Design and Optimize AWS CloudFormation Templates

Provides expert guidance for designing, optimizing, and maintaining AWS CloudFormation templates - deep knowledge of CloudFormation syntax, built-in functions, resource properties, and architectural patterns for building scalable, maintainable infrastructure as code.

Use this skill when structuring a new CloudFormation template, applying intrinsic functions for dynamic values, wiring cross-stack references, hardening IAM policies and resource security, building custom resources or nested stacks, or setting up template validation and multi-account deployment.

Basic template structure follows a consistent section order - AWSTemplateFormatVersion, Description, Metadata (including AWS::CloudFormation::Interface parameter grouping for the console UI), Parameters (with AllowedValues), Mappings (environment-keyed lookups like instance type by environment), Conditions (e.g. IsProd), Resources, and Outputs with Export.

Intrinsic function patterns covered: dynamic resource naming via !Sub '${AWS::StackName}-${Environment}-data-${AWS::AccountId}'; conditional resource creation gated by a Condition; !FindInMap for environment-specific lookups; and complex string manipulation for EC2 UserData via Fn::Base64/!Sub. Cross-stack references export values with Outputs.Export.Name in one stack and consume them with !ImportValue in another.

Security and compliance best practices: IAM execution roles scoped with AssumeRolePolicyDocument and least-privilege inline policies (e.g. S3 GetObject/PutObject scoped to a specific bucket ARN); encryption at rest via StorageEncrypted/KmsKeyId on RDS; and restrictive security groups that only allow traffic from a specific source security group rather than open CIDR ranges.

Advanced resource patterns: custom resources backed by a Lambda function (AWS::CloudFormation::CustomResource with a ServiceToken, using cfnresponse to signal success/failure back to CloudFormation); and nested stacks (AWS::CloudFormation::Stack with TemplateURL, passing parameters and consuming another stack's Outputs via !GetAtt, ordered with DependsOn).

Optimization and maintenance guidance: keep templates under 1MB and use nested stacks for larger architectures, group related resources logically, use consistent naming conventions with prefixes/suffixes, and implement a coherent tagging strategy. Parameter validation uses AllowedPattern with regex (e.g. validating a VPC CIDR) and AllowedValues for constrained choices like instance type. Error handling and rollback rely on DeletionPolicy/UpdateReplacePolicy (e.g. Snapshot for critical databases) for protecting critical resources, correct DependsOn ordering, and Conditions for optional resource handling.

Testing and deployment strategy: validate templates with aws cloudformation validate-template and CloudFormation Linter (cfn-lint), enforce compliance with AWS Config Rules, monitor drift detection for ongoing maintenance, and use StackSets for multi-account/multi-region deployments with proper CI/CD pipelines for staged rollouts and automated testing.

Built entirely on AWS CloudFormation's own primitives (AWS::CloudFormation::Stack, AWS::CloudFormation::CustomResource, StackSets), IAM, RDS, EC2, S3, Lambda, and tooling like cfn-lint and AWS Config Rules.

AWS infrastructure engineers designing or maintaining CloudFormation templates who need concrete patterns for cross-stack references, IAM security, nested stacks, custom resources, and multi-account deployment rather than assembling CloudFormation syntax from the AWS docs alone.