Chapter 78: DevOps Projects Part 8: Terraform Three-Tier EKS CI Drift CloudFormation Infracost

78.5 Project 59: AWS CloudFormation stack beside Terraform

By Ravindra Bagale Last updated: 28 October 2026

Friends, many companies still run CloudFormation. Today we write a small YAML template for an S3 bucket, package the stack commands, compare the mental model to Terraform, and note when to leave an old stack alone.

What you will build in this project

cloudformation YAML template.
create-stack and describe tips.
Side-by-side compare notes.
Leave-alone rule for brownfield CFN.

1. Start from a real company story

At Infosys in Pune, a Terraform rewrite of a working billing CloudFormation stack missed one export and broke three child stacks.

Billing jobs failed overnight. Rough cost: about ₹30 lakh in reruns and client credits.

Leena made a rule: new greenfield uses Terraform; working CFN stacks get change sets, not surprise rewrites.

Today we learn enough CFN to work beside it.

Picture 1: template.yaml → create-stack → change set → update or leave alone

Ravindra Bagale's Tip

Students delete a CloudFormation stack to recreate it in Terraform without a migration plan. Exports break. Keep that habit of change sets first.

2. Start and prepare

Step 1: Why learn CFN

Why: Brownfield exists. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'CloudFormation is AWS-native IaC still common in older accounts'

You will see:

CloudFormation is AWS-native IaC still common in older accounts

What it means: Why.

Example 2: a2

Type this:

mkdir -p /tmp/cfn59 && printf '%s\n' 'Rule: greenfield Terraform; working CFN gets change sets first' > /tmp/cfn59/RULE.txt && cat /tmp/cfn59/RULE.txt

You will see:

Rule: greenfield Terraform; working CFN gets change sets first

What it means: Rule.

Example 3: a3

Type this:

echo 'Today we write a tiny S3 template and the command loop'

You will see:

Today we write a tiny S3 template and the command loop

What it means: Scope.

Step 2: Template header

Why: AWSTemplateFormatVersion. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf template. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' 'AWSTemplateFormatVersion: "2010-09-09"' 'Description: tf59 lab bucket' 'Resources:' '  LabBucket:' '    Type: AWS::S3::Bucket' '    Properties:' '      BucketName: shop-cfn-111122223333-tf59' '      PublicAccessBlockConfiguration:' '        BlockPublicAcls: true' '        BlockPublicPolicy: true' '        IgnorePublicAcls: true' '        RestrictPublicBuckets: true' '      Tags:' '        - Key: Name' '          Value: shop-cfn' > /tmp/cfn59/template.yaml && wc -l /tmp/cfn59/template.yaml

You will see:

16 /tmp/cfn59/template.yaml

What it means: Template written.

Example 5: b2

Type this:

grep Type /tmp/cfn59/template.yaml

You will see:

Type: AWS::S3::Bucket

What it means: Resource type.

Example 6: b3

Type this:

echo 'YAML indentation matters — two spaces per level in this lab'

You will see:

YAML indentation matters — two spaces per level in this lab

What it means: YAML tip.

Step 3: Validate tip

Why: aws cloudformation validate-template. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo command. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

echo 'aws cloudformation validate-template --template-body file://template.yaml'

You will see:

aws cloudformation validate-template --template-body file://template.yaml

What it means: Validate.

Example 8: c2

Type this:

echo 'Fix YAML errors before create-stack'

You will see:

Fix YAML errors before create-stack

What it means: Order.

Example 9: c3

Type this:

echo 'Template body must be under the service size limits or use S3 upload'

You will see:

Template body must be under the service size limits or use S3 upload

What it means: Size tip.

3. Build the main pieces

Step 4: create-stack

Why: Deploy the stack. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo create. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

echo 'aws cloudformation create-stack --stack-name shop-cfn-lab --template-body file://template.yaml --tags Key=Project,Value=lab'

You will see:

aws cloudformation create-stack --stack-name shop-cfn-lab --template-body file://template.yaml --tags Key=Project,Value=lab

What it means: Create.

Example 11: d2

Type this:

echo 'aws cloudformation describe-stacks --stack-name shop-cfn-lab --query Stacks[0].StackStatus'

You will see:

aws cloudformation describe-stacks --stack-name shop-cfn-lab --query Stacks[0].StackStatus

What it means: Status.

Example 12: d3

Type this:

echo 'Wait for CREATE_COMPLETE before using the bucket'

You will see:

Wait for CREATE_COMPLETE before using the bucket

What it means: Wait tip.

Step 5: change set

Why: CFN plan equivalent. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo change-set. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

echo 'aws cloudformation create-change-set --stack-name shop-cfn-lab --change-set-name add-tag --template-body file://template.yaml'

You will see:

aws cloudformation create-change-set --stack-name shop-cfn-lab --change-set-name add-tag --template-body file://template.yaml

What it means: Create change set.

Example 14: e2

Type this:

echo 'aws cloudformation describe-change-set --stack-name shop-cfn-lab --change-set-name add-tag'

You will see:

aws cloudformation describe-change-set --stack-name shop-cfn-lab --change-set-name add-tag

What it means: Review.

Example 15: e3

Type this:

echo 'execute-change-set only after humans read the changes'

You will see:

execute-change-set only after humans read the changes

What it means: Execute tip.

