[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"prev-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-infrastructure-as-code-cloudformation-stack-operations-en":4,"next-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-infrastructure-as-code-cloudformation-stack-operations-en":2220,"lesson-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-infrastructure-as-code-cloudformation-stack-operations-en":2235},null,{"locked":5,"reason":3,"meta":6,"item":20},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"CloudFormation Fundamentals","How a CloudFormation template describes infrastructure: the template sections, parameters with real guardrails, intrinsic functions, the dependency graph CloudFormation builds for you, and the resource attributes that decide what survives a delete.",true,30,"intermediate",[13,14,15,16,17,18,19],"Distinguish a template, a stack, a logical ID, and a physical ID","Identify the template sections and explain which one is required","Choose the right parameter type and constraints to catch bad input before any resource is created","Select the correct intrinsic function for a given reference, and explain why Ref and Fn::GetAtt are not interchangeable","Predict the order in which CloudFormation creates resources, and know when DependsOn is required","Compare Fn::ImportValue, Fn::GetStackOutput, and nested stack outputs for sharing values between stacks","Keep credentials out of a template using dynamic references, and state what NoEcho does not protect",{"id":21,"title":7,"body":22,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":2120,"infographics":2121,"isFree":9,"learningObjectives":2138,"meta":2139,"navigation":9,"path":2140,"quiz":2141,"seo":2217,"stem":2218,"__hash__":2219},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/02-infrastructure-as-code/01-cloudformation-fundamentals.md",{"type":23,"value":24,"toc":2108},"minimark",[25,29,32,37,40,48,54,61,139,153,156,163,167,170,313,319,325,329,332,463,466,503,517,530,545,572,576,579,587,623,641,649,679,695,707,748,781,784,924,930,934,937,1083,1098,1101,1106,1109,1156,1163,1167,1170,1175,1306,1311,1478,1491,1494,1498,1501,1561,1575,1578,1617,1620,1726,1735,1739,1745,1800,1803,1825,1828,1839,1843,1851,1859,1915,1936,1958,2006,2013,2022,2026,2098,2101,2104],[26,27,28],"p",{},"A team built staging by hand: a VPC, two subnets, a security group, a load balancer, an Auto Scaling group, and an RDS instance. It took an afternoon of clicking. Now production needs the same thing, in a second Region, and nobody can reconstruct the exact security group rules from memory. Somebody opens the console side by side with staging and starts copying.",[26,30,31],{},"That is the problem CloudFormation removes. You describe the infrastructure once, in a file, and AWS builds it. Build it again next week in another account and you get the same result, because the description is the source of truth instead of somebody's memory.",[33,34,36],"h2",{"id":35},"template-stack-and-the-two-kinds-of-id","Template, stack, and the two kinds of ID",[26,38,39],{},"Three words carry most of the meaning, and mixing them up makes every later concept harder.",[26,41,42,43,47],{},"A ",[44,45,46],"strong",{},"template"," is the file. JSON or YAML, stored in Git, reviewed like code, doing nothing on its own.",[26,49,42,50,53],{},[44,51,52],{},"stack"," is what you get when CloudFormation processes that template: a live collection of AWS resources managed as one unit. Update the stack and CloudFormation works out which resources need to change. Delete the stack and, by default, everything in it goes.",[26,55,56,57,60],{},"Inside the template, every resource has a ",[44,58,59],{},"logical ID",", the name you choose:",[62,63,68],"pre",{"className":64,"code":65,"language":66,"meta":67,"style":67},"language-yaml shiki shiki-themes material-theme-lighter github-light github-dark","Resources:\n  WebSecurityGroup:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: Allow HTTPS from the load balancer\n      VpcId: !Ref AppVpc\n","yaml","",[69,70,71,84,92,105,113,124],"code",{"__ignoreMap":67},[72,73,76,80],"span",{"class":74,"line":75},"line",1,[72,77,79],{"class":78},"sQzsp","Resources",[72,81,83],{"class":82},"sP7_E",":\n",[72,85,87,90],{"class":74,"line":86},2,[72,88,89],{"class":78},"  WebSecurityGroup",[72,91,83],{"class":82},[72,93,95,98,101],{"class":74,"line":94},3,[72,96,97],{"class":78},"    Type",[72,99,100],{"class":82},":",[72,102,104],{"class":103},"s_sjI"," AWS::EC2::SecurityGroup\n",[72,106,108,111],{"class":74,"line":107},4,[72,109,110],{"class":78},"    Properties",[72,112,83],{"class":82},[72,114,116,119,121],{"class":74,"line":115},5,[72,117,118],{"class":78},"      GroupDescription",[72,120,100],{"class":82},[72,122,123],{"class":103}," Allow HTTPS from the load balancer\n",[72,125,127,130,132,136],{"class":74,"line":126},6,[72,128,129],{"class":78},"      VpcId",[72,131,100],{"class":82},[72,133,135],{"class":134},"sbsja"," !Ref",[72,137,138],{"class":103}," AppVpc\n",[26,140,141,144,145,148,149,152],{},[69,142,143],{},"WebSecurityGroup"," is the logical ID. It exists only inside this template and this stack. When CloudFormation creates the group, AWS assigns it a ",[44,146,147],{},"physical ID"," such as ",[69,150,151],{},"sg-0a1b2c3d4e5f",". The logical ID is how you refer to the resource while authoring; the physical ID is what actually exists in the account.",[26,154,155],{},"That distinction becomes load-bearing later. Rename a logical ID and CloudFormation does not see a rename, it sees one resource deleted and a different resource created. The physical ID is also what changes when a resource is replaced during an update, which is the difference between a harmless update and an outage.",[26,157,158,159,162],{},"One more framing that pays off throughout this topic: a template is ",[44,160,161],{},"declarative",". You state the end state, not the steps. You never write \"create the VPC, wait, then create the subnet.\" You state that the subnet belongs to the VPC, and CloudFormation figures out the order.",[33,164,166],{"id":165},"the-template-sections","The template sections",[26,168,169],{},"A template has ten possible top-level sections. Exactly one is required.",[171,172,173,186],"table",{},[174,175,176],"thead",{},[177,178,179,183],"tr",{},[180,181,182],"th",{},"Section",[180,184,185],{},"Purpose",[187,188,189,209,219,233,243,253,270,280,290,303],"tbody",{},[177,190,191,196],{},[192,193,194],"td",{},[69,195,79],{},[192,197,198,201,202,205,206],{},[44,199,200],{},"Required."," The AWS resources to create, each with a logical ID, a ",[69,203,204],{},"Type",", and ",[69,207,208],{},"Properties",[177,210,211,216],{},[192,212,213],{},[69,214,215],{},"Parameters",[192,217,218],{},"Values supplied at create or update time, so one template serves many environments",[177,220,221,226],{},[192,222,223],{},[69,224,225],{},"Mappings",[192,227,228,229,232],{},"A static lookup table read with ",[69,230,231],{},"Fn::FindInMap",", typically keyed by Region or environment",[177,234,235,240],{},[192,236,237],{},[69,238,239],{},"Conditions",[192,241,242],{},"Named boolean expressions that decide whether a resource or property is included",[177,244,245,250],{},[192,246,247],{},[69,248,249],{},"Outputs",[192,251,252],{},"Values returned after the stack is built, optionally exported for other