort : 443 CidrIp : 0.0.0.0/0 - IpProtocol : tcp FromPort : 22 ToPort : 22 CidrIp : 10.0.0.0/16 SecurityGroupEgress : - IpProtocol : tcp FromPort : 443 ToPort : 443 CidrIp : 0.0.0.0/0 Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - web - sg Security Group with Self Reference Resources : AppSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupDescription : Security group for application VpcId : !Ref VpcId SecurityGroupIngress : - IpProtocol : tcp FromPort : 8080 ToPort : 8080 SourceSecurityGroupId : !Ref LoadBalancerSecurityGroup Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - app - sg DatabaseSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupDescription : Security group for database VpcId : !Ref VpcId SecurityGroupIngress : - IpProtocol : tcp FromPort : 5432 ToPort : 5432 SourceSecurityGroupId : !Ref AppSecurityGroup Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - db - sg Security Group for ALB Resources : AlbSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupDescription : Security group for Application Load Balancer VpcId : !Ref VpcId SecurityGroupIngress : - IpProtocol : tcp FromPort : 80 ToPort : 80 CidrIp : 0.0.0.0/0 - IpProtocol : tcp FromPort : 443 ToPort : 443 CidrIp : 0.0.0.0/0 SecurityGroupEgress : - IpProtocol : tcp FromPort : 80 ToPort : 80 SourceSecurityGroupId : !Ref AppSecurityGroup - IpProtocol : tcp FromPort : 443 ToPort : 443 SourceSecurityGroupId : !Ref AppSecurityGroup IAM Roles EC2 IAM Role with Least Privilege Resources : Ec2Role : Type : AWS : : IAM : : Role Properties : AssumeRolePolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Principal : Service : ec2.amazonaws.com Action : sts : AssumeRole ManagedPolicyArns : [ ] Policies : - PolicyName : S3Access PolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Action : - s3 : GetObject - s3 : PutObject - s3 : DeleteObject Resource : !Sub "arn:aws:s3:::${S3BucketName}/" - PolicyName : CloudWatchLogs PolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Action : - logs : CreateLogGroup - logs : CreateLogStream - logs : PutLogEvents - logs : DescribeLogStreams Resource : !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/ec2/${EnvironmentName}/" Ec2InstanceProfile : Type : AWS : : IAM : : InstanceProfile Properties : Roles : - !Ref Ec2Role InstanceProfileName : !Sub $ { AWS : : StackName } - profile Role for Systems Manager Resources : SsmRole : Type : AWS : : IAM : : Role Properties : AssumeRolePolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Principal : Service : ec2.amazonaws.com Action : sts : AssumeRole ManagedPolicyArns : - arn : aws : iam : : aws : policy/AmazonSSMManagedInstanceCore Policies : - PolicyName : S3ReadAccess PolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Action : - s3 : GetObject Resource : !Sub "arn:aws:s3:::${S3BucketName}/" Application Load Balancer (ALB) Basic ALB Resources : ApplicationLoadBalancer : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer Properties : Name : !Sub $ { AWS : : StackName } - alb Scheme : internet - facing SecurityGroups : - !Ref AlbSecurityGroup Subnets : - !Ref PublicSubnet1 - !Ref PublicSubnet2 Type : application ApplicationTargetGroup : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup Properties : Name : !Sub $ { AWS : : StackName } - tg Port : 80 Protocol : HTTP VpcId : !Ref VpcId TargetType : instance HealthCheckPath : /health HealthCheckIntervalSeconds : 30 HealthCheckTimeoutSeconds : 5 