Deployment, provisioning and automation

AMIs and container images

• An AMI bundles a root volume snapshot, launch permissions and a block device mapping. AMIs are Regional: copy to use in another Region (copying an encrypted AMI can re-encrypt with a different key). Share with specific accounts or an organization, or publicly. Sharing an encrypted AMI needs the customer managed KMS key shared too, because AWS managed keys can’t be shared.
• Create an AMI from a running instance (CreateImage; optionally no reboot, at the cost of file system consistency). Deregister an AMI, then delete its snapshots. Recycle Bin can recover deleted AMIs. Deprecation and block public access for AMIs exist for hygiene.
• EC2 Image Builder automates building, testing and distributing AMIs and container images. Parts:
  • Components: build steps and test steps (YAML documents, run by the AWSTOE agent) — AWS-managed (for example update the OS, install the SSM agent, hardening such as CIS) or your own.
  • Image recipe: base image + ordered components (container recipe for containers).
  • Infrastructure configuration: instance type, subnet, security groups, role, logging for the build instance.
  • Distribution settings: Regions, accounts, naming, launch template updates, ECR repositories.
  • Pipeline: runs on a schedule or when the base image updates, so patched AMIs appear automatically. Ends by publishing the AMI ID to Parameter Store, which launch templates can reference.
• Prefer a golden AMI pipeline over patching long-lived instances. For fast boot use baked AMIs; for flexibility use user data (runs once at first boot by default, as root, limited to 16 KB).
• Container images: build and push to Amazon ECR (private or public registries). ECR offers image scanning (basic or enhanced with Inspector), lifecycle policies to expire old images, replication across Regions and accounts, and pull-through cache for upstream registries. Tag immutability prevents overwriting tags.

CloudFormation

Concepts

• A template (JSON or YAML) declares resources; a stack is the deployed instance of a template. Sections: Parameters, Mappings, Conditions, Resources (required), Outputs, Transform, Metadata, Rules.
• Intrinsic functions: !Ref, !GetAtt, !Sub, !Join, !Select, !FindInMap, !If, !ImportValue (cross-stack, from an exported output), Fn::Transform (for example the AWS::Include or AWS::LanguageExtensions macros), and dynamic references to Parameter Store and Secrets Manager ({{resolve:ssm:...}}, {{resolve:secretsmanager:...}}). SSM parameter types (AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>) fetch the latest AMI ID at deploy time.
• Pseudo parameters: AWS::Region, AWS::AccountId, AWS::StackName, AWS::NoValue.
• Cross-stack references use exports (an export can’t be changed or removed while imported). Nested stacks (AWS::CloudFormation::Stack) reuse templates as children of a parent and update with it.
• Helper scripts cfn-init (reads AWS::CloudFormation::Init metadata to install packages and write files), cfn-signal (reports success), cfn-hup (reapplies on metadata change). Pair a CreationPolicy (or UpdatePolicy for ASG rolling updates) with cfn-signal so the stack waits for the instance to be ready, with a Timeout. A WaitCondition is the older equivalent.
• Custom resources run Lambda (or SNS) code during stack events for things CloudFormation doesn’t support; the function must send a response to the presigned S3 URL or the stack hangs until timeout (an hour by default).
• Registry and modules share resource types; macros transform templates.

