CloudFormation Stack

Amazon Web Services
CloudFormation is a service provided by Amazon Web Services (AWS) that enables users to provision and manage a collection of related AWS resources as a single unit, called a "stack". A CloudFormation stack is a collection of AWS resources that you can manage and provision as a single unit. A stack can include a wide range of AWS resources, such as Amazon EC2 instances, Amazon RDS databases, Amazon S3 buckets, and other AWS resources. When you create a stack, you define the resources that should be included, as well as any dependencies between them. CloudFormation then takes care of provisioning and configuring those resources in the correct order. You can use CloudFormation to create, update, or delete a stack, and AWS will ensure that all resources in the stack are in the desired state. This makes it easier to manage complex applications and infrastructures, as you can create a stack once and then deploy it repeatedly, consistently and predictably.
Terraform Name
CloudFormation Stack

The following arguments are supported:

  • name - (Required) Stack name.
  • template_body - (Optional) Structure containing the template body (max size: 51,200 bytes).
  • template_url - (Optional) Location of a file containing the template body (max size: 460,800 bytes).
  • capabilities - (Optional) A list of capabilities. Valid values: CAPABILITY_IAM, CAPABILITY_NAMED_IAM, or CAPABILITY_AUTO_EXPAND
  • disable_rollback - (Optional) Set to true to disable rollback of the stack if stack creation failed. Conflicts with on_failure.
  • notification_arns - (Optional) A list of SNS topic ARNs to publish stack related events.
  • on_failure - (Optional) Action to be taken if stack creation fails. This must be one of: DO_NOTHING, ROLLBACK, or DELETE. Conflicts with disable_rollback.
  • parameters - (Optional) A map of Parameter structures that specify input parameters for the stack.
  • policy_body - (Optional) Structure containing the stack policy body. Conflicts w/ policy_url.
  • policy_url - (Optional) Location of a file containing the stack policy. Conflicts w/ policy_body.
  • tags - (Optional) Map of resource tags to associate with this stack. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
  • iam_role_arn - (Optional) The ARN of an IAM role that AWS CloudFormation assumes to create the stack. If you don't specify a value, AWS CloudFormation uses the role that was previously associated with the stack. If no role is available, AWS CloudFormation uses a temporary session that is generated from your user credentials.
  • timeout_in_minutes - (Optional) The amount of time that can pass before the stack status becomes CREATE_FAILED.

Associating resources with a
CloudFormation Stack
Resources do not "belong" to a
CloudFormation Stack
Rather, one or more Security Groups are associated to a resource.
CloudFormation Stack
via Terraform:
The following HCL creates a CloudFormation Stack resource.

resource "aws_cloudformation_stack" "network" {
 name = "networking-stack"

 parameters = {
   VPCCidr = ""

 template_body = jsonencode({
   Parameters = {
     VPCCidr = {
       Type        = "String"
       Default     = ""
       Description = "Enter the CIDR block for the VPC. Default is"

   Resources = {
     myVpc = {
       Type = "AWS::EC2::VPC"
       Properties = {
         CidrBlock = {
           "Ref" = "VPCCidr"
         Tags = [
             Key   = "Name"
             Value = "Primary_CF_VPC"

CloudFormation Stack
via CLI:

--stack-name <value>
[--template-body <value>]
[--template-url <value>]
[--parameters <value>]
[--disable-rollback | --no-disable-rollback]
[--rollback-configuration <value>]
[--timeout-in-minutes <value>]
[--notification-arns <value>]
[--capabilities <value>]
[--resource-types <value>]
[--role-arn <value>]
[--on-failure <value>]
[--stack-policy-body <value>]
[--stack-policy-url <value>]
[--tags <value>]
[--client-request-token <value>]
[--enable-termination-protection | --no-enable-termination-protection]
[--cli-input-json <value>]
[--generate-cli-skeleton <value>]
[--endpoint-url <value>]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]


aws cloudformation create-stack --stack-name myteststack --template-body file://sampletemplate.json --parameters ParameterKey=KeyPairName,ParameterValue=TestKey ParameterKey=SubnetIDs,ParameterValue=SubnetID1\\,SubnetID2

aws cost
There is no additional cost for using AWS CloudFormation itself. However, you will be charged for the AWS resources that are created and managed by CloudFormation, such as EC2 instances, RDS databases, S3 buckets, etc. The cost of these resources will depend on various factors such as the type and number of resources you use, the region where they are deployed, and the duration of their use. You can estimate the cost of a CloudFormation stack by adding up the cost of the individual resources that are part of the stack.
Direct Cost


Best Practices for
CloudFormation Stack

Categorized by Availability, Security & Compliance and Cost

Access allowed from VPN
No items found.
Auto Scaling Group not in use
No items found.
Connections towards DynamoDB should be via VPC endpoints
No items found.
Container in CrashLoopBackOff state
No items found.
EC2 with GPU capabilities
No items found.
EC2 with high privileged policies
No items found.
ECS cluster delete alarm
No items found.
ECS task with Admin access (*:*)
ECS task with high privileged policies
No items found.
EKS cluster delete alarm
No items found.
ElastiCache cluster delete alarm
No items found.
Ensure Container liveness probe is configured
No items found.
Ensure ECS task definition has memory limit
No items found.
Ensure EMR cluster master nodes are not publicly accessible
No items found.
More from
Amazon Web Services