Managing Cloudformation

CloudFormation Management Skill

Manage and inspect AWS CloudFormation stacks, change sets, and templates.

MANDATORY: Discovery-First Pattern

Always list stacks and check stack status before modifying infrastructure.

Phase 1: Discovery

#!/bin/bash

echo "=== Active Stacks ==="
aws cloudformation list-stacks \
    --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE UPDATE_ROLLBACK_COMPLETE ROLLBACK_COMPLETE \
    --query 'StackSummaries[].{Name:StackName,Status:StackStatus,Updated:LastUpdatedTime}' \
    --output table 2>/dev/null | head -30

echo ""
echo "=== Failed Stacks ==="
aws cloudformation list-stacks \
    --stack-status-filter CREATE_FAILED UPDATE_FAILED DELETE_FAILED ROLLBACK_FAILED \
    --query 'StackSummaries[].{Name:StackName,Status:StackStatus,Reason:StackStatusReason}' \
    --output table 2>/dev/null

echo ""
echo "=== Stack Sets ==="
aws cloudformation list-stack-sets \
    --status ACTIVE \
    --query 'Summaries[].{Name:StackSetName,Status:Status}' \
    --output table 2>/dev/null | head -15

Core Helper Functions

#!/bin/bash

# CloudFormation API wrapper
cfn_cmd() {
    aws cloudformation "$@" --output json 2>/dev/null
}

# Get stack status
cfn_status() {
    local stack="$1"
    cfn_cmd describe-stacks --stack-name "$stack" \
        --query 'Stacks[0].StackStatus' --output text
}

# Get stack events (most recent)
cfn_events() {
    local stack="$1"
    local limit="${2:-10}"
    cfn_cmd describe-stack-events --stack-name "$stack" \
        --query "StackEvents[:${limit}]"
}

Output Rules

• TOKEN EFFICIENCY: Target <=50 lines per output
• Use --query (JMESPath) to filter AWS CLI output
• Use --output table for human-readable summaries
• Never dump full templates -- extract specific resources

Common Operations

Stack Inspection and Resources

#!/bin/bash
STACK_NAME="${1:?Stack name required}"

echo "=== Stack Details ==="
aws cloudformation describe-stacks --stack-name "$STACK_NAME" \
    --query 'Stacks[0].{Name:StackName,Status:StackStatus,Created:CreationTime,Updated:LastUpdatedTime,Description:Description}' \
    --output table 2>/dev/null

echo ""
echo "=== Stack Resources ==="
aws cloudformation list-stack-resources --stack-name "$STACK_NAME" \
    --query 'StackResourceSummaries[].{Logical:LogicalResourceId,Type:ResourceType,Status:ResourceStatus}' \
    --output table 2>/dev/null | head -30

echo ""
echo "=== Stack Outputs ==="
aws cloudformation describe-stacks --stack-name "$STACK_NAME" \
    --query 'Stacks[0].Outputs[].{Key:OutputKey,Value:OutputValue}' \
    --output table 2>/dev/null

echo ""
echo "=== Stack Parameters ==="
aws cloudformation describe-stacks --stack-name "$STACK_NAME" \
    --query 'Stacks[0].Parameters[].{Key:ParameterKey,Value:ParameterValue}' \
    --output table 2>/dev/null

Change Set Management

#!/bin/bash
STACK_NAME="${1:?Stack name required}"
TEMPLATE="${2:?Template file or URL required}"

echo "=== Creating Change Set ==="
CHANGE_SET_NAME="review-$(date +%s)"
aws cloudformation create-change-set \
    --stack-name "$STACK_NAME" \
    --change-set-name "$CHANGE_SET_NAME" \
    --template-body "file://${TEMPLATE}" \
    --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
    --output json 2>/dev/null | jq '{Id: .Id, StackId: .StackId}'

echo "Waiting for change set to be created..."
aws cloudformation wait change-set-create-complete \
    --stack-name "$STACK_NAME" \
    --change-set-name "$CHANGE_SET_NAME" 2>/dev/null

echo ""
echo "=== Change Set Details ==="
aws cloudformation describe-change-set \
    --stack-name "$STACK_NAME" \
    --change-set-name "$CHANGE_SET_NAME" \
    --query 'Changes[].{Action:ResourceChange.Action,Resource:ResourceChange.LogicalResourceId,Type:ResourceChange.ResourceType,Replacement:ResourceChange.Replacement}' \
    --output table 2>/dev/null