HealthyThresholdCount : 2 UnhealthyThresholdCount : 3 Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - tg ApplicationListener : Type : AWS : : ElasticLoadBalancingV2 : : Listener Properties : DefaultActions : - Type : forward TargetGroupArn : !Ref ApplicationTargetGroup LoadBalancerArn : !Ref ApplicationLoadBalancer Port : 80 Protocol : HTTP ALB with HTTPS Resources : ApplicationLoadBalancer : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer Properties : Name : !Sub $ { AWS : : StackName } - alb Scheme : internet - facing SecurityGroups : - !Ref AlbSecurityGroup Subnets : - !Ref PublicSubnet1 - !Ref PublicSubnet2 ApplicationTargetGroup : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup Properties : Name : !Sub $ { AWS : : StackName } - tg Port : 443 Protocol : HTTPS VpcId : !Ref VpcId TargetType : instance HealthCheckPath : /health HealthCheckProtocol : HTTPS ApplicationListener : Type : AWS : : ElasticLoadBalancingV2 : : Listener Properties : DefaultActions : - Type : forward TargetGroupArn : !Ref ApplicationTargetGroup LoadBalancerArn : !Ref ApplicationLoadBalancer Port : 443 Protocol : HTTPS Certificates : - CertificateArn : !Ref CertificateArn ApplicationListenerHttpRedirect : Type : AWS : : ElasticLoadBalancingV2 : : Listener Properties : DefaultActions : - Type : redirect RedirectConfig : Host : "#{host}" Path : "/#{path}" Port : "443" Protocol : "HTTPS" Query : "#{query}" StatusCode : HTTP_301 LoadBalancerArn : !Ref ApplicationLoadBalancer Port : 80 Protocol : HTTP ALB with Multiple Target Groups Resources : ApplicationLoadBalancer : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer Properties : Name : !Sub $ { AWS : : StackName } - alb Scheme : internet - facing SecurityGroups : - !Ref AlbSecurityGroup Subnets : - !Ref PublicSubnet1 - !Ref PublicSubnet2 ApiTargetGroup : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup Properties : Name : !Sub $ { AWS : : StackName } - api - tg Port : 8080 Protocol : HTTP VpcId : !Ref VpcId HealthCheckPath : /actuator/health WebTargetGroup : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup Properties : Name : !Sub $ { AWS : : StackName } - web - tg Port : 80 Protocol : HTTP VpcId : !Ref VpcId HealthCheckPath : /health ApiListenerRule : Type : AWS : : ElasticLoadBalancingV2 : : ListenerRule Properties : Actions : - Type : forward TargetGroupArn : !Ref ApiTargetGroup Conditions : - Field : path - pattern Values : - /api/ - /v1/ ListenerArn : !Ref ApplicationListener Priority : 10 WebListenerRule : Type : AWS : : ElasticLoadBalancingV2 : : ListenerRule Properties : Actions : - Type : forward TargetGroupArn : !Ref WebTargetGroup Conditions : - Field : path - pattern Values : - /* ListenerArn : !Ref ApplicationListener Priority : 100 ALB with Cross-Zone Load Balancing Resources : ApplicationLoadBalancer : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer Properties : Name : !Sub $ { AWS : : StackName } - alb Scheme : internet - facing SecurityGroups : - !Ref AlbSecurityGroup Subnets : - !Ref PublicSubnet1 - !Ref PublicSubnet2 LoadBalancerAttributes : - Key : load_balancing.cross_zone.enabled Value : true Complete Example Full EC2 Stack with ALB AWSTemplateFormatVersion : 2010-09-09 Description : Complete EC2 stack with ALB , security groups , and IAM role Parameters : EnvironmentName : Type : String Default : production LatestAmiId : Type : AWS : : SSM : : Parameter : : Value<AWS : : EC2 : : Image : : Id