stacks",[177,254,255,260],{},[192,256,257],{},[69,258,259],{},"Transform",[192,261,262,263,266,267],{},"Macros to run over the template, including ",[69,264,265],{},"AWS::Serverless"," (SAM) and ",[69,268,269],{},"AWS::LanguageExtensions",[177,271,272,277],{},[192,273,274],{},[69,275,276],{},"Metadata",[192,278,279],{},"Arbitrary extra data about the template, including console UI hints",[177,281,282,287],{},[192,283,284],{},[69,285,286],{},"Rules",[192,288,289],{},"Validates a parameter or a combination of parameters before provisioning",[177,291,292,297],{},[192,293,294],{},[69,295,296],{},"AWSTemplateFormatVersion",[192,298,299,300],{},"The template format version, ",[69,301,302],{},"2010-09-09",[177,304,305,310],{},[192,306,307],{},[69,308,309],{},"Description",[192,311,312],{},"A text description of the template",[26,314,315,316,318],{},"A template that only declares ",[69,317,79],{}," is valid. Everything else earns its place by making the template reusable, safer, or easier to read.",[26,320,321,322,324],{},"Section order in the file does not matter to CloudFormation, and neither does the order of resources inside ",[69,323,79],{},". That surprises people who expect a script.",[33,326,328],{"id":327},"parameters-input-with-guardrails","Parameters: input with guardrails",[26,330,331],{},"A hardcoded template is a template you can only use once. Parameters are how one file serves dev, staging, and production.",[62,333,335],{"className":64,"code":334,"language":66,"meta":67,"style":67},"Parameters:\n  EnvironmentName:\n    Type: String\n    AllowedValues: [dev, staging, prod]\n    Description: Which environment this stack represents\n\n  AppVpcId:\n    Type: AWS::EC2::VPC::Id\n    Description: The VPC to deploy into\n\n  LatestAmiId:\n    Type: AWS::SSM::Parameter::Value\u003CAWS::EC2::Image::Id>\n    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2\n",[69,336,337,343,350,359,386,396,401,409,419,429,434,442,452],{"__ignoreMap":67},[72,338,339,341],{"class":74,"line":75},[72,340,215],{"class":78},[72,342,83],{"class":82},[72,344,345,348],{"class":74,"line":86},[72,346,347],{"class":78},"  EnvironmentName",[72,349,83],{"class":82},[72,351,352,354,356],{"class":74,"line":94},[72,353,97],{"class":78},[72,355,100],{"class":82},[72,357,358],{"class":103}," String\n",[72,360,361,364,366,369,372,375,378,380,383],{"class":74,"line":107},[72,362,363],{"class":78},"    AllowedValues",[72,365,100],{"class":82},[72,367,368],{"class":82}," [",[72,370,371],{"class":103},"dev",[72,373,374],{"class":82},",",[72,376,377],{"class":103}," staging",[72,379,374],{"class":82},[72,381,382],{"class":103}," prod",[72,384,385],{"class":82},"]\n",[72,387,388,391,393],{"class":74,"line":115},[72,389,390],{"class":78},"    Description",[72,392,100],{"class":82},[72,394,395],{"class":103}," Which environment this stack represents\n",[72,397,398],{"class":74,"line":126},[72,399,400],{"emptyLinePlaceholder":9},"\n",[72,402,404,407],{"class":74,"line":403},7,[72,405,406],{"class":78},"  AppVpcId",[72,408,83],{"class":82},[72,410,412,414,416],{"class":74,"line":411},8,[72,413,97],{"class":78},[72,415,100],{"class":82},[72,417,418],{"class":103}," AWS::EC2::VPC::Id\n",[72,420,422,424,426],{"class":74,"line":421},9,[72,423,390],{"class":78},[72,425,100],{"class":82},[72,427,428],{"class":103}," The VPC to deploy into\n",[72,430,432],{"class":74,"line":431},10,[72,433,400],{"emptyLinePlaceholder":9},[72,435,437,440],{"class":74,"line":436},11,[72,438,439],{"class":78},"  LatestAmiId",[72,441,83],{"class":82},[72,443,445,447,449],{"class":74,"line":444},12,[72,446,97],{"class":78},[72,448,100],{"class":82},[72,450,451],{"class":103}," AWS::SSM::Parameter::Value\u003CAWS::EC2::Image::Id>\n",[72,453,455,458,460],{"class":74,"line":454},13,[72,456,457],{"class":78},"    Default",[72,459,100],{"class":82},[72,461,462],{"class":103}," /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2\n",[26,464,465],{},"Three different parameter types are doing three different jobs there, and the difference matters more than the syntax suggests.",[26,467,468,471,472,475,476,479,480,482,483,482,486,482,489,482,492,482,495,498,499,502],{},[69,469,470],{},"EnvironmentName"," is a plain ",[44,473,474],{},"String"," locked down by ",[69,477,478],{},"AllowedValues",". Constraints (",[69,481,478],{},", ",[69,484,485],{},"AllowedPattern",[69,487,488],{},"MinLength",[69,490,491],{},"MaxLength",[69,493,494],{},"MinValue",[69,496,497],{},"MaxValue",") are checked before any resource is touched, so a typo fails in seconds instead of failing halfway through a 12-minute deployment. Add ",[69,500,501],{},"ConstraintDescription"," and the error message says \"must be dev, staging, or prod\" instead of dumping a regular expression at the user.",[26,504,505,508,509,512,513,516],{},[69,506,507],{},"AppVpcId"," uses an ",[44,510,511],{},"AWS-specific parameter type",". CloudFormation validates that the VPC actually exists in this account and Region, and the console shows a dropdown instead of a text box. There are types for availability zones, AMI IDs, instance IDs, key pairs, security groups, subnets, volumes, VPCs, and Route 53 hosted zones, plus a ",[69,514,515],{},"List\u003C>"," form of each.",[26,518,519,508,522,525,526,529],{},[69,520,521],{},"LatestAmiId",[44,523,524],{},"SSM parameter type",". You supply a Parameter Store key, and CloudFormation fetches the current value at create or update time. That one line replaces the entire Region-to-AMI mapping table that older templates carried, and it is the reason the AWS public parameter ",[69,527,528],{},"/aws/service/ami-amazon-latest/..."," exists. Note what \"current\" means here: the value is resolved when the stack operation runs, so a stack created last month still holds last month's AMI ID until you update it.",[26,531,532,533,482,535,482,538,205,541,544],{},"The basic types are ",[69,534,474],{},[69,536,537],{},"Number",[69,539,540],{},"List\u003CNumber>",[69,542,543],{},"CommaDelimitedList",". A template can declare up to 200 parameters.",[26,546,547,550,551,554,555,558,559,562,563,565,566,568,569,571],{},[44,548,549],{},"The misconception worth killing now:"," parameters are not a secrets mechanism. ",[69,552,553],{},"NoEcho: true"," masks a parameter with asterisks in ",[69,556,557],{},"describe-stacks"," and ",[69,560,561],{},"describe-stack-events",", which is useful, but it is a display filter and nothing more. It does not mask the value in the ",[69,564,249],{}," section, in the ",[69,567,276],{}," section, or in a resource's ",[69,570,276],{}," attribute, and the value still travels through your API call and your CI logs. Secrets belong in a dynamic reference, covered later in this lesson.",[33,573,575],{"id":574},"intrinsic-functions","Intrinsic functions",[26,577,578],{},"A template has to refer to things that do not exist yet. The instance needs the security group's ID, but the security group has no ID until CloudFormation creates it. Intrinsic functions are how you write \"whatever that turns out to be.