Drift Detection

#!/bin/bash
STACK_NAME="${1:?Stack name required}"

echo "=== Initiating Drift Detection ==="
DETECT_ID=$(aws cloudformation detect-stack-drift \
    --stack-name "$STACK_NAME" \
    --query 'StackDriftDetectionId' --output text 2>/dev/null)

echo "Detection ID: $DETECT_ID"
echo "Waiting for detection to complete..."
sleep 10

echo ""
echo "=== Drift Status ==="
aws cloudformation describe-stack-drift-detection-status \
    --stack-drift-detection-id "$DETECT_ID" \
    --query '{Status:DetectionStatus,DriftStatus:StackDriftStatus,DriftedResources:DriftedStackResourceCount}' \
    --output table 2>/dev/null

echo ""
echo "=== Drifted Resources ==="
aws cloudformation describe-stack-resource-drifts \
    --stack-name "$STACK_NAME" \
    --stack-resource-drift-status-filters MODIFIED DELETED \
    --query 'StackResourceDrifts[].{Resource:LogicalResourceId,Type:ResourceType,Status:StackResourceDriftStatus}' \
    --output table 2>/dev/null

Template Validation

#!/bin/bash
TEMPLATE="${1:?Template file required}"

echo "=== Template Validation ==="
aws cloudformation validate-template \
    --template-body "file://${TEMPLATE}" \
    --query '{Parameters:Parameters[].ParameterKey,Capabilities:Capabilities,Description:Description}' \
    --output json 2>/dev/null

echo ""
echo "=== Resource Types in Template ==="
cat "$TEMPLATE" | python3 -c "
import sys, json, yaml
try:
    tpl = yaml.safe_load(sys.stdin) or json.load(open('$TEMPLATE'))
except:
    tpl = json.load(open('$TEMPLATE'))
resources = tpl.get('Resources', {})
for name, r in resources.items():
    print(f\"{name}: {r['Type']}\")
" 2>/dev/null | head -30

Event Troubleshooting

#!/bin/bash
STACK_NAME="${1:?Stack name required}"

echo "=== Recent Stack Events ==="
aws cloudformation describe-stack-events --stack-name "$STACK_NAME" \
    --query 'StackEvents[:20].{Time:Timestamp,Resource:LogicalResourceId,Status:ResourceStatus,Reason:ResourceStatusReason}' \
    --output table 2>/dev/null

echo ""
echo "=== Failed Events ==="
aws cloudformation describe-stack-events --stack-name "$STACK_NAME" \
    --query 'StackEvents[?contains(ResourceStatus,`FAILED`)].{Time:Timestamp,Resource:LogicalResourceId,Reason:ResourceStatusReason}' \
    --output table 2>/dev/null | head -20

Safety Rules

• NEVER delete stacks without explicit user confirmation -- use --retain-resources if needed
• Always use change sets for production stacks instead of direct update-stack
• Enable termination protection on critical stacks
• Use --capabilities CAPABILITY_IAM only when template creates IAM resources
• Review change set before executing -- replacement operations destroy and recreate resources

Output Format

Present results as a structured report:

Managing Cloudformation Report
══════════════════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Anti-Hallucination Rules

1. NEVER assume resource names — always discover via CLI/API in Phase 1 before referencing in Phase 2.
2. NEVER fabricate metric names or dimensions — verify against the service documentation or --help output.
3. NEVER mix CLI commands between service versions — confirm which version/API you are targeting.
4. ALWAYS use the discovery → verify → analyze chain — every resource referenced must have been discovered first.
5. ALWAYS handle empty results gracefully — an empty response is valid data, not an error to retry.

Counter-Rationalizations

Common Pitfalls

• ROLLBACK_COMPLETE state: Stack cannot be updated -- must be deleted and recreated
• Circular dependencies: Resources referencing each other cause creation failures -- use DependsOn carefully
• Resource limits: AWS has limits on resources per stack (500) -- use nested stacks for large deployments
• IAM capabilities: Forgetting CAPABILITY_IAM causes immediate failure on IAM-containing templates
• Export/Import dependencies: Cannot delete a stack whose exports are imported by other stacks
• Drift false positives: Some resources show drift due to AWS-managed fields (e.g., default security group rules)
• Template size limit: Direct upload limited to 51,200 bytes -- use S3 for larger templates
• Stack set drift: Individual stack instances in a stack set can drift independently