Default : /aws/service/ami - amazon - linux - latest/amzn2 - ami - hvm - x86_64 - gp2 InstanceType : Type : String Default : t3.micro AllowedValues : - t3.micro - t3.small - t3.medium - t3.large VpcCidr : Type : String Default : 10.0.0.0/16 Resources :

VPC

VPC : Type : AWS : : EC2 : : VPC Properties : CidrBlock : !Ref VpcCidr EnableDnsHostnames : true EnableDnsSupport : true Tags : - Key : Name Value : !Sub $ { EnvironmentName } - vpc - Key : Environment Value : !Ref EnvironmentName

Internet Gateway

InternetGateway : Type : AWS : : EC2 : : InternetGateway Properties : Tags : - Key : Name Value : !Sub $ { EnvironmentName } - igw - Key : Environment Value : !Ref EnvironmentName InternetGatewayAttachment : Type : AWS : : EC2 : : VPCGatewayAttachment Properties : VpcId : !Ref VPC InternetGatewayId : !Ref InternetGateway

Public Subnets

PublicSubnet1 : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.1.0/24 AvailabilityZone : !Select [ 0 , !GetAZs '' ] MapPublicIpOnLaunch : true Tags : - Key : Name Value : !Sub $ { EnvironmentName } - public - 1 - Key : SubnetType Value : Public PublicSubnet2 : Type : AWS : : EC2 : : Subnet Properties : VpcId : !Ref VPC CidrBlock : 10.0.2.0/24 AvailabilityZone : !Select [ 1 , !GetAZs '' ] MapPublicIpOnLaunch : true Tags : - Key : Name Value : !Sub $ { EnvironmentName } - public - 2 - Key : SubnetType Value : Public

Security Group for ALB

AlbSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupDescription : Security group for ALB VpcId : !Ref VPC SecurityGroupIngress : - IpProtocol : tcp FromPort : 80 ToPort : 80 CidrIp : 0.0.0.0/0 - IpProtocol : tcp FromPort : 443 ToPort : 443 CidrIp : 0.0.0.0/0 Tags : - Key : Name Value : !Sub $ { EnvironmentName } - alb - sg - Key : Environment Value : !Ref EnvironmentName

Security Group for EC2

InstanceSecurityGroup : Type : AWS : : EC2 : : SecurityGroup Properties : GroupDescription : Security group for EC2 instances VpcId : !Ref VPC SecurityGroupIngress : - IpProtocol : tcp FromPort : 80 ToPort : 80 SourceSecurityGroupId : !Ref AlbSecurityGroup - IpProtocol : tcp FromPort : 22 ToPort : 22 CidrIp : 10.0.0.0/16 Tags : - Key : Name Value : !Sub $ { EnvironmentName } - instance - sg - Key : Environment Value : !Ref EnvironmentName

IAM Role with specific permissions

Ec2Role : Type : AWS : : IAM : : Role Properties : AssumeRolePolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Principal : Service : ec2.amazonaws.com Action : sts : AssumeRole ManagedPolicyArns : - arn : aws : iam : : aws : policy/AmazonSSMManagedInstanceCore Policies : - PolicyName : S3Access PolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Action : - s3 : GetObject - s3 : PutObject Resource : !Sub "arn:aws:s3:::${S3BucketName}/" - PolicyName : CloudWatchLogs PolicyDocument : Version : "2012-10-17" Statement : - Effect : Allow Action : - logs : CreateLogGroup - logs : CreateLogStream - logs : PutLogEvents Resource : !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/ec2/${EnvironmentName}/" Tags : - Key : Name Value : !Sub $ { EnvironmentName } - ec2 - role Ec2InstanceProfile : Type : AWS : : IAM : : InstanceProfile Properties : Roles : - !Ref Ec2Role

