CloudFormation and infrastructure change sets

Why and what

A CloudFormation template describes desired resources; a stack is a deployed instance of that template. Parameters provide inputs, outputs expose useful references, and intrinsic functions connect resources. A change set previews proposed changes before execution. Infrastructure as code improves reproducibility, but a valid template can still describe an unsafe architecture.

Minimal private-bucket template

AWSTemplateFormatVersion: '2010-09-09'
Description: Academy private bucket lab
Resources:
  LessonBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    UpdateReplacePolicy: Retain
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        IgnorePublicAcls: true
        BlockPublicPolicy: true
        RestrictPublicBuckets: true
      VersioningConfiguration:
        Status: Enabled
Outputs:
  BucketName:
    Value: !Ref LessonBucket

Lab steps

1. Save the YAML and validate the template with the console or CLI.
2. Create a stack using a role with only required permissions. Review capabilities if adding IAM resources.
3. Inspect Events until completion and locate the generated bucket via Outputs.
4. Add a tag to the template; create a change set and confirm it is an in-place update.
5. Execute it, then deliberately modify a supported property outside CloudFormation and run drift detection.

Replacement and retention

Some property changes replace resources instead of editing them. Replacement may change identifiers and can lose data without retention/backup planning. DeletionPolicy: Retain keeps the bucket when deleting the stack; it does not delete the data or stop its storage costs. A nonempty bucket can also prevent deletion when no retention policy is used.

Failure handling

Read the first meaningful failure event rather than only the final rollback message. Missing permissions, name conflicts, invalid dependencies and quotas are common causes. A rollback can itself need intervention; retain stack events for diagnosis. Never paste production secrets into template parameters unless using an appropriate secret mechanism.

Assignment and cleanup

Create a second independent stack from the same template. Explain how generated names avoid collisions. Delete the lab stacks, then explicitly inspect retained buckets and decide whether to remove their versions and contents.

Official reference

CloudFormation guide

Interview and revision check

Does Retain mean a resource stops costing money?

No. It preserves the resource after stack deletion/replacement according to policy; you must still manage it and its charges.