Change management

• Change sets preview what an update will add, modify, replace or remove before you execute it. Check the Replacement column; replacement means a new physical resource and data loss risk for stateful resources.
• Update behaviours per property: no interruption, some interruption, replacement.
• Stack policy: JSON that protects resources from update actions. Once set, everything is denied by default unless allowed; you can’t remove a stack policy once applied, though you can edit it, and you can override it for one update. It does not apply to deletion of the stack.
• DeletionPolicy: Delete (default), Retain, RetainExceptOnCreate, Snapshot (for EBS, RDS, and others). UpdateReplacePolicy does the same when a resource is replaced during an update. Use Retain or Snapshot on databases and buckets. A non-empty S3 bucket fails to delete unless emptied.
• Termination protection blocks DeleteStack.
• Drift detection compares live configuration with the template and reports IN_SYNC, DRIFTED, NOT_CHECKED. It reports; it does not fix. Fix by updating the template or reverting the change, and import the resource. Drift can be checked per stack, per resource or on StackSets.
• Import existing resources into a stack with a change set of type IMPORT (the template needs DeletionPolicy on those resources). IaC generator scans existing resources and produces a template.
• Rollback: on create failure a stack goes to ROLLBACK_COMPLETE and must be deleted before retry (or use “preserve successfully provisioned resources” and disable rollback for debugging). A failed update goes to UPDATE_ROLLBACK_COMPLETE. If rollback itself fails you get UPDATE_ROLLBACK_FAILED: fix the cause (or skip the stuck resources) and continue the rollback. DELETE_FAILED: a dependency or non-empty resource blocked deletion; retry with retain on those resources.
• Rollback triggers tie a stack update to CloudWatch alarms: if an alarm fires during the monitoring window, the update rolls back.
• Stack sets and nested stacks events: the Events tab shows the first failing resource and its reason; read from the earliest failure.
• Updates that need a role: run as a service role (the role CloudFormation assumes) so users don’t need broad permissions; a user needs iam:PassRole on it.

Typical errors

Validate with aws cloudformation validate-template and the cfn-lint tool; TaintResources and continue update rollback appear in advanced cases. The CloudFormation Guard policy-as-code tool and hooks evaluate templates against rules before provisioning.

AWS CDK

• The Cloud Development Kit lets you define infrastructure in TypeScript, Python, Java, C# or Go. Constructs come in levels: L1 (CfnBucket, mirrors CloudFormation exactly), L2 (opinionated with defaults and helper methods such as bucket.grantRead(role)), L3 (patterns). The code runs and synthesizes into a CloudFormation template.
• Workflow: cdk init, cdk synth (see the template), cdk diff (compare with deployed), cdk deploy, cdk destroy. cdk bootstrap creates the CDKToolkit stack (staging S3 bucket, ECR repository, IAM roles) once per account and Region; a deploy fails without it (or with an outdated bootstrap version).
• A CDK app contains stacks, which can span accounts and Regions (set env). Everything deploys through CloudFormation, so all CloudFormation behaviour (rollback, drift, change sets) still applies. Troubleshoot at the CloudFormation level.
• Use CDK Aspects or Config/Guard for compliance. Context values and lookups are cached in cdk.context.json.

Multi-Region and multi-account

• CloudFormation StackSets deploy one template to many accounts and Regions from an administrator account.
  • Permission models: self-managed (you create AWSCloudFormationStackSetAdministrationRole and AWSCloudFormationStackSetExecutionRole) and service-managed (with AWS Organizations; roles are created for you, and automatic deployment adds new accounts in an OU). Use a delegated administrator to avoid using the management account.
  • Operation settings: maximum concurrent accounts, failure tolerance, region order, and retained stacks when removing instances.
  • A stack instance can be OUTDATED or INOPERABLE after failures; fix and re-run. Overrides let one account use different parameters.
• AWS Resource Access Manager (RAM) shares resources without copying them: VPC subnets (the participant launches into the owner’s subnet; common in a shared-services or landing zone design), Transit Gateway, Route 53 Resolver rules, License Manager configurations, Image Builder components, Aurora clones, and more. Turn on sharing with Organizations once, and shares then need no invitation within the organization. Participants cannot modify the owner’s shared resources, and security groups aren’t shared.
• Control Tower and Account Factory create accounts with guardrails; Service Catalog offers approved products (CloudFormation or Terraform-backed) with launch constraints so users deploy without broad IAM permissions.
• Share AMIs, snapshots and Parameter Store advanced parameters through their own sharing mechanisms or RAM. Parameter Store advanced tier parameters (up to 8 KB, policies, more than 10,000 parameters) can be shared by RAM.