Application Load Balancer

ApplicationLoadBalancer : Type : AWS : : ElasticLoadBalancingV2 : : LoadBalancer Properties : Name : !Sub $ { EnvironmentName } - alb Scheme : internet - facing SecurityGroups : - !Ref AlbSecurityGroup Subnets : - !Ref PublicSubnet1 - !Ref PublicSubnet2 Type : application ApplicationTargetGroup : Type : AWS : : ElasticLoadBalancingV2 : : TargetGroup Properties : Name : !Sub $ { EnvironmentName } - tg Port : 80 Protocol : HTTP VpcId : !Ref VPC TargetType : instance HealthCheckPath : /health HealthCheckIntervalSeconds : 30 HealthCheckTimeoutSeconds : 5 HealthyThresholdCount : 2 UnhealthyThresholdCount : 3 Tags : - Key : Name Value : !Sub $ { EnvironmentName } - tg ApplicationListener : Type : AWS : : ElasticLoadBalancingV2 : : Listener Properties : DefaultActions : - Type : forward TargetGroupArn : !Ref ApplicationTargetGroup LoadBalancerArn : !Ref ApplicationLoadBalancer Port : 80 Protocol : HTTP

EC2 Instance

Ec2Instance : Type : AWS : : EC2 : : Instance Properties : ImageId : !Ref LatestAmiId InstanceType : !Ref InstanceType IamInstanceProfile : !Ref Ec2InstanceProfile SecurityGroupIds : - !Ref InstanceSecurityGroup SubnetId : !Ref PublicSubnet1 UserData : Fn::Base64 : |

!/bin/bash

yum update -y yum install -y httpd systemctl start httpd systemctl enable httpd echo "

Hello from $(hostname)

Description : Select subnets SecurityGroupIds : Type : List<AWS : : EC2 : : SecurityGroup : : Id

Description : Select security groups InstanceType : Type : AWS : : EC2 : : InstanceType Description : EC2 instance type KeyName : Type : AWS : : EC2 : : KeyPair : : KeyName Description : Select a key pair Organize by Lifecycle Separate resources that change at different rates into different stacks.

Network stack - rarely changes

AWSTemplateFormatVersion : 2010-09-09 Description : Network infrastructure (VPC , subnets , routes) Resources : VPC : AWS : : EC2 : : VPC Subnets : AWS : : EC2 : : Subnet

Security stack - changes occasionally

AWSTemplateFormatVersion : 2010-09-09 Description : Security resources (IAM roles , security groups) Resources : SecurityGroups : AWS : : EC2 : : SecurityGroup Roles : AWS : : IAM : : Role

Application stack - changes frequently

AWSTemplateFormatVersion : 2010-09-09 Description : Application resources (EC2 instances , ALB) Parameters : NetworkStackName : Type : String SecurityStackName : Type : String Resources : Instances : AWS : : EC2 : : Instance LoadBalancer : AWS : : ElasticLoadBalancingV2 : : LoadBalancer Use Meaningful Names Use AWS::StackName and parameters for consistent naming. Resources : Ec2Instance : Type : AWS : : EC2 : : Instance Properties : Tags : - Key : Name Value : !Sub $ { AWS : : StackName } - instance - Key : Environment Value : !Ref EnvironmentName Use Pseudo Parameters Use pseudo parameters for region-agnostic templates. Resources : S3Bucket : Type : AWS : : S3 : : Bucket Properties : BucketName : !Sub $ { AWS : : StackName } - $ { AWS : : AccountId } - $ { AWS : : Region } Ec2Instance : Type : AWS : : EC2 : : Instance Properties : Tags : - Key : StackName Value : !Ref AWS : : StackName - Key : Region Value : !Ref AWS : : Region Validate Before Deployment

Validate template

aws cloudformation validate-template --template-body file://template.yaml

Check for syntax errors

aws cloudformation validate-template \ --template-body file://template.yaml \ --query 'Description'

Use cfn-lint for advanced validation

pip install cfn-lint cfn-lint template.yaml Stack Policies Stack policies protect stack resources from unintended updates that could cause service disruption. Apply policies to prevent accidental modifications or deletions of critical resources. Resources :

EC2 instance - allow updates but prevent deletion

Ec2Instance : Type : AWS : : EC2 : : Instance DeletionPolicy : Retain UpdateReplacePolicy : Retain

