Configuration management and IaC

CloudFormation basics

• A template (YAML or JSON) describes resources; a stack is a deployed instance of it. CloudFormation creates resources in dependency order and rolls back on failure.
• Sections: Parameters, Mappings (lookup tables, such as per Region), Conditions (create only in prod), Resources (the only required section), Outputs (values to show or Export), plus Metadata, Rules and Transform.
• Intrinsic functions: !Ref, !GetAtt, !Sub, !Join, !Select, !Split, !FindInMap, !If/!Equals, !ImportValue, !GetAZs, !Base64 (for user data). Pseudo parameters: AWS::Region, AWS::AccountId, AWS::StackName, AWS::Partition.
• Latest AMI without hard-coding: a parameter of type AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> defaulting to a public parameter such as /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64.
• Secrets in templates: dynamic references {{resolve:secretsmanager:MySecret:SecretString:password}} or {{resolve:ssm-secure:/path}}, and NoEcho on parameters.
• Capabilities: templates that create IAM resources need CAPABILITY_IAM or CAPABILITY_NAMED_IAM; macros need CAPABILITY_AUTO_EXPAND. A service role lets CloudFormation deploy with permissions the user doesn’t have.

Resource attributes

A non-empty S3 bucket can’t be deleted, so stack deletion fails. Fix it with a custom resource that empties the bucket on delete, or retain the bucket.

Changing stacks safely

Stack states to recognise

• ROLLBACK_COMPLETE after a failed create: the stack can only be deleted and recreated.
• A failed update rolls back automatically. --disable-rollback (“preserve successfully provisioned resources”) keeps the state for debugging.
• UPDATE_ROLLBACK_FAILED: fix the cause (often a resource changed by hand), then continue update rollback, optionally skipping resources.
• Resource import adopts existing resources into a stack.

Bootstrapping EC2

• cfn-init reads AWS::CloudFormation::Init metadata (packages, files, services, commands) and applies it. Logs: /var/log/cfn-init.log and cfn-init-cmd.log.
• cfn-signal reports success or failure to a CreationPolicy or wait condition. Without it, the instance is “complete” as soon as it launches, even if the software failed to install.
• cfn-hup is a daemon that detects metadata changes on stack updates and re-runs the actions — needed because user data only runs once. (cfn-get-metadata reads metadata.)
• User data output: /var/log/cloud-init-output.log.

Reuse and scale

• Nested stacks (AWS::CloudFormation::Stack) reuse components inside one parent and share its lifecycle.
• Cross-stack references (Export + !ImportValue) share values between independent stacks. You can’t delete or change an export while another stack imports it.
• Custom resources (Custom::Name, backed by Lambda or SNS) run your own logic: call external APIs, empty buckets, look things up. CloudFormation sends Create, Update or Delete with a pre-signed S3 ResponseURL, and your code must always reply SUCCESS or FAILED — otherwise the stack hangs for up to an hour.
• Macros and transforms process templates (SAM is the AWS::Serverless-2016-10-31 transform; AWS::Include inserts snippets). Modules package reusable resource groups. The Registry holds third-party and private resource types. Hooks validate resources before provisioning — Control Tower’s proactive controls use them.

StackSets

One template to many accounts and Regions.

Rollout options: maximum concurrent accounts, failure tolerance, Region order.

AWS CDK and AWS SAM

• CDK writes infrastructure in TypeScript, Python, Java, C# or Go and synthesises CloudFormation.
  • cdk bootstrap creates the toolkit stack (S3 bucket, ECR repository, roles) once per account and Region; for cross-account deployments, bootstrap the target to trust the pipeline account.
  • cdk synth generates a template without deploying, cdk diff compares with what’s deployed, cdk deploy deploys.
  • Constructs: L1 (raw Cfn* resources), L2 (sensible defaults), L3 (patterns). Share them as versioned packages through CodeArtifact.
  • CDK Pipelines is self-mutating: change the pipeline in code and it updates itself on the next run.
• SAM: shorthand CloudFormation for serverless. sam build, sam deploy, sam local. AutoPublishAlias + DeploymentPreference give CodeDeploy traffic shifting.
• Terraform appears mainly through Account Factory for Terraform (below).

Systems Manager

A suite for operating fleets (EC2, on-premises and other clouds) without SSH.

When is a node “managed”?

