What's changed: In-scope coverage: added Control Tower, Service Catalog, AWS Proton to s2; OpsWorks, License Manager, EC2 Image Builder to s3
2.1CloudFormation and IaC Fundamentals
Understand infrastructure as code—CloudFormation (templates/stacks), change sets, drift detection, and nested stacks. Manage infrastructure declaratively and reproducibly.
Infrastructure as Code (IaC) declares infrastructure in code for reproducible provisioning. On AWS, CloudFormation is the core.
2.1.1How CloudFormation works
- Template/stack: declare resources in YAML/JSON and create/update/delete them together as a stack.
- Change set: preview an update before applying to avoid unintended replacements/deletions.
- Drift detection: detect whether the actual configuration has diverged from the template.
- Nested stacks: modularize and reuse common templates to organize large stacks.
Common on DOP-C02: preview diff before apply = change set, detect manual-change drift = drift detection, reuse common parts = nested stacks, auto-rollback on failure. In production, review via change sets before executing.
CDK and SAM ultimately synthesize CloudFormation templates. CDK lets you write IaC in programming languages; SAM offers concise serverless syntax.
DOP-C02 probes the design skill to wield template features. Externalize environment differences with Parameters, branch by region/environment with Mappings/Conditions, and loosely couple stacks via Outputs with exports/Fn::ImportValue or SSM parameter (dynamic) references. To prevent update accidents, forbid replacement of critical resources (e.g., DBs) with a stack policy, prevent accidental deletion per-resource with DeletionPolicy: Retain/Snapshot, and preserve data on replacement with UpdateReplacePolicy. If an update fails midway, CloudFormation auto-rolls back to the prior state; an UPDATE_ROLLBACK_FAILED state requires manual recovery (continue update rollback). Custom resources (Lambda-backed) and macros embed non-standard processing, and third-party resource types in the Registry are supported. Drift detection surfaces "manual changes made outside the template," making it operationally central to IaC consistency. In production, always follow the change-set review → execute sequence.
| Goal | Feature | Key point |
|---|---|---|
| Preview update diff | Change set | See replacements/deletions before apply |
| Detect manual drift | Drift detection | Diff between live config and template |
| Protect critical resources | Stack policy / DeletionPolicy | Forbid replace; prevent deletion (Retain/Snapshot) |
| Organize large stacks | Nested stacks | Modularize/reuse common templates |
Scenario: On a production stack update, prevent the RDS DB instance from being accidentally replaced (recreated, losing data). → First check the change set for any resource showing "Replacement: True." Set DeletionPolicy: Snapshot and UpdateReplacePolicy: Snapshot on the DB, and use a stack policy to deny updates (replacement) of the DB resource—technically blocking an accidental replace.
FAQ: How to share values between stacks? Two ways. Output exports + Fn::ImportValue create a strong dependency (you can’t delete/change an exporter while imported) but are explicit. SSM parameter (dynamic) references are loosely coupled and easier to repoint later. Choose by whether you want tight or loose coupling.
Exam trap: When you want to "bring manual console changes into CloudFormation," drift detection only detects the diff—it does not auto-fix. Remediate by updating the template or using resource import. Also, a change set is a "pre-apply preview"; nothing changes unless you execute it.
2.1.2Section summary
- IaC = CloudFormation (template/stack)
- Safe ops = change sets + drift detection + nested stacks
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to preview a CloudFormation stack update (including replacements/deletions) before applying. What?
Q2. Someone made manual console changes; you want to check if the live environment diverges from the template. What?
Q3. You want to modularize and reuse a common network definition across stacks. What?