Database - prevent all updates

DatabaseInstance : Type : AWS : : RDS : : DBInstance DeletionPolicy : Snapshot UpdateReplacePolicy : Retain Stack Policy JSON Example: { "Statement" : [ { "Effect" : "Allow" , "Action" : "Update:" , "Principal" : "" , "Resource" : "" } , { "Effect" : "Deny" , "Action" : [ "Update:Delete" , "Update:Replace" ] , "Principal" : "" , "Resource" : "LogicalId=Ec2Instance" } , { "Effect" : "Deny" , "Action" : "Update:" , "Principal" : "" , "Resource" : "LogicalId=DatabaseInstance" } ] } Apply Stack Policy: aws cloudformation set-stack-policy \ --stack-name my-ec2-stack \ --stack-policy-body file://stack-policy.json

Or from a file

aws cloudformation set-stack-policy \ --stack-name my-ec2-stack \ --stack-policy-url https://s3.amazonaws.com/bucket/policy.json Termination Protection Enable termination protection to prevent accidental deletion of production stacks. This is critical for production environments.

Enable termination protection when creating a stack

aws cloudformation create-stack \ --stack-name my-ec2-stack \ --template-body file://template.yaml \ --enable-termination-protection

Enable termination protection on existing stack

aws cloudformation update-termination-protection \ --stack-name my-ec2-stack \ --enable-termination-protection

Disable termination protection (use with caution)

aws cloudformation update-termination-protection \ --stack-name my-ec2-stack \ --no-enable-termination-protection

Check if termination protection is enabled

aws cloudformation describe-stacks \ --stack-name my-ec2-stack \ --query 'Stacks[0].EnableTerminationProtection' Best Practices for Termination Protection: Enable on all production stacks Use AWS Organizations SCP to enforce termination protection Review before deleting development stacks Document the process for emergency termination Drift Detection Drift detection identifies differences between the actual infrastructure and the CloudFormation template. Regular drift checks ensure compliance and security.

Detect drift on a stack

aws cloudformation detect-drift \ --stack-name my-ec2-stack

Get drift detection status

aws cloudformation describe-stack-drift-detection-status \ --stack-drift-detection-id abc123

Get resources that have drifted

aws cloudformation describe-stack-resource-drifts \ --stack-name my-ec2-stack

Get detailed drift information for a specific resource

aws cloudformation describe-stack-resource-drifts \ --stack-name my-ec2-stack \ --stack-resource-drifts-limit 10 Detect Drift Programmatically:

!/bin/bash

detect-drift.sh - Automated drift detection script

STACK_NAME

$1 if [ -z " $STACK_NAME " ] ; then echo "Usage: $0 " exit 1 fi echo "Detecting drift for stack: $STACK_NAME "

Start drift detection

DETECTION_ID

$( aws cloudformation detect-drift \ --stack-name $STACK_NAME \ --query 'StackId' \ --output text ) echo "Drift detection started: $DETECTION_ID "

Wait for drift detection to complete

STATUS

"DETECTION_IN_PROGRESS" while [ " $STATUS " = "DETECTION_IN_PROGRESS" ] ; do sleep 5 STATUS = $( aws cloudformation describe-stack-drift-detection-status \ --stack-drift-detection-id $DETECTION_ID \ --query 'DetectionStatus' \ --output text ) echo "Status: $STATUS " done

Get drift status

DRIFT_STATUS

$( aws cloudformation describe-stack-drift-detection-status \ --stack-drift-detection-id $DETECTION_ID \ --query 'DriftStatus' \ --output text ) echo "Drift Status: $DRIFT_STATUS " if [ " $DRIFT_STATUS " = "DRIFTED" ] ; then echo "Resources with drift:" aws cloudformation describe-stack-resource-drifts \ --stack-name $STACK_NAME \ --query 'StackResourceDrifts[].{LogicalId:LogicalResourceId,Status:ResourceDriftStatus,Type:ResourceType}' else echo "No drift detected - stack is in sync with template" fi Common Drift Scenarios: Drift Type Description Action Required MODIFIED Resource properties changed Review and update template or revert changes DELETED Resource deleted outside CFN Recreate via template or import ADDED Resource created outside CFN Import to stack or delete manually Change Sets Change sets preview the impact of stack changes before execution. Always review change sets in production environments.

