Interview

15 CloudFormation Interview Questions and Answers

Prepare for your interview with our comprehensive guide on CloudFormation, covering key concepts and practical insights to boost your cloud infrastructure skills.

CloudFormation is a powerful tool within the AWS ecosystem that allows developers to define and provision infrastructure as code. By using JSON or YAML templates, CloudFormation enables the automation of resource management, making it easier to maintain and scale cloud environments. This approach not only reduces the potential for human error but also ensures consistency across deployments.

This article offers a curated selection of CloudFormation interview questions designed to test your understanding and proficiency with the tool. Reviewing these questions will help you gain confidence and demonstrate your expertise in managing cloud infrastructure efficiently during your interview.

CloudFormation Interview Questions and Answers

1. Explain the structure of a CloudFormation template.

A CloudFormation template is a JSON or YAML file that outlines the infrastructure and resources for your application. It consists of several sections:

  • AWSTemplateFormatVersion: Specifies the template format version (optional).
  • Description: Describes the template (optional).
  • Metadata: Provides additional template information (optional).
  • Parameters: Defines input values for stack creation or updates.
  • Mappings: Creates “lookup tables” for reference.
  • Conditions: Controls resource creation based on criteria.
  • Resources: Lists AWS resources to include in the stack. This is required.
  • Outputs: Returns values when viewing stack properties.

2. What are intrinsic functions, and can you name a few?

Intrinsic functions in CloudFormation are built-in functions for managing and manipulating data within templates. They enable operations like string manipulations and referencing other resources or parameters, making templates more dynamic.

Common intrinsic functions include:

  • Fn::Join: Concatenates values into a string.
  • Fn::Sub: Substitutes variables in a string with values.
  • Fn::GetAtt: Returns an attribute’s value from a resource.
  • Fn::Ref: Returns a specified parameter or resource value.
  • Fn::If: Returns a value based on a condition’s evaluation.

Example:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
Resources:
MyBucket:
Type: "AWS::S3::Bucket"
Properties:
BucketName: !Sub "${EnvironmentName}-mybucket"
MyInstance:
Type: "AWS::EC2::Instance"
Properties:
ImageId: "ami-0ff8a91507f77f867"
InstanceType: "t2.micro"
Tags:
- Key: "Name"
Value: !Join ["-", [!Ref "EnvironmentName", "instance"]]
Resources: MyBucket: Type: "AWS::S3::Bucket" Properties: BucketName: !Sub "${EnvironmentName}-mybucket" MyInstance: Type: "AWS::EC2::Instance" Properties: ImageId: "ami-0ff8a91507f77f867" InstanceType: "t2.micro" Tags: - Key: "Name" Value: !Join ["-", [!Ref "EnvironmentName", "instance"]]
Resources:
  MyBucket:
    Type: "AWS::S3::Bucket"
    Properties:
      BucketName: !Sub "${EnvironmentName}-mybucket"
  MyInstance:
    Type: "AWS::EC2::Instance"
    Properties:
      ImageId: "ami-0ff8a91507f77f867"
      InstanceType: "t2.micro"
      Tags:
        - Key: "Name"
          Value: !Join ["-", [!Ref "EnvironmentName", "instance"]]

3. How do you manage dependencies between resources in a template?

Managing dependencies between resources ensures correct creation order. CloudFormation handles some dependencies automatically, but explicit definitions are sometimes needed.

Two primary methods for managing dependencies:

  • DependsOn Attribute: Ensures one resource is created before another.
  • Intrinsic Functions (Ref and GetAtt): References other resources, automatically creating them in the correct order.

Example:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
Resources:
MyBucket:
Type: "AWS::S3::Bucket"
MyBucketPolicy:
Type: "AWS::S3::BucketPolicy"
Properties:
Bucket: !Ref MyBucket
PolicyDocument:
Statement:
- Action: "s3:*"
Effect: "Allow"
Resource: !Sub "arn:aws:s3:::${MyBucket}/*"
Principal: "*"
DependsOn: MyBucket
Resources: MyBucket: Type: "AWS::S3::Bucket" MyBucketPolicy: Type: "AWS::S3::BucketPolicy" Properties: Bucket: !Ref MyBucket PolicyDocument: Statement: - Action: "s3:*" Effect: "Allow" Resource: !Sub "arn:aws:s3:::${MyBucket}/*" Principal: "*" DependsOn: MyBucket
Resources:
  MyBucket:
    Type: "AWS::S3::Bucket"
  
  MyBucketPolicy:
    Type: "AWS::S3::BucketPolicy"
    Properties:
      Bucket: !Ref MyBucket
      PolicyDocument:
        Statement:
          - Action: "s3:*"
            Effect: "Allow"
            Resource: !Sub "arn:aws:s3:::${MyBucket}/*"
            Principal: "*"
    DependsOn: MyBucket

4. How would you define and use parameters in a template?

Parameters customize template values at runtime, making templates more dynamic and reusable. They specify configuration values like instance types or database names.