Step 6: Compare TF

Why: Mental model map. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: COMPARE.txt. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' 'CloudFormation          Terraform' 'template.yaml           *.tf' 'create-change-set       terraform plan' 'execute-change-set      terraform apply' 'stack                   root module + state' 'Exports/Imports         remote state outputs' > /tmp/cfn59/COMPARE.txt && cat /tmp/cfn59/COMPARE.txt

You will see:

create-change-set       terraform plan

What it means: Compare table.

Example 17: f2

Type this:

echo 'Both need remote collaboration rules and least privilege IAM'

You will see:

Both need remote collaboration rules and least privilege IAM

What it means: Shared needs.

Example 18: f3

Type this:

echo 'Terraform is multi-cloud; CFN is deepest on AWS-only features sometimes'

You will see:

Terraform is multi-cloud; CFN is deepest on AWS-only features sometimes

What it means: Trade-off.

4. Automate and verify

Step 7: Outputs exports

Why: Stack outputs. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: Outputs section tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

printf '%s\n' 'Outputs:' '  BucketName:' '    Value: !Ref LabBucket' '    Export:' '      Name: shop-cfn-lab-bucket' >> /tmp/cfn59/template.yaml && tail -6 /tmp/cfn59/template.yaml

You will see:

Export:

What it means: Export name.

Example 20: g2

Type this:

echo 'Other stacks Fn::ImportValue the export name'

You will see:

Other stacks Fn::ImportValue the export name

What it means: ImportValue tip.

Example 21: g3

Type this:

echo 'Deleting a stack with active exports fails until children release them'

You will see:

Deleting a stack with active exports fails until children release them

What it means: Export danger.

Step 8: delete tip

Why: Careful teardown. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo delete. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'aws cloudformation delete-stack --stack-name shop-cfn-lab'

You will see:

aws cloudformation delete-stack --stack-name shop-cfn-lab

What it means: Delete.

Example 23: h2

Type this:

echo 'Empty the bucket first if retention rules block delete'

You will see:

Empty the bucket first if retention rules block delete

What it means: Empty tip.

Example 24: h3

Type this:

echo 'Do not delete a billing stack to recreate it in Terraform without a written plan'

You will see:

Do not delete a billing stack to recreate it in Terraform without a written plan

What it means: Rewrite warning.

Step 9: When to leave alone

Why: Brownfield rule. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: LEAVE.txt. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

printf '%s\n' 'Leave CFN alone when:' '- stack is stable and exports are many' '- team only knows CFN change sets' '- migration cost exceeds benefit this quarter' > /tmp/cfn59/LEAVE.txt && cat /tmp/cfn59/LEAVE.txt

You will see:

- stack is stable and exports are many

What it means: Leave-alone.

Example 26: i2

Type this:

echo 'New modules and new accounts can still start in Terraform'

You will see:

New modules and new accounts can still start in Terraform

What it means: Greenfield.

Example 27: i3

Type this:

echo 'Document the choice in the architecture decision record'

You will see:

Document the choice in the architecture decision record

What it means: ADR tip.

5. Harden and accept

Step 10: Local proof

Why: Files exist. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: list. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

ls /tmp/cfn59

You will see:

COMPARE.txt\nLEAVE.txt\nRULE.txt\ntemplate.yaml

What it means: Artifacts.

Example 29: j2

Type this:

head -2 /tmp/cfn59/template.yaml

You will see:

AWSTemplateFormatVersion: "2010-09-09"\nDescription: tf59 lab bucket

What it means: Header ok.

Example 30: j3

Type this:

grep BlockPublicAcls /tmp/cfn59/template.yaml

You will see:

BlockPublicAcls: true

What it means: Public block set.

Step 11: Acceptance

Why: Leena signs off. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

cat /tmp/cfn59/RULE.txt

You will see:

Rule: greenfield Terraform; working CFN gets change sets first

What it means: Rule.

Example 32: k2

Type this:

echo 'Change set equals plan; execute equals apply'

You will see:

Change set equals plan; execute equals apply

What it means: Model.

Example 33: k3

Type this:

echo 'Leena: PASS'

You will see:

Leena: PASS

What it means: Accepted.

Step 12: Bridge

Why: Next Infracost. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: bridge. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'You can read CFN stacks without rewriting them'

You will see:

You can read CFN stacks without rewriting them

What it means: Skill.

Example 35: z2

Type this:

echo 'Keep COMPARE.txt in the team wiki'

You will see:

Keep COMPARE.txt in the team wiki

What it means: Habit.

Example 36: z3

Type this:

echo 'Next: cost estimate with Infracost — project 60'

You will see:

Next: cost estimate with Infracost — project 60

What it means: Bridge.

Check yourself

Q1. Who set Infosys CFN rule?

Leena

Q2. CFN review object?

change set

Q3. Terraform dry run?

plan

Q4. Greenfield default?

Terraform

Q5. Delete working CFN casually?

Q6. Template language in lab?

YAML

Friends, you wrote a CloudFormation template and compared it to Terraform. Did you understand? Let us try it once more. Add a Parameters section for the bucket name prefix.

Lab: try at home

Write template.yaml.
Document stack commands.
Compare to Terraform.
Write leave-alone rule.

Recap

CFN is AWS-native IaC.
Templates declare Resources.
Change sets are the plan.
Exports link stacks.
Do not rewrite working stacks casually.