\"",[26,580,581,586],{},[44,582,583],{},[69,584,585],{},"Ref"," returns a resource's primary identifier, or a parameter's value.",[62,588,590],{"className":64,"code":589,"language":66,"meta":67,"style":67},"SubnetId: !Ref PrivateSubnetA     # returns subnet-0abc123\nInstanceType: !Ref InstanceType   # returns the parameter value\n",[69,591,592,608],{"__ignoreMap":67},[72,593,594,597,599,601,604],{"class":74,"line":75},[72,595,596],{"class":78},"SubnetId",[72,598,100],{"class":82},[72,600,135],{"class":134},[72,602,603],{"class":103}," PrivateSubnetA",[72,605,607],{"class":606},"sutJx","     # returns subnet-0abc123\n",[72,609,610,613,615,617,620],{"class":74,"line":86},[72,611,612],{"class":78},"InstanceType",[72,614,100],{"class":82},[72,616,135],{"class":134},[72,618,619],{"class":103}," InstanceType",[72,621,622],{"class":606},"   # returns the parameter value\n",[26,624,625,626,628,629,632,633,636,637,640],{},"What ",[69,627,585],{}," returns is resource-specific and documented per type. For ",[69,630,631],{},"AWS::EC2::Instance"," it is the instance ID. For ",[69,634,635],{},"AWS::S3::Bucket"," it is the bucket name. For ",[69,638,639],{},"AWS::IAM::Role"," it is the role name, not the ARN, which is a very common one-line failure.",[26,642,643,648],{},[44,644,645],{},[69,646,647],{},"Fn::GetAtt"," returns a named attribute instead of the identifier.",[62,650,652],{"className":64,"code":651,"language":66,"meta":67,"style":67},"RoleArn: !GetAtt AppRole.Arn\nDnsName: !GetAtt AppLoadBalancer.DNSName\n",[69,653,654,667],{"__ignoreMap":67},[72,655,656,659,661,664],{"class":74,"line":75},[72,657,658],{"class":78},"RoleArn",[72,660,100],{"class":82},[72,662,663],{"class":134}," !GetAtt",[72,665,666],{"class":103}," AppRole.Arn\n",[72,668,669,672,674,676],{"class":74,"line":86},[72,670,671],{"class":78},"DnsName",[72,673,100],{"class":82},[72,675,663],{"class":134},[72,677,678],{"class":103}," AppLoadBalancer.DNSName\n",[26,680,681,682,684,685,688,689,691,692,694],{},"Read the boundary between them once and you stop guessing: ",[69,683,585],{}," gives you the one identifier the resource type nominates; ",[69,686,687],{},"GetAtt"," gives you any other published attribute, by name. When a stem asks for an ARN and the resource's ",[69,690,585],{}," returns a name, the answer is ",[69,693,687],{},".",[26,696,697,702,703,706],{},[44,698,699],{},[69,700,701],{},"Fn::Sub"," does string substitution, and it is the readable replacement for nested ",[69,704,705],{},"Fn::Join"," calls.",[62,708,710],{"className":64,"code":709,"language":66,"meta":67,"style":67},"BucketName: !Sub \"${EnvironmentName}-app-logs-${AWS::AccountId}\"\nArn: !Sub \"arn:${AWS::Partition}:s3:::${LogBucket}/*\"\n",[69,711,712,732],{"__ignoreMap":67},[72,713,714,717,719,722,726,729],{"class":74,"line":75},[72,715,716],{"class":78},"BucketName",[72,718,100],{"class":82},[72,720,721],{"class":134}," !Sub",[72,723,725],{"class":724},"sjJ54"," \"",[72,727,728],{"class":103},"${EnvironmentName}-app-logs-${AWS::AccountId}",[72,730,731],{"class":724},"\"\n",[72,733,734,737,739,741,743,746],{"class":74,"line":86},[72,735,736],{"class":78},"Arn",[72,738,100],{"class":82},[72,740,721],{"class":134},[72,742,725],{"class":724},[72,744,745],{"class":103},"arn:${AWS::Partition}:s3:::${LogBucket}/*",[72,747,731],{"class":724},[26,749,750,751,754,755,758,759,482,762,482,765,482,768,482,771,482,774,205,777,780],{},"Those ",[69,752,753],{},"${AWS::...}"," values are ",[44,756,757],{},"pseudo parameters",": values CloudFormation supplies without you declaring them. ",[69,760,761],{},"AWS::Region",[69,763,764],{},"AWS::AccountId",[69,766,767],{},"AWS::StackName",[69,769,770],{},"AWS::StackId",[69,772,773],{},"AWS::Partition",[69,775,776],{},"AWS::URLSuffix",[69,778,779],{},"AWS::NoValue",". Using them instead of hardcoded values is what makes a template portable across accounts, Regions, and partitions such as GovCloud.",[26,782,783],{},"The rest of the working set, briefly:",[171,785,786,796],{},[174,787,788],{},[177,789,790,793],{},[180,791,792],{},"Function",[180,794,795],{},"Use it for",[187,797,798,810,820,830,843,853,863,873,883,905],{},[177,799,800,804],{},[192,801,802],{},[69,803,231],{},[192,805,806,807,809],{},"Read a value out of the ",[69,808,225],{}," section",[177,811,812,817],{},[192,813,814],{},[69,815,816],{},"Fn::ImportValue",[192,818,819],{},"Read a value exported by another stack in the same account and Region",[177,821,822,827],{},[192,823,824],{},[69,825,826],{},"Fn::GetStackOutput",[192,828,829],{},"Read any stack output, including cross-Region and cross-account",[177,831,832,840],{},[192,833,834,836,837],{},[69,835,705],{}," / ",[69,838,839],{},"Fn::Split",[192,841,842],{},"Build a string from parts, or break one apart",[177,844,845,850],{},[192,846,847],{},[69,848,849],{},"Fn::Select",[192,851,852],{},"Pick an item from a list by index",[177,854,855,860],{},[192,856,857],{},[69,858,859],{},"Fn::GetAZs",[192,861,862],{},"Get the availability zones of a Region as a list",[177,864,865,870],{},[192,866,867],{},[69,868,869],{},"Fn::Base64",[192,871,872],{},"Encode user data",[177,874,875,880],{},[192,876,877],{},[69,878,879],{},"Fn::Cidr",[192,881,882],{},"Carve subnet CIDR blocks out of a VPC CIDR",[177,884,885,902],{},[192,886,887,482,890,482,893,482,896,482,899],{},[69,888,889],{},"Fn::If",[69,891,892],{},"Fn::Equals",[69,894,895],{},"Fn::Not",[69,897,898],{},"Fn::And",[69,900,901],{},"Fn::Or",[192,903,904],{},"Condition logic",[177,906,907,918],{},[192,908,909,482,912,482,915],{},[69,910,911],{},"Fn::ForEach",[69,913,914],{},"Fn::Length",[69,916,917],{},"Fn::ToJsonString",[192,919,920,921,923],{},"Loops and helpers, available only with the ",[69,922,269],{}," transform",[26,925,926,927,929],{},"Intrinsic functions are not usable everywhere. You can use them in resource properties, outputs, metadata attributes, update policy attributes, and conditions. You cannot use them in the ",[69,928,215],{}," section, which is why a parameter default can never be computed.",[33,931,933],{"id":932},"the-dependency-graph-you-did-not-have-to-write","The dependency graph you did not have to write",[26,935,936],{},"Here is where declarative stops being an abstract word.",[62,938,940],{"className":64,"code":939,"language":66,"meta":67,"style":67},"Resources:\n  AppVpc:\n    Type: AWS::EC2::VPC\n    Properties:\n      CidrBlock: 10.0.0.0/16\n\n  WebSecurityGroup:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: Web tier\n      VpcId: !Ref AppVpc\n\n  WebInstance:\n    Type: AWS::EC2::Instance\n    Properties:\n      ImageId: !Ref LatestAmiId\n      SecurityGroupIds:\n        - !Ref WebSecurityGroup\n",[69,941,942,948,955,964,970,980,984,990,998,1004,1013,1023,1027,1034,1044,1051,1064,1072],{"__ignoreMap":67},[72,943,944,946],{"class":74,"line":75},[72,945,79],{"class":78},[72,947,83],{"class":82},[72,949,950,953],{"class":74,"line":86},[72,951,952],{"class":78},"  AppVpc",[72,954,83],{"class":82},[72,956,957,959,961],{"class":74,"line":94},[72,958,97],{"class":78},[72,960,100],{"class":82},[72,962,963],{"class":103}," AWS::EC2::VPC\n",[72,965,966,968],{"class":74,"line":107},[72,967,110],{"class":78},[72,969,83],{"class":82},[72,971,972,975,977],{"class":74,"line":115},[72,973,974],{"class":78},"      CidrBlock",[72,976,100],{"class":82},[72,978,979],{"class":103}," 10.0.0.0/16\n",[72,981,982],{"class":74,"line":126},[72,983,400],{"emptyLinePlaceholder":9},[72,985,986,988],{"class":74,"line":403},[72,987,89],{"class":78},[72,989,83],{"class":82},[72,991,992,994,996],{"class":74,"line":411},[72,993,97],{"class":78},[72,995,100],{"class":82},[72,997,104],{"class":103},[72,999,1000,1002],{"class":74,"line":421},[72,1001,110],{"class":78},[72,1003,83],{"class":82},[72,1005,1006,1008,1010],{"class":74,"line":431},[72,1007,118],{"class":78},[72,1009,100],{"class":82},[72,1011,1012],{"class":103}," Web