Create a change set

aws cloudformation create-change-set \ --stack-name my-ec2-stack \ --change-set-name my-ec2-changeset \ --template-body file://updated-template.yaml \ --capabilities CAPABILITY_IAM \ --change-set-type UPDATE

List change sets for a stack

aws cloudformation list-change-sets \ --stack-name my-ec2-stack

Describe a change set to see the planned changes

aws cloudformation describe-change-set \ --stack-name my-ec2-stack \ --change-set-name my-ec2-changeset

Execute a change set

aws cloudformation execute-change-set \ --stack-name my-ec2-stack \ --change-set-name my-ec2-changeset

Delete a change set if changes are not needed

aws cloudformation delete-change-set \ --stack-name my-ec2-stack \ --change-set-name my-ec2-changeset Change Set Types: Type Description Use Case UPDATE Preview changes to existing stack Modifying existing resources CREATE Preview new stack creation Creating new stacks from template IMPORT Preview resources to import Importing existing resources Review Change Sets with Filters:

Get changes affecting specific resource types

aws cloudformation describe-change-set \ --stack-name my-ec2-stack \ --change-set-name my-ec2-changeset \ --query 'Changes[?ResourceChange.ResourceType==AWS::EC2::Instance]'

Get changes with replacement impact

aws cloudformation describe-change-set \ --stack-name my-ec2-stack \ --change-set-name my-ec2-changeset \ --query 'Changes[?ResourceChange.Replacement!=None]' Automated Change Set Review Script:

!/bin/bash

review-changeset.sh - Automated change set review

STACK_NAME

$1 CHANGE_SET_NAME = $2 AUTO_APPROVE = false while getopts "a" opt ; do case $opt in a ) AUTO_APPROVE = true ; ; * ) echo "Usage: $0 [-a] " echo " -a: Auto-approve if no critical changes" exit 1 ; ; esac done echo "Reviewing change set: $CHANGE_SET_NAME " echo "Stack: $STACK_NAME " echo ""

Get change set summary

CHANGES

$( aws cloudformation describe-change-set \ --stack-name $STACK_NAME \ --change-set-name $CHANGE_SET_NAME \ --query 'Changes[*].{Type:Type,Resource:ResourceChange.LogicalResourceId,Action:ResourceChange.Action,Replacement:ResourceChange.Replacement}' \ --output table ) echo "Planned Changes:" echo " $CHANGES " echo ""

Check for critical changes (replacements or deletions)

CRITICAL_CHANGES

$( aws cloudformation describe-change-set \ --stack-name $STACK_NAME \ --change-set-name $CHANGE_SET_NAME \ --query 'Changes[?ResourceChange.Replacement==True || ResourceChange.Action==Remove]' \ --output json ) if [ -n " $CRITICAL_CHANGES " ] && [ " $CRITICAL_CHANGES " != "[]" ] ; then echo "WARNING: Critical changes detected that require manual review:" echo " $CRITICAL_CHANGES " echo "" echo "Please review manually before executing." exit 1 fi if [ " $AUTO_APPROVE " = true ] ; then echo "No critical changes - auto-executing change set..." aws cloudformation execute-change-set \ --stack-name $STACK_NAME \ --change-set-name $CHANGE_SET_NAME echo "Change set executed successfully." else echo "Review complete. No critical changes detected." echo "To execute: aws cloudformation execute-change-set --stack-name $STACK_NAME --change-set-name $CHANGE_SET_NAME " fi Related Resources For advanced examples: See EXAMPLES.md For reference: See REFERENCE.md AWS CloudFormation User Guide: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/ AWS EC2 Documentation: https://docs.aws.amazon.com/ec2/ AWS ALB Documentation: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/