15 CloudFormation Interview Questions and Answers

CloudFormation is a powerful tool within the AWS ecosystem that allows developers to define and provision infrastructure as code. By using JSON or YAML templates, CloudFormation enables the automation of resource management, making it easier to maintain and scale cloud environments. This approach not only reduces the potential for human error but also ensures consistency across deployments.

This article offers a curated selection of CloudFormation interview questions designed to test your understanding and proficiency with the tool. Reviewing these questions will help you gain confidence and demonstrate your expertise in managing cloud infrastructure efficiently during your interview.

CloudFormation Interview Questions and Answers

1. Explain the structure of a CloudFormation template.

A CloudFormation template is a JSON or YAML file that outlines the infrastructure and resources for your application. It consists of several sections:

• AWSTemplateFormatVersion: Specifies the template format version (optional).
• Description: Describes the template (optional).
• Metadata: Provides additional template information (optional).
• Parameters: Defines input values for stack creation or updates.
• Mappings: Creates “lookup tables” for reference.
• Conditions: Controls resource creation based on criteria.
• Resources: Lists AWS resources to include in the stack. This is required.
• Outputs: Returns values when viewing stack properties.

2. What are intrinsic functions, and can you name a few?

Intrinsic functions in CloudFormation are built-in functions for managing and manipulating data within templates. They enable operations like string manipulations and referencing other resources or parameters, making templates more dynamic.

Common intrinsic functions include:

• Fn::Join: Concatenates values into a string.
• Fn::Sub: Substitutes variables in a string with values.
• Fn::GetAtt: Returns an attribute’s value from a resource.
• Fn::Ref: Returns a specified parameter or resource value.
• Fn::If: Returns a value based on a condition’s evaluation.

Example:

Resources:
  MyBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "${EnvironmentName}-mybucket"
  MyInstance:
    Type: "AWS::EC2::Instance"
    Properties:
      ImageId: "ami-0ff8a91507f77f867"
      InstanceType: "t2.micro"
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref "EnvironmentName", "instance"]]

3. How do you manage dependencies between resources in a template?

Managing dependencies between resources ensures correct creation order. CloudFormation handles some dependencies automatically, but explicit definitions are sometimes needed.

Two primary methods for managing dependencies:

• DependsOn Attribute: Ensures one resource is created before another.
• Intrinsic Functions (Ref and GetAtt): References other resources, automatically creating them in the correct order.

Example:

Resources:
  MyBucket:
    Type: "AWS::S3::Bucket"
  
  MyBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref MyBucket
      PolicyDocument:
        Statement:
          - Action: "s3:*"
            Effect: "Allow"
            Resource: !Sub "arn:aws:s3:::${MyBucket}/*"
            Principal: "*"
    DependsOn: MyBucket

4. How would you define and use parameters in a template?

Parameters customize template values at runtime, making templates more dynamic and reusable. They specify configuration values like instance types or database names.

Example of defining and using parameters:

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  InstanceType:
    Description: Type of EC2 instance
    Type: String
    Default: t2.micro
    AllowedValues:
      - t2.micro
      - t2.small
      - t2.medium
    ConstraintDescription: must be a valid EC2 instance type.

Resources:
  MyEC2Instance:
    Type: 'AWS::EC2::Instance'
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: ami-0ff8a91507f77f867

5. How do conditions work in templates?

Conditions control resource and output creation based on criteria, allowing for flexible templates. Conditions are evaluated using input parameters or existing resource values.

Example:

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  EnvironmentType:
    Description: Type of environment
    Type: String
    Default: test
    AllowedValues:
      - prod
      - test

Conditions:
  CreateProdResources: !Equals [ !Ref EnvironmentType, prod ]

Resources:
  MyBucket:
    Type: 'AWS::S3::Bucket'
    Condition: CreateProdResources
    Properties:
      BucketName: my-prod-bucket

Outputs:
  BucketName:
    Condition: CreateProdResources
    Value: !Ref MyBucket
    Description: The name of the S3 bucket created for production

6. How do you handle rollbacks?

Rollbacks are automatically handled when a stack creation or update fails, ensuring the stack is left in a consistent state. CloudFormation reverts to the previous state or deletes resources created during the failed operation.

Rollback features include:

• Automatic Rollback: Default behavior when an error occurs.
• Disable Rollback: Set DisableRollback to true for debugging.
• Rollback Triggers: Use CloudWatch alarms to trigger rollbacks.
• Change Sets: Preview changes before applying them to reduce rollback likelihood.

7. What are custom resources, and when would you use them?

Custom resources extend CloudFormation capabilities by allowing custom logic execution during stack operations. They are useful for actions not supported by built-in resource types, like interacting with third-party services.

Custom resources are implemented using AWS Lambda functions or other AWS services. When a custom resource is created, updated, or deleted, CloudFormation sends a request to the specified service, which executes the custom logic and returns a response.

Example:

Resources:
  MyCustomResource:
    Type: Custom::MyCustomResourceType
    Properties:
      ServiceToken: arn:aws:lambda:region:account-id:function:my-function
      Key1: Value1
      Key2: Value2

8. How do you implement cross-stack references?

Cross-stack references allow sharing resources between stacks, useful for modularizing infrastructure. You can export values from one stack and import them into another using Export and ImportValue.