tier\n",[72,1014,1015,1017,1019,1021],{"class":74,"line":436},[72,1016,129],{"class":78},[72,1018,100],{"class":82},[72,1020,135],{"class":134},[72,1022,138],{"class":103},[72,1024,1025],{"class":74,"line":444},[72,1026,400],{"emptyLinePlaceholder":9},[72,1028,1029,1032],{"class":74,"line":454},[72,1030,1031],{"class":78},"  WebInstance",[72,1033,83],{"class":82},[72,1035,1037,1039,1041],{"class":74,"line":1036},14,[72,1038,97],{"class":78},[72,1040,100],{"class":82},[72,1042,1043],{"class":103}," AWS::EC2::Instance\n",[72,1045,1047,1049],{"class":74,"line":1046},15,[72,1048,110],{"class":78},[72,1050,83],{"class":82},[72,1052,1054,1057,1059,1061],{"class":74,"line":1053},16,[72,1055,1056],{"class":78},"      ImageId",[72,1058,100],{"class":82},[72,1060,135],{"class":134},[72,1062,1063],{"class":103}," LatestAmiId\n",[72,1065,1067,1070],{"class":74,"line":1066},17,[72,1068,1069],{"class":78},"      SecurityGroupIds",[72,1071,83],{"class":82},[72,1073,1075,1078,1080],{"class":74,"line":1074},18,[72,1076,1077],{"class":82},"        -",[72,1079,135],{"class":134},[72,1081,1082],{"class":103}," WebSecurityGroup\n",[26,1084,1085,1086,1088,1089,205,1092,1088,1095,1097],{},"Nothing in that template states an order. But ",[69,1087,143],{}," refers to ",[69,1090,1091],{},"AppVpc",[69,1093,1094],{},"WebInstance",[69,1096,143],{},", so CloudFormation builds a directed graph out of those references and creates resources in an order that satisfies it: VPC, then security group, then instance. Resources with no edge between them are created in parallel, which is why a 40-resource stack does not take 40 times as long as a 1-resource stack.",[26,1099,1100],{},"Deletion runs the same graph in reverse. That is why you cannot delete a VPC stack while an instance from it still exists, and why an unexpected delete order usually means an unexpected reference.",[1102,1103],"infographic",{"alt":1104,"slug":1105},"A directed graph of five template resources where solid arrows labelled Ref and Fn::GetAtt set the creation order automatically, and a single dashed DependsOn arrow supplies the one ordering that no reference expresses.","cloudformation-fundamentals-dependency-graph",[26,1107,1108],{},"Sometimes two resources must be ordered even though neither refers to the other. The classic case is an Elastic IP in a VPC: it needs the internet gateway attached before it can be allocated, but nothing in its properties mentions the attachment. For that, and only that, you declare the edge yourself:",[62,1110,1112],{"className":64,"code":1111,"language":66,"meta":67,"style":67},"  NatEip:\n    Type: AWS::EC2::EIP\n    DependsOn: AttachGateway\n    Properties:\n      Domain: vpc\n",[69,1113,1114,1121,1130,1140,1146],{"__ignoreMap":67},[72,1115,1116,1119],{"class":74,"line":75},[72,1117,1118],{"class":78},"  NatEip",[72,1120,83],{"class":82},[72,1122,1123,1125,1127],{"class":74,"line":86},[72,1124,97],{"class":78},[72,1126,100],{"class":82},[72,1128,1129],{"class":103}," AWS::EC2::EIP\n",[72,1131,1132,1135,1137],{"class":74,"line":94},[72,1133,1134],{"class":78},"    DependsOn",[72,1136,100],{"class":82},[72,1138,1139],{"class":103}," AttachGateway\n",[72,1141,1142,1144],{"class":74,"line":107},[72,1143,110],{"class":78},[72,1145,83],{"class":82},[72,1147,1148,1151,1153],{"class":74,"line":115},[72,1149,1150],{"class":78},"      Domain",[72,1152,100],{"class":82},[72,1154,1155],{"class":103}," vpc\n",[26,1157,1158,1159,1162],{},"Reach for ",[69,1160,1161],{},"DependsOn"," when a reference cannot express the ordering, not as a general safety measure. Sprinkling it everywhere serializes a stack that could have deployed in parallel, and it hides the real relationships from the next reader.",[33,1164,1166],{"id":1165},"conditions-and-mappings-one-template-many-environments","Conditions and Mappings: one template, many environments",[26,1168,1169],{},"Production needs a Multi-AZ database and a bastion host. Dev needs neither, and paying for both is silly. Two mechanisms handle this without forking the template.",[26,1171,1172,1174],{},[44,1173,225],{}," are a static lookup table:",[62,1176,1178],{"className":64,"code":1177,"language":66,"meta":67,"style":67},"Mappings:\n  EnvConfig:\n    dev:\n      InstanceType: t3.small\n      MinSize: 1\n    prod:\n      InstanceType: m6i.large\n      MinSize: 3\n\nResources:\n  AppGroup:\n    Type: AWS::AutoScaling::AutoScalingGroup\n    Properties:\n      MinSize: !FindInMap [EnvConfig, !Ref EnvironmentName, MinSize]\n",[69,1179,1180,1186,1193,1200,1210,1221,1228,1237,1246,1250,1256,1263,1272,1278],{"__ignoreMap":67},[72,1181,1182,1184],{"class":74,"line":75},[72,1183,225],{"class":78},[72,1185,83],{"class":82},[72,1187,1188,1191],{"class":74,"line":86},[72,1189,1190],{"class":78},"  EnvConfig",[72,1192,83],{"class":82},[72,1194,1195,1198],{"class":74,"line":94},[72,1196,1197],{"class":78},"    dev",[72,1199,83],{"class":82},[72,1201,1202,1205,1207],{"class":74,"line":107},[72,1203,1204],{"class":78},"      InstanceType",[72,1206,100],{"class":82},[72,1208,1209],{"class":103}," t3.small\n",[72,1211,1212,1215,1217],{"class":74,"line":115},[72,1213,1214],{"class":78},"      MinSize",[72,1216,100],{"class":82},[72,1218,1220],{"class":1219},"srdBf"," 1\n",[72,1222,1223,1226],{"class":74,"line":126},[72,1224,1225],{"class":78},"    prod",[72,1227,83],{"class":82},[72,1229,1230,1232,1234],{"class":74,"line":403},[72,1231,1204],{"class":78},[72,1233,100],{"class":82},[72,1235,1236],{"class":103}," m6i.large\n",[72,1238,1239,1241,1243],{"class":74,"line":411},[72,1240,1214],{"class":78},[72,1242,100],{"class":82},[72,1244,1245],{"class":1219}," 3\n",[72,1247,1248],{"class":74,"line":421},[72,1249,400],{"emptyLinePlaceholder":9},[72,1251,1252,1254],{"class":74,"line":431},[72,1253,79],{"class":78},[72,1255,83],{"class":82},[72,1257,1258,1261],{"class":74,"line":436},[72,1259,1260],{"class":78},"  AppGroup",[72,1262,83],{"class":82},[72,1264,1265,1267,1269],{"class":74,"line":444},[72,1266,97],{"class":78},[72,1268,100],{"class":82},[72,1270,1271],{"class":103}," AWS::AutoScaling::AutoScalingGroup\n",[72,1273,1274,1276],{"class":74,"line":454},[72,1275,110],{"class":78},[72,1277,83],{"class":82},[72,1279,1280,1282,1284,1287,1289,1292,1294,1296,1299,1301,1304],{"class":74,"line":1036},[72,1281,1214],{"class":78},[72,1283,100],{"class":82},[72,1285,1286],{"class":134}," !FindInMap",[72,1288,368],{"class":82},[72,1290,1291],{"class":103},"EnvConfig",[72,1293,374],{"class":82},[72,1295,135],{"class":134},[72,1297,1298],{"class":103}," EnvironmentName",[72,1300,374],{"class":82},[72,1302,1303],{"class":103}," MinSize",[72,1305,385],{"class":82},[26,1307,1308,1310],{},[44,1309,239],{}," decide whether something exists at all:",[62,1312,1314],{"className":64,"code":1313,"language":66,"meta":67,"style":67},"Conditions:\n  IsProduction: !Equals [!Ref EnvironmentName, prod]\n\nResources:\n  BastionHost:\n    Type: AWS::EC2::Instance\n    Condition: IsProduction\n    Properties:\n      # ...