Example of defining and using parameters:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
InstanceType:
Description: Type of EC2 instance
Type: String
Default: t2.micro
AllowedValues:
- t2.micro
- t2.small
- t2.medium
ConstraintDescription: must be a valid EC2 instance type.
Resources:
MyEC2Instance:
Type: 'AWS::EC2::Instance'
Properties:
InstanceType: !Ref InstanceType
ImageId: ami-0ff8a91507f77f867
AWSTemplateFormatVersion: '2010-09-09' Parameters: InstanceType: Description: Type of EC2 instance Type: String Default: t2.micro AllowedValues: - t2.micro - t2.small - t2.medium ConstraintDescription: must be a valid EC2 instance type. Resources: MyEC2Instance: Type: 'AWS::EC2::Instance' Properties: InstanceType: !Ref InstanceType ImageId: ami-0ff8a91507f77f867
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  InstanceType:
    Description: Type of EC2 instance
    Type: String
    Default: t2.micro
    AllowedValues:
      - t2.micro
      - t2.small
      - t2.medium
    ConstraintDescription: must be a valid EC2 instance type.

Resources:
  MyEC2Instance:
    Type: 'AWS::EC2::Instance'
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: ami-0ff8a91507f77f867

5. How do conditions work in templates?

Conditions control resource and output creation based on criteria, allowing for flexible templates. Conditions are evaluated using input parameters or existing resource values.

Example:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
EnvironmentType:
Description: Type of environment
Type: String
Default: test
AllowedValues:
- prod
- test
Conditions:
CreateProdResources: !Equals [ !Ref EnvironmentType, prod ]
Resources:
MyBucket:
Type: 'AWS::S3::Bucket'
Condition: CreateProdResources
Properties:
BucketName: my-prod-bucket
Outputs:
BucketName:
Condition: CreateProdResources
Value: !Ref MyBucket
Description: The name of the S3 bucket created for production
AWSTemplateFormatVersion: '2010-09-09' Parameters: EnvironmentType: Description: Type of environment Type: String Default: test AllowedValues: - prod - test Conditions: CreateProdResources: !Equals [ !Ref EnvironmentType, prod ] Resources: MyBucket: Type: 'AWS::S3::Bucket' Condition: CreateProdResources Properties: BucketName: my-prod-bucket Outputs: BucketName: Condition: CreateProdResources Value: !Ref MyBucket Description: The name of the S3 bucket created for production
AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  EnvironmentType:
    Description: Type of environment
    Type: String
    Default: test
    AllowedValues:
      - prod
      - test

Conditions:
  CreateProdResources: !Equals [ !Ref EnvironmentType, prod ]

Resources:
  MyBucket:
    Type: 'AWS::S3::Bucket'
    Condition: CreateProdResources
    Properties:
      BucketName: my-prod-bucket

Outputs:
  BucketName:
    Condition: CreateProdResources
    Value: !Ref MyBucket
    Description: The name of the S3 bucket created for production

6. How do you handle rollbacks?

Rollbacks are automatically handled when a stack creation or update fails, ensuring the stack is left in a consistent state. CloudFormation reverts to the previous state or deletes resources created during the failed operation.

Rollback features include:

  • Automatic Rollback: Default behavior when an error occurs.
  • Disable Rollback: Set DisableRollback to true for debugging.
  • Rollback Triggers: Use CloudWatch alarms to trigger rollbacks.
  • Change Sets: Preview changes before applying them to reduce rollback likelihood.

7. What are custom resources, and when would you use them?

Custom resources extend CloudFormation capabilities by allowing custom logic execution during stack operations. They are useful for actions not supported by built-in resource types, like interacting with third-party services.

Custom resources are implemented using AWS Lambda functions or other AWS services. When a custom resource is created, updated, or deleted, CloudFormation sends a request to the specified service, which executes the custom logic and returns a response.