All three must be true:

1. The SSM Agent is installed (it’s preinstalled on Amazon Linux and Windows AMIs).
2. It has an instance profile with AmazonSSMManagedInstanceCore, or the organization-wide Default Host Management Configuration is on.
3. It can reach Systems Manager over outbound HTTPS: internet or NAT, or interface endpoints for ssm, ssmmessages and ec2messages (plus an S3 gateway endpoint and logs if needed). No inbound ports.

On-premises servers use hybrid activations and get mi- IDs.

Capabilities

Secrets and configuration

• Secrets Manager: KMS-encrypted secrets with automatic rotation by a rotation Lambda (managed rotation for RDS, Aurora, Redshift and DocumentDB); cross-account access through a resource policy plus a customer managed key; replication to other Regions. Choose it for rotation or cross-account sharing; Parameter Store for simple, cheap config.
• AWS AppConfig: feature flags and runtime config deployed separately from code. Validators (JSON schema or Lambda), deployment strategies (for example 20% every 6 minutes with bake time), CloudWatch alarm rollback; apps read config through the AppConfig agent or Lambda extension.
• EC2 Image Builder: automated golden AMI or container image pipelines — a recipe (base image + components), test components, and distribution settings that copy images to other Regions and accounts and can update launch templates. Runs on a schedule or when the base image changes.
• OpsWorks (Chef and Puppet) reached end of life in 2024. It may still appear in older questions; the modern equivalent is Systems Manager plus Auto Scaling.

Multi-account governance

AWS Organizations

• Root → OUs → accounts. The management account pays (consolidated billing) and controls the organization; “all features” mode is required for policies.
• Delegated administrator member accounts run security services so you don’t work in the management account.
• Service control policies:
  • Set the maximum permissions for every user and role in member accounts, including the account root user. They never grant anything.
  • Don’t affect the management account or service-linked roles.
  • A Deny anywhere up the tree applies; an allow-list strategy needs Allow at every level.
  • Typical uses: deny leaving the organization; deny disabling CloudTrail, GuardDuty or Config; deny unapproved Regions (aws:RequestedRegion); protect specific roles (Deny with ArnNotLike aws:PrincipalArn = the admin role); require encryption.
• Other organization policies: tag policies, backup policies, resource control policies (cap what resources allow), AI opt-out, declarative policies.

AWS Control Tower

• Builds a landing zone: Organizations, a Log Archive account (central CloudTrail and Config logs), an Audit account (security tooling), IAM Identity Center and baseline controls.
• Controls: preventive (SCPs), detective (Config rules) and proactive (CloudFormation Hooks). Guidance levels: mandatory, strongly recommended, elective.
• Account Factory vends accounts through Service Catalog. Lifecycle events such as CreateManagedAccount go to EventBridge for follow-up automation.
• Customisation: CfCT (Customizations for Control Tower — CloudFormation templates and SCPs from a Git or S3 pipeline) or AFT (Account Factory for Terraform — account requests and customisations in Git, applied by Terraform pipelines). AFT feature flags include aft_feature_enterprise_support, aft_feature_cloudtrail_data_events and aft_feature_delete_default_vpcs_enabled; set them and redeploy AFT.
• If someone changes Control Tower-managed resources, re-register the OU or update the landing zone to fix drift.

Service Catalog

• Admins publish approved CloudFormation or Terraform templates as products in portfolios; users launch them self-service.
• A launch constraint is an IAM role Service Catalog uses to provision, so end users need no permissions on the underlying services. Also template constraints (restrict parameter values), TagOptions, and portfolio sharing to an organization or OU.

IAM Identity Center

• Single sign-on for the workforce across all accounts. Identity source: built-in directory, Active Directory, or an external IdP (Okta, Microsoft Entra ID) through SAML 2.0 with SCIM user and group sync.
• A permission set is a bundle of policies; assigning a group and permission set to an account creates AWSReservedSSO_* roles there.
• Attributes for access control map IdP attributes (department, cost centre) to session tags for ABAC.
• Without Identity Center, the hub-and-spoke pattern is: IAM users in one account, a role in each workload account trusting that account, and an IAM group allowed to sts:AssumeRole on those roles.
• Cognito is for your application’s end users, not employees accessing AWS accounts.

AWS RAM shares subnets, Transit Gateways, Route 53 Resolver rules and License Manager configurations with other accounts.