\n\n  AppDatabase:\n    Type: AWS::RDS::DBInstance\n    Properties:\n      MultiAZ: !If [IsProduction, true, false]\n      DBSnapshotIdentifier: !If [IsProduction, !Ref SnapshotId, !Ref \"AWS::NoValue\"]\n",[69,1315,1316,1322,1345,1349,1355,1362,1370,1380,1386,1391,1395,1402,1411,1417,1445],{"__ignoreMap":67},[72,1317,1318,1320],{"class":74,"line":75},[72,1319,239],{"class":78},[72,1321,83],{"class":82},[72,1323,1324,1327,1329,1332,1334,1337,1339,1341,1343],{"class":74,"line":86},[72,1325,1326],{"class":78},"  IsProduction",[72,1328,100],{"class":82},[72,1330,1331],{"class":134}," !Equals",[72,1333,368],{"class":82},[72,1335,1336],{"class":134},"!Ref",[72,1338,1298],{"class":103},[72,1340,374],{"class":82},[72,1342,382],{"class":103},[72,1344,385],{"class":82},[72,1346,1347],{"class":74,"line":94},[72,1348,400],{"emptyLinePlaceholder":9},[72,1350,1351,1353],{"class":74,"line":107},[72,1352,79],{"class":78},[72,1354,83],{"class":82},[72,1356,1357,1360],{"class":74,"line":115},[72,1358,1359],{"class":78},"  BastionHost",[72,1361,83],{"class":82},[72,1363,1364,1366,1368],{"class":74,"line":126},[72,1365,97],{"class":78},[72,1367,100],{"class":82},[72,1369,1043],{"class":103},[72,1371,1372,1375,1377],{"class":74,"line":403},[72,1373,1374],{"class":78},"    Condition",[72,1376,100],{"class":82},[72,1378,1379],{"class":103}," IsProduction\n",[72,1381,1382,1384],{"class":74,"line":411},[72,1383,110],{"class":78},[72,1385,83],{"class":82},[72,1387,1388],{"class":74,"line":421},[72,1389,1390],{"class":606},"      # ...\n",[72,1392,1393],{"class":74,"line":431},[72,1394,400],{"emptyLinePlaceholder":9},[72,1396,1397,1400],{"class":74,"line":436},[72,1398,1399],{"class":78},"  AppDatabase",[72,1401,83],{"class":82},[72,1403,1404,1406,1408],{"class":74,"line":444},[72,1405,97],{"class":78},[72,1407,100],{"class":82},[72,1409,1410],{"class":103}," AWS::RDS::DBInstance\n",[72,1412,1413,1415],{"class":74,"line":454},[72,1414,110],{"class":78},[72,1416,83],{"class":82},[72,1418,1419,1422,1424,1427,1429,1432,1434,1438,1440,1443],{"class":74,"line":1036},[72,1420,1421],{"class":78},"      MultiAZ",[72,1423,100],{"class":82},[72,1425,1426],{"class":134}," !If",[72,1428,368],{"class":82},[72,1430,1431],{"class":103},"IsProduction",[72,1433,374],{"class":82},[72,1435,1437],{"class":1436},"syTEX"," true",[72,1439,374],{"class":82},[72,1441,1442],{"class":1436}," false",[72,1444,385],{"class":82},[72,1446,1447,1450,1452,1454,1456,1458,1460,1462,1465,1467,1469,1471,1473,1476],{"class":74,"line":1046},[72,1448,1449],{"class":78},"      DBSnapshotIdentifier",[72,1451,100],{"class":82},[72,1453,1426],{"class":134},[72,1455,368],{"class":82},[72,1457,1431],{"class":103},[72,1459,374],{"class":82},[72,1461,135],{"class":134},[72,1463,1464],{"class":103}," SnapshotId",[72,1466,374],{"class":82},[72,1468,135],{"class":134},[72,1470,725],{"class":724},[72,1472,779],{"class":103},[72,1474,1475],{"class":724},"\"",[72,1477,385],{"class":82},[26,1479,1480,1481,1484,1485,1487,1488,1490],{},"Two details in that last block are worth stopping on. A ",[69,1482,1483],{},"Condition"," on a resource controls whether the resource is created; ",[69,1486,889],{}," inside a property controls the value of that property. And ",[69,1489,779],{}," is the pseudo parameter that means \"omit this property entirely,\" which is the only way to express an absent optional property conditionally.",[26,1492,1493],{},"The decision rule: mappings for values that differ, conditions for resources and properties that exist or do not.",[33,1495,1497],{"id":1496},"outputs-and-sharing-values-between-stacks","Outputs, and sharing values between stacks",[26,1499,1500],{},"A stack that builds a VPC is not much use if nothing else can find the subnet IDs.",[62,1502,1504],{"className":64,"code":1503,"language":66,"meta":67,"style":67},"Outputs:\n  AppVpcId:\n    Description: VPC created by this stack\n    Value: !Ref AppVpc\n    Export:\n      Name: !Sub \"${AWS::StackName}-VpcId\"\n",[69,1505,1506,1512,1518,1527,1538,1545],{"__ignoreMap":67},[72,1507,1508,1510],{"class":74,"line":75},[72,1509,249],{"class":78},[72,1511,83],{"class":82},[72,1513,1514,1516],{"class":74,"line":86},[72,1515,406],{"class":78},[72,1517,83],{"class":82},[72,1519,1520,1522,1524],{"class":74,"line":94},[72,1521,390],{"class":78},[72,1523,100],{"class":82},[72,1525,1526],{"class":103}," VPC created by this stack\n",[72,1528,1529,1532,1534,1536],{"class":74,"line":107},[72,1530,1531],{"class":78},"    Value",[72,1533,100],{"class":82},[72,1535,135],{"class":134},[72,1537,138],{"class":103},[72,1539,1540,1543],{"class":74,"line":115},[72,1541,1542],{"class":78},"    Export",[72,1544,83],{"class":82},[72,1546,1547,1550,1552,1554,1556,1559],{"class":74,"line":126},[72,1548,1549],{"class":78},"      Name",[72,1551,100],{"class":82},[72,1553,721],{"class":134},[72,1555,725],{"class":724},[72,1557,1558],{"class":103},"${AWS::StackName}-VpcId",[72,1560,731],{"class":724},[26,1562,1563,1566,1567,1570,1571,1574],{},[69,1564,1565],{},"Value"," makes the output visible on the stack. Adding ",[69,1568,1569],{},"Export"," publishes it under a name that must be unique per account and Region, which is why prefixing with ",[69,1572,1573],{},"${AWS::StackName}"," is the standard habit.",[26,1576,1577],{},"Another stack then consumes it:",[62,1579,1581],{"className":64,"code":1580,"language":66,"meta":67,"style":67},"  AppSubnet:\n    Type: AWS::EC2::Subnet\n    Properties:\n      VpcId: !ImportValue network-stack-VpcId\n",[69,1582,1583,1590,1599,1605],{"__ignoreMap":67},[72,1584,1585,1588],{"class":74,"line":75},[72,1586,1587],{"class":78},"  AppSubnet",[72,1589,83],{"class":82},[72,1591,1592,1594,1596],{"class":74,"line":86},[72,1593,97],{"class":78},[72,1595,100],{"class":82},[72,1597,1598],{"class":103}," AWS::EC2::Subnet\n",[72,1600,1601,1603],{"class":74,"line":94},[72,1602,110],{"class":78},[72,1604,83],{"class":82},[72,1606,1607,1609,1611,1614],{"class":74,"line":107},[72,1608,129],{"class":78},[72,1610,100],{"class":82},[72,1612,1613],{"class":134}," !ImportValue",[72,1615,1616],{"class":103}," network-stack-VpcId\n",[26,1618,1619],{},"There are now three ways to pass a value from one stack to another, and they differ in strength and reach, not in syntax.",[171,1621,1622,1639],{},[174,1623,1624],{},[177,1625,1626,1628,1632,1636],{},[180,1627],{},[180,1629,1630],{},[69,1631,816],{},[180,1633,1634],{},[69,1635,826],{},[180,1637,1638],{},"Nested stack outputs",[187,1640,1641,1657,1668,1684,1698,1712],{},[177,1642,1643,1649,1652,1655],{},[192,1644,1645,1646,1648],{},"Requires an ",[69,1647,1569],{}," on the producer",[192,1650,1651],{},"Yes",[192,1653,1654],{},"No",[192,1656,1654],{},[177,1658,1659,1662,1664,1666],{},[192,1660,1661],{},"Same account, same Region",[192,1663,1651],{},[192,1665,1651],{},[192,1667,1651],{},[177,1669,1670,1673,1675,1682],{},[192,1671,1672],{},"Cross-Region",[192,1674,1654],{},[192,1676,1677,1678,1681],{},"Yes, with the ",[69,1679,1680],{},"Region"," parameter",[192,1683,1654],{},[177,1685,1686,1689,1691,1696],{},[192,1687,1688],{},"Cross-account",[192,1690,1654],{},[192,1692,1693,1694],{},"Yes, with a ",[69,1695,658],{},[192,1697,1654],{},[177,1699,1700,1703,1706,1709],{},[192,1701,1702],{},"Reference strength",[192,1704,1705],{},"Strong: producer cannot be deleted while imported",[192,1707,1708],{},"Weak: resolved at deploy time only",[192,1710,1711],{},"Owned by the parent stack",[177,1713,1714,1717,1720,1723],{},[192,1715,1716],{},"Can the exported value change while in use?",[192,1718,1719],{},"No, the export is locked",[192,1721,1722],{},"Yes, silently",[192,1724,1725],{},"Managed with the parent",[26,1727,1728,1729,1731,1732,1734],{},"That strength column is the whole trade. ",[69,1730,816],{}," gives