What's changed: In-scope coverage: added compute/scaling/storage (EC2 Auto Scaling/AWS Auto Scaling/ECS/Fargate/Lambda/S3)
4.3Automating Networks with IaC
Make networks reproducible in code—understand CloudFormation, CDK, Terraform, change sets/drift detection, and repeatable deployments. Eliminate manual click-ops drift.
Defining networks (VPC, subnets, routes, SGs, endpoints, TGW) as IaC (Infrastructure as Code) makes them repeatable, consistent, and auditable, preventing manual configuration drift.
4.3.1IaC tools and benefits
- CloudFormation: AWS-native declarative templates (YAML/JSON). Preview diffs with change sets before applying.
- CDK: author in a programming language to synthesize CloudFormation; easy to reuse.
- Terraform: multi-cloud IaC; manages resources via state.
- Drift detection: detect whether the live environment deviates from the template to preserve reproducibility.
Common on ANS-C01: build networks repeatably and consistently = IaC (CloudFormation/CDK/Terraform), preview diffs before applying = change sets, and detect manual deviation = drift detection. Manage production networks via IaC, avoiding manual click-ops changes.
ANS-C01 tests rolling out the same network across an organization. For a single account use CloudFormation stacks; to deploy across many accounts/Regions at once use StackSets, and with AWS Organizations integration you can auto-provision baseline networking (VPC, subnets, routes, endpoints) when a new account is created. Sharing matters too: with AWS RAM (Resource Access Manager) you can share a Transit Gateway, subnets, or Route 53 Resolver rules to other accounts so they use centrally defined networking instead of each building their own. A network-specific pitfall: CloudFormation can fail on ordering unless you make resource dependencies explicit with DependsOn or references (e.g., attach the IGW before creating its route). Externalize hard-to-change values like CIDRs and subnet IDs into parameters or Mappings so templates are reusable per environment. For change management, preview diffs with change sets, prevent accidental deletion of critical resources with DeletionPolicy: Retain, and periodically surface manual changes with drift detection.
| Tool/feature | Role | When to use |
|---|---|---|
| CloudFormation stack | Declarative build in one account | Manage one account/Region together |
| StackSets | Deploy to many accounts/Regions | Roll out baseline org-wide |
| AWS RAM | Share TGW/subnets/Resolver rules | Use central definitions per account |
| Change set | Preview diff before apply | Prevent unintended changes |
| Drift detection | Detect deviation from template | Periodic audit of manual changes |
Scenario: deploy identical VPC, subnets, an S3 gateway endpoint, and a shared TGW attachment consistently to all 100 org accounts, and auto-apply to new accounts. → Configure CloudFormation StackSets with Organizations integration (auto-deploy) to roll the baseline network to every OU. Create the shared TGW in a central account and share it via AWS RAM so each account just attaches rather than building its own.
FAQ: Q. A stack update fails creating a route because its dependency is missing? A. Make the IGW attachment or TGW attachment completion explicit via DependsOn/references to guarantee ordering. Q. Same config across Regions? A. Separate Region-dependent values (AZs, AMIs) into Mappings or parameters and deploy by Region with StackSets.
Trap: "with drift detection, manual changes auto-revert" is false. Drift detection only reports that drift exists—it does not fix it. Remediation requires redeploying from the template as source of truth (or incorporating the change). If auto-remediation is required, build a separate pipeline or use AWS Config remediation actions.
4.3.2In-scope compute, scaling, and storage services
Implementing a network also covers the compute and scaling of workloads that process traffic. For EC2 fleets, Amazon EC2 Auto Scaling auto-replaces unhealthy instances via health checks and maintains desired/min/max counts with policy scaling, while AWS Auto Scaling manages cross-service plans including non-EC2 (ECS/DynamoDB, etc.). Run containerized network services without managing servers with Amazon Elastic Container Service (ECS) and AWS Fargate, and do event-driven automation serverlessly with AWS Lambda (triggering remediation from CloudWatch/EventBridge). For long-term retention of VPC flow logs and network audit logs, Amazon S3 is low-cost and durable, queryable later directly with Athena.
4.3.3Section summary
- Automation = reproducible with CloudFormation/CDK/Terraform
- Safe apply = change sets; consistency = drift detection
- Scale = EC2/AWS Auto Scaling; containers = ECS/Fargate; automation = Lambda; log retention = S3
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Repeatably and consistently build the same VPC network across dev/test/prod. Best approach?
Q2. Before updating a CloudFormation stack, review which resources change and how. What?
Q3. Check whether an IaC-built network has deviated from the template due to manual changes. What?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.