Example:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
Resources:
MyCustomResource:
Type: Custom::MyCustomResourceType
Properties:
ServiceToken: arn:aws:lambda:region:account-id:function:my-function
Key1: Value1
Key2: Value2
Resources: MyCustomResource: Type: Custom::MyCustomResourceType Properties: ServiceToken: arn:aws:lambda:region:account-id:function:my-function Key1: Value1 Key2: Value2
Resources:
  MyCustomResource:
    Type: Custom::MyCustomResourceType
    Properties:
      ServiceToken: arn:aws:lambda:region:account-id:function:my-function
      Key1: Value1
      Key2: Value2

8. How do you implement cross-stack references?

Cross-stack references allow sharing resources between stacks, useful for modularizing infrastructure. You can export values from one stack and import them into another using

Export
Export and
ImportValue
ImportValue.

Example:

In the first stack, export a value:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
Resources:
MyBucket:
Type: AWS::S3::Bucket
Outputs:
BucketName:
Value: !Ref MyBucket
Export:
Name: MyBucketName
Resources: MyBucket: Type: AWS::S3::Bucket Outputs: BucketName: Value: !Ref MyBucket Export: Name: MyBucketName
Resources:
  MyBucket:
    Type: AWS::S3::Bucket

Outputs:
  BucketName:
    Value: !Ref MyBucket
    Export:
      Name: MyBucketName

In the second stack, import the exported value:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
Resources:
MyBucketPolicy:
Type: AWS::S3::BucketPolicy
Properties:
Bucket: !ImportValue MyBucketName
PolicyDocument:
Statement:
<ul>
<li>Effect: Allow</li>
<li>Principal: "*"</li>
<li>Action: "s3:GetObject"</li>
<li>Resource: !Sub "arn:aws:s3:::${MyBucketName}/*"</li>
</ul>
Resources: MyBucketPolicy: Type: AWS::S3::BucketPolicy Properties: Bucket: !ImportValue MyBucketName PolicyDocument: Statement: <ul> <li>Effect: Allow</li> <li>Principal: "*"</li> <li>Action: "s3:GetObject"</li> <li>Resource: !Sub "arn:aws:s3:::${MyBucketName}/*"</li> </ul>
Resources:
  MyBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !ImportValue MyBucketName
      PolicyDocument:
        Statement:
          <ul>
            <li>Effect: Allow</li>
            <li>Principal: "*"</li>
            <li>Action: "s3:GetObject"</li>
            <li>Resource: !Sub "arn:aws:s3:::${MyBucketName}/*"</li>
          </ul>

9. Explain the concept of nested stacks and their benefits.

Nested stacks allow creating stacks within stacks, helping manage large-scale infrastructure by breaking it into smaller, reusable components. Each nested stack is treated as a resource within the parent stack.

Benefits include:

  • Reusability: Common configurations can be reused across stacks.
  • Manageability: Smaller stacks are easier to manage and update.
  • Scalability: Better organization and scalability of infrastructure.
  • Isolation: Changes in one nested stack do not affect others.

Example:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
Resources:
VPCStack:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: https://s3.amazonaws.com/mybucket/vpc-template.yaml
Parameters:
VpcId: vpc-123456
AppStack:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: https://s3.amazonaws.com/mybucket/app-template.yaml
Parameters:
VpcId: !GetAtt VPCStack.Outputs.VpcId
Resources: VPCStack: Type: AWS::CloudFormation::Stack Properties: TemplateURL: https://s3.amazonaws.com/mybucket/vpc-template.yaml Parameters: VpcId: vpc-123456 AppStack: Type: AWS::CloudFormation::Stack Properties: TemplateURL: https://s3.amazonaws.com/mybucket/app-template.yaml Parameters: VpcId: !GetAtt VPCStack.Outputs.VpcId
Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/mybucket/vpc-template.yaml
      Parameters:
        VpcId: vpc-123456

  AppStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/mybucket/app-template.yaml
      Parameters:
        VpcId: !GetAtt VPCStack.Outputs.VpcId

10. What are change sets, and how do you use them?

Change sets allow you to preview changes to your stack before applying them. CloudFormation compares the current stack state with proposed changes and generates a summary of differences.

To use change sets:

  • Create a change set for your stack.
  • Review the change set to understand the proposed changes.
  • Execute the change set to apply the changes to your stack.

Creating a change set involves specifying the stack to update and providing the new template or parameters. CloudFormation generates a change set listing resources to be added, modified, or deleted.