you referential integrity: CloudFormation refuses to delete the exporting stack, and refuses to change or remove an export that another stack imports. That protection is genuinely valuable and genuinely annoying, because it means you cannot rename a subnet export without first unwiring every consumer. ",[69,1733,826],{}," gives up the protection to buy cross-Region and cross-account reach, and resolves the value fresh on each operation.",[33,1736,1738],{"id":1737},"keeping-credentials-out-of-the-file","Keeping credentials out of the file",[26,1740,1741,1742,694],{},"Never put a password in a template. That is easy to agree with and easy to violate accidentally, so use the mechanism built for it: ",[44,1743,1744],{},"dynamic references",[62,1746,1748],{"className":64,"code":1747,"language":66,"meta":67,"style":67},"  AppDatabase:\n    Type: AWS::RDS::DBInstance\n    Properties:\n      MasterUsername: '{{resolve:ssm:/app/db/username}}'\n      MasterUserPassword: '{{resolve:secretsmanager:prod/app/db:SecretString:password}}'\n",[69,1749,1750,1756,1764,1770,1786],{"__ignoreMap":67},[72,1751,1752,1754],{"class":74,"line":75},[72,1753,1399],{"class":78},[72,1755,83],{"class":82},[72,1757,1758,1760,1762],{"class":74,"line":86},[72,1759,97],{"class":78},[72,1761,100],{"class":82},[72,1763,1410],{"class":103},[72,1765,1766,1768],{"class":74,"line":94},[72,1767,110],{"class":78},[72,1769,83],{"class":82},[72,1771,1772,1775,1777,1780,1783],{"class":74,"line":107},[72,1773,1774],{"class":78},"      MasterUsername",[72,1776,100],{"class":82},[72,1778,1779],{"class":724}," '",[72,1781,1782],{"class":103},"{{resolve:ssm:/app/db/username}}",[72,1784,1785],{"class":724},"'\n",[72,1787,1788,1791,1793,1795,1798],{"class":74,"line":115},[72,1789,1790],{"class":78},"      MasterUserPassword",[72,1792,100],{"class":82},[72,1794,1779],{"class":724},[72,1796,1797],{"class":103},"{{resolve:secretsmanager:prod/app/db:SecretString:password}}",[72,1799,1785],{"class":724},[26,1801,1802],{},"Three patterns exist:",[1804,1805,1806,1813,1819],"ul",{},[1807,1808,1809,1812],"li",{},[69,1810,1811],{},"{{resolve:ssm:parameter-name:version}}"," for a plaintext Parameter Store value.",[1807,1814,1815,1818],{},[69,1816,1817],{},"{{resolve:ssm-secure:parameter-name:version}}"," for a SecureString parameter.",[1807,1820,1821,1824],{},[69,1822,1823],{},"{{resolve:secretsmanager:secret-id:SecretString:json-key:version-stage:version-id}}"," for a Secrets Manager secret.",[26,1826,1827],{},"CloudFormation resolves the reference when it needs the value and never stores it. Rotate the secret and the next stack operation picks up the new value with no template change.",[26,1829,1830,1831,1834,1835,1838],{},"The limits are small but real: a template can hold up to 60 dynamic references, they are not supported in ",[69,1832,1833],{},"AWS::CloudFormation::Init"," metadata or in EC2 ",[69,1836,1837],{},"UserData",", and they are not resolved before a transform runs. A reference that ends in a backslash fails to resolve at all.",[33,1840,1842],{"id":1841},"resource-attributes-that-change-the-blast-radius","Resource attributes that change the blast radius",[26,1844,1845,1846,558,1848,1850],{},"Resource attributes sit next to ",[69,1847,204],{},[69,1849,208],{},", and they change what CloudFormation does to a resource rather than what the resource is.",[26,1852,1853,1858],{},[44,1854,1855],{},[69,1856,1857],{},"DeletionPolicy"," decides what happens when the resource leaves the stack.",[171,1860,1861,1870],{},[174,1862,1863],{},[177,1864,1865,1867],{},[180,1866,1565],{},[180,1868,1869],{},"Effect",[187,1871,1872,1882,1892,1905],{},[177,1873,1874,1879],{},[192,1875,1876],{},[69,1877,1878],{},"Delete",[192,1880,1881],{},"Delete the resource. The default for nearly every type.",[177,1883,1884,1889],{},[192,1885,1886],{},[69,1887,1888],{},"Retain",[192,1890,1891],{},"Keep the resource, remove it from CloudFormation's scope. It keeps billing.",[177,1893,1894,1899],{},[192,1895,1896],{},[69,1897,1898],{},"RetainExceptOnCreate",[192,1900,1901,1902,1904],{},"Behaves like ",[69,1903,1888],{},", except that a resource created by an operation that then rolls back is deleted.",[177,1906,1907,1912],{},[192,1908,1909],{},[69,1910,1911],{},"Snapshot",[192,1913,1914],{},"Take a snapshot, then delete. Supported on EBS volumes, RDS and DocumentDB and Neptune clusters and instances, ElastiCache clusters and replication groups, and Redshift clusters.",[26,1916,1917,1918,1921,1922,1925,1926,1929,1930,1932,1933,1935],{},"The exception that catches people: ",[69,1919,1920],{},"AWS::RDS::DBCluster",", and any ",[69,1923,1924],{},"AWS::RDS::DBInstance"," that does not specify ",[69,1927,1928],{},"DBClusterIdentifier",", default to ",[69,1931,1911],{},", not ",[69,1934,1878],{},". Delete such a stack and you get a surviving snapshot and a surviving bill.",[26,1937,1938,1943,1944,1946,1947,1949,1950,1953,1954,1957],{},[44,1939,1940],{},[69,1941,1942],{},"UpdateReplacePolicy"," does the same job for a different event. ",[69,1945,1857],{}," covers a resource being removed from the stack; ",[69,1948,1942],{}," covers a resource being replaced during an update, where CloudFormation creates a new physical resource and deletes the old one. Setting ",[69,1951,1952],{},"DeletionPolicy: Retain"," on a database and forgetting ",[69,1955,1956],{},"UpdateReplacePolicy: Retain"," leaves you protected against a stack delete and unprotected against the far more likely accidental replacement. Set both.",[62,1959,1961],{"className":64,"code":1960,"language":66,"meta":67,"style":67},"  AppDatabase:\n    Type: AWS::RDS::DBInstance\n    DeletionPolicy: Snapshot\n    UpdateReplacePolicy: Snapshot\n    Properties:\n      # ...\n",[69,1962,1963,1969,1977,1987,1996,2002],{"__ignoreMap":67},[72,1964,1965,1967],{"class":74,"line":75},[72,1966,1399],{"class":78},[72,1968,83],{"class":82},[72,1970,1971,1973,1975],{"class":74,"line":86},[72,1972,97],{"class":78},[72,1974,100],{"class":82},[72,1976,1410],{"class":103},[72,1978,1979,1982,1984],{"class":74,"line":94},[72,1980,1981],{"class":78},"    DeletionPolicy",[72,1983,100],{"class":82},[72,1985,1986],{"class":103}," Snapshot\n",[72,1988,1989,1992,1994],{"class":74,"line":107},[72,1990,1991],{"class":78},"    UpdateReplacePolicy",[72,1993,100],{"class":82},[72,1995,1986],{"class":103},[72,1997,1998,2000],{"class":74,"line":115},[72,1999,110],{"class":78},[72,2001,83],{"class":82},[72,2003,2004],{"class":74,"line":126},[72,2005,1390],{"class":606},[26,2007,2008,2012],{},[44,2009,2010],{},[69,2011,276],{}," attaches arbitrary data to a resource. It has one operational use worth remembering: CloudFormation does not treat a change to a deletion policy, update policy, condition, or output declaration as an update, so a template edit that touches only those produces \"No updates to be performed.