DevOps-Security-Agent-Skills/infrastructure/cloud-aws/cloudformation/SKILL.md

name, description, license, metadata

name	description	license	metadata
cloudformation	Deploy AWS resources with CloudFormation templates. Create stacks, use nested stacks, and implement drift detection. Use when deploying AWS-native IaC.	MIT	author version devops-skills 1.0

CloudFormation

Deploy AWS infrastructure with native CloudFormation templates.

Template Structure

AWSTemplateFormatVersion: '2010-09-09'
Description: Web application stack

Parameters:
  Environment:
    Type: String
    AllowedValues: [dev, staging, prod]
    
Resources:
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref AMI
      InstanceType: t3.micro
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-web'
          
Outputs:
  InstanceId:
    Value: !Ref WebServer
    Export:
      Name: !Sub '${Environment}-WebServerId'

Stack Operations

# Create stack
aws cloudformation create-stack \
  --stack-name myapp \
  --template-body file://template.yaml \
  --parameters ParameterKey=Environment,ParameterValue=prod

# Update stack
aws cloudformation update-stack \
  --stack-name myapp \
  --template-body file://template.yaml

# Delete stack
aws cloudformation delete-stack --stack-name myapp

# Detect drift
aws cloudformation detect-stack-drift --stack-name myapp

Intrinsic Functions

# Reference
!Ref MyResource

# Get attribute
!GetAtt MyResource.Arn

# Substitute
!Sub 'arn:aws:s3:::${BucketName}/*'

# Conditional
!If [CreateProdResources, 't3.large', 't3.micro']

# Join
!Join ['-', [!Ref Environment, 'app', 'bucket']]

Best Practices

• Use change sets before updates
• Implement stack policies
• Use nested stacks for modularity
• Enable termination protection
• Use cfn-lint for validation

Related Skills

• terraform-aws - Alternative IaC
• aws-iam - IAM resources