11. How would you automate the deployment of templates using CI/CD pipelines?

To automate CloudFormation template deployment using CI/CD pipelines, integrate CloudFormation with tools like AWS CodePipeline, Jenkins, or GitLab CI/CD. The process generally involves:

  • Source Control Integration: Store templates in a version control system like Git.
  • Build Stage: Automatically trigger a build process on repository changes, including linting and validating templates.
  • Test Stage: Deploy templates to a staging environment for testing.
  • Approval Stage: Implement a manual approval step before production deployment.
  • Deploy Stage: Deploy templates to production using AWS CLI commands or SDKs.

Example of a simple AWS CodePipeline setup:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
version: 0.2
phases:
install:
runtime-versions:
python: 3.8
build:
commands:
- aws cloudformation validate-template --template-body file://template.yaml
- aws cloudformation deploy --template-file template.yaml --stack-name my-stack --capabilities CAPABILITY_NAMED_IAM
version: 0.2 phases: install: runtime-versions: python: 3.8 build: commands: - aws cloudformation validate-template --template-body file://template.yaml - aws cloudformation deploy --template-file template.yaml --stack-name my-stack --capabilities CAPABILITY_NAMED_IAM
version: 0.2

phases:
  install:
    runtime-versions:
      python: 3.8
  build:
    commands:
      - aws cloudformation validate-template --template-body file://template.yaml
      - aws cloudformation deploy --template-file template.yaml --stack-name my-stack --capabilities CAPABILITY_NAMED_IAM

12. What is drift detection, and how do you use it?

Drift detection identifies discrepancies between the actual state of stack resources and the expected state in the template. This ensures infrastructure consistency.

To use drift detection, initiate a drift detection operation on your stack. This compares the current state of each resource with its expected state. Differences are reported as drift, which you can review and resolve.

Drift detection can be performed via the AWS Management Console, AWS CLI, or AWS SDKs. Example using the AWS CLI:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
aws cloudformation detect-stack-drift --stack-name my-stack
aws cloudformation detect-stack-drift --stack-name my-stack
aws cloudformation detect-stack-drift --stack-name my-stack

Check the drift status:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id <detection-id>
aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id <detection-id>
aws cloudformation describe-stack-drift-detection-status --stack-drift-detection-id <detection-id>

13. What are stack policies, and how do they help in managing stacks?

Stack policies are JSON documents that define update protection for resources in a CloudFormation stack. They ensure critical resources remain unchanged unless explicitly allowed.

A stack policy consists of rules specifying allowed or denied actions for resources. These rules are evaluated during stack updates to determine compliance.

Example of a stack policy:

Plain text
Copy to clipboard
Open code in new window
EnlighterJS 3 Syntax Highlighter
{
"Statement": [
{
"Effect": "Deny",
"Action": "Update:*",
"Principal": "*",
"Resource": "LogicalResourceId/MyCriticalResource"
}
]
}
{ "Statement": [ { "Effect": "Deny", "Action": "Update:*", "Principal": "*", "Resource": "LogicalResourceId/MyCriticalResource" } ] }
{
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "Update:*",
      "Principal": "*",
      "Resource": "LogicalResourceId/MyCriticalResource"
    }
  ]
}

In this example, the policy denies update actions on “LogicalResourceId/MyCriticalResource,” ensuring it remains unchanged during updates.

14. How do you import existing resources into a stack?

To import existing resources into a CloudFormation stack, follow these steps:

  • Prepare the Template: Update your template to include resources to import, ensuring logical IDs match existing configurations.
  • Identify Resources: Specify resources to import using unique identifiers (e.g., ARNs).
  • Execute Import: Use the CloudFormation console or
    aws cloudformation import-stacks
    aws cloudformation import-stacks command to initiate the import.
  • Review and Confirm: Review changes and confirm the import operation.

15. What are some best practices for writing and managing templates?

Best practices for writing and managing CloudFormation templates include:

  • Modularize Templates: Break down large templates into smaller, reusable components using nested stacks.
  • Use Parameters and Mappings: Leverage parameters for flexibility and mappings for static values.
  • Version Control: Store templates in a version control system like Git.
  • Documentation: Include comments and documentation within the template.
  • Validation and Testing: Use tools like AWS CloudFormation Linter (cfn-lint) and test in a staging environment.
  • IAM Policies: Follow the principle of least privilege for IAM policies.
  • Outputs: Use outputs to export key information from stacks.
  • Resource Naming Conventions: Adopt consistent naming conventions for resources.
Previous

15 BGP Scenario Based Interview Questions and Answers

Back to Interview
Next

10 Apache Solr Interview Questions and Answers