\" Changing any metadata value gives CloudFormation something to see, and the update proceeds.",[26,2014,2015,558,2018,2021],{},[69,2016,2017],{},"CreationPolicy",[69,2019,2020],{},"UpdatePolicy",", the two attributes that control waiting for signals and rolling Auto Scaling updates, belong with stack operations and appear in the next lesson.",[33,2023,2025],{"id":2024},"exam-tips","Exam tips",[1804,2027,2028,2040,2043,2050,2053,2062,2072,2078,2087,2093],{},[1807,2029,2030,2032,2033,2035,2036,691,2038,694],{},[69,2031,585],{}," returns the resource's primary identifier; ",[69,2034,647],{}," returns any other attribute by name. If the stem needs an ARN and the type's ",[69,2037,585],{},[69,2039,687],{},[1807,2041,2042],{},"\"The same template must work in any Region or account\" points at pseudo parameters and AWS-specific or SSM parameter types, and away from hardcoded AMI IDs and account numbers.",[1807,2044,2045,2047,2048,694],{},[69,2046,816],{}," is same-account, same-Region only. A stem that mentions a second Region or a second account and asks for a stack output rules it out and points at ",[69,2049,826],{},[1807,2051,2052],{},"\"Cannot delete stack, export in use by another stack\" is expected behavior, not a bug. Remove the import first.",[1807,2054,2055,2058,2059,2061],{},[69,2056,2057],{},"NoEcho"," masks describe output. Any answer that treats it as encryption, or as protection for values you copied into ",[69,2060,249],{},", is wrong.",[1807,2063,2064,2065,482,2068,2071],{},"Sensitive values in a template means dynamic references (",[69,2066,2067],{},"ssm-secure",[69,2069,2070],{},"secretsmanager","), not parameters.",[1807,2073,2074,2075,2077],{},"The RDS ",[69,2076,1911],{}," default is a favorite. Read \"no DeletionPolicy specified\" plus \"RDS\" as a snapshot, and the same words plus \"S3 bucket\" as a delete.",[1807,2079,2080,2081,2083,2084,2086],{},"Set ",[69,2082,1942],{}," alongside ",[69,2085,1857],{}," whenever data is involved. Questions about a database that vanished during a routine update are testing exactly this.",[1807,2088,2089,2090,2092],{},"\"No updates to be performed\" after editing only a deletion policy, update policy, condition, or output is expected. The fix is to change a resource ",[69,2091,276],{}," value.",[1807,2094,2095,2097],{},[69,2096,1161],{}," is for ordering that no reference expresses. The internet gateway attachment and an Elastic IP is the canonical pair.",[26,2099,2100],{},"The idea to carry forward is that a template is a description of a desired end state plus a graph of relationships, and CloudFormation derives everything else from it: the order of creation, the order of deletion, what can run in parallel, and what has to change when you edit one line.",[26,2102,2103],{},"Which raises the question this lesson deliberately left open. You now have a template that creates a stack correctly the first time. The next lesson is about the second time and every time after: how to change a running stack without breaking it, how to see what an update will do before it does it, and what to do when someone has been editing your resources in the console.",[2105,2106,2107],"style",{},"html pre.shiki code .sQzsp, html code.shiki .sQzsp{--shiki-light:#E53935;--shiki-default:#22863A;--shiki-dark:#85E89D}html pre.shiki code .sP7_E, html code.shiki .sP7_E{--shiki-light:#39ADB5;--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sbsja, html code.shiki .sbsja{--shiki-light:#9C3EDA;--shiki-default:#D73A49;--shiki-dark:#F97583}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sutJx, html code.shiki .sutJx{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#6A737D;--shiki-default-font-style:inherit;--shiki-dark:#6A737D;--shiki-dark-font-style:inherit}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .syTEX, html code.shiki .syTEX{--shiki-light:#FF5370;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":67,"searchDepth":94,"depth":94,"links":2109},[2110,2111,2112,2113,2114,2115,2116,2117,2118,2119],{"id":35,"depth":86,"text":36},{"id":165,"depth":86,"text":166},{"id":327,"depth":86,"text":328},{"id":574,"depth":86,"text":575},{"id":932,"depth":86,"text":933},{"id":1165,"depth":86,"text":1166},{"id":1496,"depth":86,"text":1497},{"id":1737,"depth":86,"text":1738},{"id":1841,"depth":86,"text":1842},{"id":2024,"depth":86,"text":2025},"md",[2122],{"slug":1105,"concept":2123,"style":2124,"aspectRatio":2125,"labels":2126},"A directed graph showing how CloudFormation derives create order from references inside one template. Five resource nodes (VPC, internet gateway, gateway attachment, security group, EC2 instance) are arranged left to right in creation order, with solid arrows labelled by the function that created the edge (Ref or Fn::GetAtt) and one dashed arrow labelled DependsOn between two nodes that share no reference. A short band underneath marks which nodes CloudFormation can build in parallel because nothing connects them. The emphasis is the contrast between the solid implicit edges and the single dashed explicit one: references write the graph for you, and DependsOn exists only for the ordering a reference cannot express.","diagram","16:9",[2127,2128,2129,2130,2131,2132,2133,2134,2135,2136,2137],"Create order comes from references, not from template order","VPC","InternetGateway","AttachGateway: Ref VPC, Ref InternetGateway","WebSecurityGroup: Ref VPC","WebInstance: Ref WebSecurityGroup, Fn::GetAtt for the subnet","Solid edge: implicit dependency created by Ref or Fn::GetAtt","Dashed edge: DependsOn, declared by hand because no reference exists","Built in parallel: VPC and InternetGateway have no edge between them","Delete runs the graph backwards","If two resources must be ordered but never reference each other, only DependsOn can say so.",[13,14,15,16,17,18,19],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/02-infrastructure-as-code/01-cloudformation-fundamentals",{"passingScore":2142,"questions":2143},70,[2144,2153,2160,2170,2178,2186,2192,2200,2208],{"question":2145,"type":2146,"options":2147,"correctAnswer":2148,"explanation":2152},"A template declares an EC2 instance with the logical ID WebServer. After the stack is created, what does Ref return for that resource?","single",[2148,2149,2150,2151],"The instance ID, such as i-0abc123def456","The string WebServer","The private IP address of the instance","The ARN of the instance","Ref on a resource returns that resource type's primary identifier, which for AWS::EC2::Instance is the instance ID. The logical ID is only the name inside the template; the private IP and other attributes come from Fn::GetAtt, and each resource type documents exactly what Ref and GetAtt return.",{"question":2154,"type":2146,"options":2155,"correctAnswer":478,"explanation":2159},"A template must not launch a stack if the user types an instance type outside a short approved list. Which parameter setting enforces that before any resource is created?",[2156,2157,2158,478],"NoEcho set to true","A Condition that compares the parameter to each approved value","A Rules section entry using Fn::Contains","AllowedValues restricts a parameter to an explicit list and is checked before provisioning starts, so a bad value never reaches a resource. NoEcho only masks a value in describe output, and while conditions and rules can express complex validation, a simple approved list is exactly what AllowedValues exists for.",{"question":2161,"type":2162,"options":2163,"correctAnswers":2168,"explanation":2169},"Which statements about NoEcho are correct? (Choose 2.)","multiple",[2164,2165,2166,2167],"It masks the parameter value in describe-stacks and describe-stack-events output","It encrypts the parameter value at rest inside CloudFormation","It does not mask values placed in the Outputs or Metadata sections","It prevents the value from being used in resource properties",[2164,2166],"NoEcho is a display control: it replaces the value with asterisks in