Deployment strategies and services

• Elastic Beanstalk deployment policies: all at once, rolling, rolling with additional batch, immutable, and traffic splitting (canary). Blue/green is done with swap environment URLs. Configuration lives in .ebextensions and saved configurations. Beanstalk-managed RDS inside the environment is lost with it: decouple the database for production.
• CodeDeploy deploys to EC2 and on-premises (in-place or blue/green; appspec.yml with lifecycle hooks such as BeforeInstall, AfterInstall, ApplicationStart, ValidateService), Lambda (aliases with canary, linear, all-at-once) and ECS (blue/green with an ALB). It needs the CodeDeploy agent on instances and rolls back automatically on failed deployments or CloudWatch alarms.
• ECS rolling update (min healthy and max percent), EKS rolling updates, Lambda aliases with weighted traffic, ALB weighted target groups, Route 53 weighted records.
• Auto Scaling instance refresh is the AMI-rollout tool for ASGs. Use Systems Manager Patch Manager for patching existing instances.
• Operations teams run these; the guide doesn’t test designing pipelines. Know CodePipeline triggers CodeBuild and CodeDeploy, and AWS CodeConnections links to GitHub and similar sources.

Third-party tools

• Terraform (HashiCorp/OpenTofu) works with the AWS provider. State must be stored remotely, commonly an S3 backend with versioning, encryption and DynamoDB (or S3-native) state locking, so two runs don’t collide. The usual commands are init, plan, apply. AWS Service Catalog and CloudFormation can also wrap Terraform. Use IAM roles for credentials, not keys committed in code.
• Git holds the code for templates and scripts: branches and pull requests for review, tags for releases. AWS CodeCommit is closed to new customers; most teams use GitHub, GitLab or Bitbucket through CodeConnections. Never commit secrets; use git-secrets or Amazon CodeGuru Security / Secrets Manager.
• Ansible, Chef and Puppet are configuration tools; Systems Manager can run Ansible playbooks (AWS-RunAnsiblePlaybook) and Chef recipes. AWS OpsWorks reached end of life in 2024.

Systems Manager for operations

• Tag-based targeting makes jobs scale (target Environment=prod). Use Quick Setup for organization-wide patching and agent updates.
• Managed node prerequisites: SSM Agent, instance role (AmazonSSMManagedInstanceCore), connectivity (or VPC endpoints). On-premises machines register through a hybrid activation.
• Compliance of managed nodes shows in the Compliance dashboard and can feed Config and Security Hub.

Event-driven automation

• Lambda is the glue: triggered by EventBridge, S3, SNS, SQS, DynamoDB streams, Kinesis, API Gateway and many more. Execution role gives it permissions; resource policy allows the invoker. Max 15 minutes; default 128 MB (up to 10,240 MB). Asynchronous invocations retry twice and can use an on-failure destination or DLQ.
• S3 Event Notifications send object created, removed, restore and replication events to Lambda, SNS, SQS or EventBridge (the EventBridge route adds filtering and more targets). The destination’s resource policy must allow S3 (a common failure). Notifications are at-least-once and can arrive without strict ordering.
• EventBridge rules respond to service events (EC2 state change, Health, GuardDuty findings, Config compliance change, Backup job state) or schedules.
• Typical automations: stop dev instances at night (Scheduler plus Automation), tag resources on creation (CloudTrail event → Lambda), snapshot before changes, quarantine instances on a GuardDuty finding (change security group, snapshot), remove public S3 access when Config flags it, rotate keys, resize on alarm.
• AWS DevOps Agent and similar agentic tools can investigate and propose or trigger mitigations from events; the guide lists them as automation aids. Use manual approval steps in runbooks (aws:approve) where a human should confirm.
• Step Functions orchestrates multi-step flows with retries and human approval (Task tokens) when a single Lambda isn’t enough.