Optimize AWS CloudFormation Templates

CloudFormation Best Practices is a skill for writing and reviewing production-grade AWS CloudFormation templates, optimizing them for maintainability and cost, and designing nested or cross-stack architectures. Its core instructions: prefer YAML over JSON for readability, parameterize environment-specific values and use Mappings for static lookups, apply DeletionPolicy: Retain on stateful resources (RDS, S3, DynamoDB), use Conditions to support multi-environment templates from one source, validate templates with aws cloudformation validate-template before deploying, and prefer !Sub over !Join for string interpolation.

Use it for writing/reviewing CloudFormation templates, optimizing existing ones, designing nested/cross-stack architectures (like a AWS::EC2::VPC resource with an environment-conditional !Sub name tag), or troubleshooting stack creation/update failures and drift. It is not the right skill when the user prefers CDK or Terraform over raw CloudFormation, or when the task is application code rather than infrastructure.

A worked example shows a parameterized VPC template using an environment-conditional pattern:

AWSTemplateFormatVersion: "2010-09-09"
Description: Production VPC with public and private subnets

Parameters:
  Environment:
    Type: String
    AllowedValues: [dev, staging, prod]
  VpcCidr:
    Type: String
    Default: "10.0.0.0/16"

Conditions:
  IsProd: !Equals [!Ref Environment, prod]

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-vpc"

Outputs:
  VpcId:
    Value: !Ref VPC
    Export:
      Name: !Sub "${Environment}-VpcId"

Best practices call for Outputs with Export for cross-stack references, DeletionPolicy and UpdateReplacePolicy on every stateful resource, and cfn-lint/cfn-nag wired into CI pipelines - while avoiding hardcoded ARNs/account IDs (use !Sub with pseudo parameters instead) and monolithic single-template designs. For a stack stuck in UPDATE_ROLLBACK_FAILED, the fix is continue-update-rollback with --resources-to-skip for the failing resource, followed by addressing the underlying cause.

Infrastructure engineers writing or maintaining AWS CloudFormation templates for stateful resources like RDS, S3, and DynamoDB who want production-grade defaults - parameterization, deletion protection, multi-environment support, and CI-linted templates - rather than ad hoc YAML.