stack descriptions and events, and that is all. It does not encrypt anything, and anything you copy into Outputs, Metadata, or a resource Metadata attribute is shown in the clear, which is why real secrets belong in a dynamic reference instead.",{"question":2171,"type":2146,"options":2172,"correctAnswer":2175,"explanation":2177},"A template creates an Elastic IP and a VPC with an internet gateway. The Elastic IP must not be created until the gateway attachment exists, but no property of the Elastic IP references the attachment. What should you do?",[2173,2174,2175,2176],"Move the Elastic IP declaration below the attachment in the Resources section","Wrap the Elastic IP in a Condition that tests the attachment","Add a DependsOn attribute on the Elastic IP naming the attachment","Add the attachment's logical ID to the Elastic IP's Metadata attribute","CloudFormation derives ordering from references, so two resources that never reference each other may be built in parallel or in any order. DependsOn is the only way to declare an ordering that no Ref or Fn::GetAtt already implies, and the position of a resource in the Resources section has no effect at all.",{"question":2179,"type":2146,"options":2180,"correctAnswer":2181,"explanation":2185},"Which reference method lets a stack in us-east-1 read an output from a stack in eu-west-1?",[2181,2182,2183,2184],"Fn::GetStackOutput with the Region parameter set to eu-west-1","Fn::ImportValue against an export created in eu-west-1","A nested stack whose TemplateURL points at the eu-west-1 stack","Fn::FindInMap with a Region key","Fn::ImportValue only resolves exports in the same account and Region, which is the constraint most people trip on. Fn::GetStackOutput was added for exactly this gap: it reads any stack output by name, accepts a Region and a RoleArn for cross-account access, and needs no Export on the producing side.",{"question":2187,"type":2146,"options":2188,"correctAnswer":2190,"explanation":2191},"True or False: a stack whose export is imported by another stack can be deleted as long as the importing stack is not currently updating.",[2189,2190],"True","False","An export consumed by Fn::ImportValue is a strong reference, and CloudFormation blocks deletion of the exporting stack while any stack imports the value. That referential integrity is the main reason to choose Fn::ImportValue over Fn::GetStackOutput, whose weak reference gives you no such protection.",{"question":2193,"type":2146,"options":2194,"correctAnswer":2197,"explanation":2199},"An RDS DB instance is declared in a template with no DeletionPolicy attribute. The stack is deleted. What happens to the database?",[2195,2196,2197,2198],"It is deleted along with the rest of the stack","It is retained and removed from CloudFormation's scope","A snapshot is taken before it is deleted","The stack deletion fails because RDS resources require an explicit policy","The default DeletionPolicy is Delete for almost every resource type, but AWS::RDS::DBCluster and standalone AWS::RDS::DBInstance resources default to Snapshot instead. The exam likes this because the general rule and the exception point at different answers, and the snapshot keeps billing after the stack is gone.",{"question":2201,"type":2146,"options":2202,"correctAnswer":2206,"explanation":2207},"A template needs the value of a database password stored in Secrets Manager, and the password must never appear in the template or in stack history. Which approach fits?",[2203,2204,2205,2206],"A String parameter with NoEcho set to true, filled in at stack creation","A Mappings entry keyed by environment","An AWS::SSM::Parameter::Value\u003CString> parameter type pointing at a SecureString","A secretsmanager dynamic reference in the resource property","A dynamic reference is resolved by CloudFormation at deploy time and the value is never stored in the template or the stack, which is precisely the requirement. A NoEcho parameter still carries the real value through the API call, mappings are plaintext in the file, and CloudFormation does not support SecureString as a template parameter type.",{"question":2209,"type":2162,"options":2210,"correctAnswers":2215,"explanation":2216},"Which of the following are valid uses of a CloudFormation Mappings section? (Choose 2.)",[2211,2212,2213,2214],"Look up a Region-specific AMI ID with Fn::FindInMap","Store a database password keyed by environment name","Map an environment name to an instance type and a desired capacity","Retrieve the current value of a Parameter Store parameter",[2211,2213],"Mappings are a static lookup table inside the template, read with Fn::FindInMap, so they suit fixed per-Region or per-environment values. They are plain text in the file, which rules out secrets, and they cannot call out to another service, which is what dynamic references and SSM parameter types are for.",{"title":7,"description":8},"courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/02-infrastructure-as-code/01-cloudformation-fundamentals","rJEYQ4PGxckzmumgCpLnWC9R-HvWvheALpmbsW2a35U",{"locked":9,"reason":2221,"meta":2222,"item":3},"paywall",{"title":2223,"description":2224,"isFree":5,"estimatedMinutes":2225,"difficulty":2226,"learningObjectives":2227},"Troubleshooting CloudFormation Deployments","A method for failed deployments: find the first failure in the stack events, read the status reason, and match it to its class - permissions, capacity and subnet sizing, missing signals, resources that never stabilize, and rollbacks that themselves fail.",28,"advanced",[2228,2229,2230,2231,2232,2233,2234],"Locate the root cause of a failed deployment by reading stack events from the first failure","Map a stack status to the operations it still permits, including ROLLBACK_COMPLETE and UPDATE_ROLLBACK_FAILED","Diagnose permission failures and distinguish caller permissions from service role permissions","Calculate usable subnet capacity and recognize deployment failures caused by address exhaustion or service quotas","Explain why a CreationPolicy times out and where to find the evidence on the instance","Recover a stack from UPDATE_ROLLBACK_FAILED, and state the consequence of skipping resources","Select the right pre-deployment tool to catch a class of failure before it reaches AWS",{"locked":9,"reason":2221,"meta":2236,"item":3},{"title":2237,"description":2238,"isFree":5,"estimatedMinutes":10,"difficulty":11,"learningObjectives":2239},"CloudFormation Stack Operations","Changing a running stack without breaking it: the three update behaviors, change sets, stack policies, signals and rolling updates, rollback options and triggers, drift detection, nested stacks, and importing existing resources.",[2240,2241,2242,2243,2244,2245,2246],"Classify an update as no interruption, some interruption, or replacement, and predict the effect on the physical ID","Use a change set to preview an update, and state what a change set cannot promise","Write a stack policy that protects a critical resource, and explain why it is not a substitute for IAM","Configure CreationPolicy and UpdatePolicy so a stack waits for the application rather than the API","Choose between automatic rollback, preserved resources, and rollback triggers for a given deployment","Interpret drift detection results and name the cases where drift cannot be detected","Compare nested stacks with separate stacks joined by cross-stack references"]