Example:

In the first stack, export a value:

Resources:
  MyBucket:
    Type: AWS::S3::Bucket

Outputs:
  BucketName:
    Value: !Ref MyBucket
    Export:
      Name: MyBucketName

In the second stack, import the exported value:

Resources:
  MyBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !ImportValue MyBucketName
      PolicyDocument:
        Statement:
          <ul>
            <li>Effect: Allow</li>
            <li>Principal: "*"</li>
            <li>Action: "s3:GetObject"</li>
            <li>Resource: !Sub "arn:aws:s3:::${MyBucketName}/*"</li>
          </ul>

9. Explain the concept of nested stacks and their benefits.

Nested stacks allow creating stacks within stacks, helping manage large-scale infrastructure by breaking it into smaller, reusable components. Each nested stack is treated as a resource within the parent stack.

Benefits include:

• Reusability: Common configurations can be reused across stacks.
• Manageability: Smaller stacks are easier to manage and update.
• Scalability: Better organization and scalability of infrastructure.
• Isolation: Changes in one nested stack do not affect others.

Example:

Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/mybucket/vpc-template.yaml
      Parameters:
        VpcId: vpc-123456

  AppStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/mybucket/app-template.yaml
      Parameters:
        VpcId: !GetAtt VPCStack.Outputs.VpcId

10. What are change sets, and how do you use them?

Change sets allow you to preview changes to your stack before applying them. CloudFormation compares the current stack state with proposed changes and generates a summary of differences.

To use change sets:

• Create a change set for your stack.
• Review the change set to understand the proposed changes.
• Execute the change set to apply the changes to your stack.

Creating a change set involves specifying the stack to update and providing the new template or parameters. CloudFormation generates a change set listing resources to be added, modified, or deleted.

11. How would you automate the deployment of templates using CI/CD pipelines?

To automate CloudFormation template deployment using CI/CD pipelines, integrate CloudFormation with tools like AWS CodePipeline, Jenkins, or GitLab CI/CD. The process generally involves:

• Source Control Integration: Store templates in a version control system like Git.
• Build Stage: Automatically trigger a build process on repository changes, including linting and validating templates.
• Test Stage: Deploy templates to a staging environment for testing.
• Approval Stage: Implement a manual approval step before production deployment.
• Deploy Stage: Deploy templates to production using AWS CLI commands or SDKs.

Example of a simple AWS CodePipeline setup:

version: 0.2

phases:
  install:
    runtime-versions:
      python: 3.8
  build:
    commands:
      - aws cloudformation validate-template --template-body file://template.yaml
      - aws cloudformation deploy --template-file template.yaml --stack-name my-stack --capabilities CAPABILITY_NAMED_IAM

12. What is drift detection, and how do you use it?

Drift detection identifies discrepancies between the actual state of stack resources and the expected state in the template. This ensures infrastructure consistency.

To use drift detection, initiate a drift detection operation on your stack. This compares the current state of each resource with its expected state. Differences are reported as drift, which you can review and resolve.

Drift detection can be performed via the AWS Management Console, AWS CLI, or AWS SDKs. Example using the AWS CLI:

aws cloudformation detect-stack-drift --stack-name my-stack

Check the drift status:

aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id <detection-id>

13. What are stack policies, and how do they help in managing stacks?

Stack policies are JSON documents that define update protection for resources in a CloudFormation stack. They ensure critical resources remain unchanged unless explicitly allowed.

A stack policy consists of rules specifying allowed or denied actions for resources. These rules are evaluated during stack updates to determine compliance.

Example of a stack policy:

{
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "Update:*",
      "Principal": "*",
      "Resource": "LogicalResourceId/MyCriticalResource"
    }
  ]
}

In this example, the policy denies update actions on “LogicalResourceId/MyCriticalResource,” ensuring it remains unchanged during updates.

14. How do you import existing resources into a stack?

To import existing resources into a CloudFormation stack, follow these steps:

• Prepare the Template: Update your template to include resources to import, ensuring logical IDs match existing configurations.
• Identify Resources: Specify resources to import using unique identifiers (e.g., ARNs).
• Execute Import: Use the CloudFormation console or aws cloudformation import-stacks command to initiate the import.
• Review and Confirm: Review changes and confirm the import operation.

15. What are some best practices for writing and managing templates?

Best practices for writing and managing CloudFormation templates include:

• Modularize Templates: Break down large templates into smaller, reusable components using nested stacks.
• Use Parameters and Mappings: Leverage parameters for flexibility and mappings for static values.
• Version Control: Store templates in a version control system like Git.
• Documentation: Include comments and documentation within the template.
• Validation and Testing: Use tools like AWS CloudFormation Linter (cfn-lint) and test in a staging environment.
• IAM Policies: Follow the principle of least privilege for IAM policies.
• Outputs: Use outputs to export key information from stacks.
• Resource Naming Conventions: Adopt consistent naming conventions for resources.