CloudFormation
By Amazon Web Services
AWS CloudFormation is Amazon Web Services's native infrastructure-as-code service that provisions and manages AWS resources from declarative templates written in JSON or YAML. A CloudFormation template describes a desired set of resources…
Definition
AWS CloudFormation is Amazon Web Services's native infrastructure-as-code service that provisions and manages AWS resources from declarative templates written in JSON or YAML. A CloudFormation template describes a desired set of resources and their relationships, and the service takes care of ordering resource creation, updates, and deletion, tracking their state as a named stack. It is built into AWS with no separate installation, and other AWS-native provisioning tooling is commonly layered on top of it.
Overview
Provisioning AWS resources by hand through the console or one-off API calls does not scale to environments with dozens of interdependent services, and it leaves no durable record of what was created or why. CloudFormation addresses this by letting an engineer describe an entire application's infrastructure, from a VPC down to individual Lambda functions and IAM roles, in a single template file that AWS itself parses and executes, removing the need for a third-party provisioning engine. A template defines resources as blocks with properties and can reference other resources by logical name, so CloudFormation builds a dependency graph and creates or updates resources in the correct order. When a stack is created or updated, the service computes a change set describing exactly what will be added, modified, or replaced, which can be reviewed before being executed. If an update fails partway through, CloudFormation automatically rolls the stack back to its last known good state, which is one of its most distinguishing operational guarantees compared with tools that leave partial changes in place on failure. CloudFormation is frequently contrasted with Terraform: both are declarative infrastructure-as-code tools, but CloudFormation is AWS-only and state is managed entirely by AWS itself, whereas Terraform is multi-cloud and requires the user to manage a state file, typically in remote storage. Higher-level tools such as the AWS CDK and SAM CLI are built on top of CloudFormation, generating CloudFormation templates from more expressive code or simplified serverless syntax rather than replacing the underlying engine. In practice, teams write CloudFormation templates for anything from a single S3 bucket to a full multi-tier application stack, and use nested stacks or StackSets to compose larger systems or apply the same template across multiple AWS accounts and regions. CloudFormation integrates directly with AWS's IAM permissions and CloudTrail logging, and its drift detection feature can identify when a live resource has been manually modified outside of the template. The main limitation is that CloudFormation only manages AWS resources, so organizations running a multi-cloud footprint typically need a second tool for non-AWS infrastructure. Template authoring in raw JSON or YAML can also become verbose and repetitive for complex stacks, which is part of why CDK and SAM exist as code-generation layers on top of it. Update behavior for certain resource properties can force full replacement rather than in-place modification, which teams need to anticipate before applying changes to stateful resources like databases. Choosing CloudFormation over Terraform is often less about raw capability and more about organizational context: teams fully committed to AWS with no near-term multi-cloud plans gain from its zero-install, first-party integration, while teams anticipating multi-cloud needs down the line often prefer to start with a provider-agnostic tool from day one.
Key Features
- Declarative JSON or YAML templates describe an entire AWS stack
- Automatic dependency resolution orders resource creation and updates
- Change sets preview exactly what will change before a stack update runs
- Automatic rollback restores the last known good state on a failed update
- Nested stacks and StackSets compose and replicate templates across accounts and regions
- Drift detection flags resources manually changed outside the template
- Deep integration with IAM permissions and CloudTrail auditing
- Serves as the underlying engine for higher-level tools like the AWS CDK and SAM