2.2.1.1. IaC Options & Tools for AWS (CloudFormation, CDK, SAM)

2.2.1.1. IaC Options & Tools for AWS (CloudFormation, CDK, SAM)

AWS CloudFormation is the foundational IaC service. You define resources in JSON/YAML templates, and CloudFormation provisions them as a stack — a single unit you can create, update, and delete atomically. Key features: drift detection, change sets (preview changes before applying), stack policies (protect critical resources from accidental updates), and rollback on failure.

AWS CDK lets you define infrastructure using TypeScript, Python, Java, or C#. CDK synthesizes to CloudFormation templates — it's an abstraction layer, not a separate provisioning engine. Use CDK when your infrastructure has complex logic (conditionals, loops, reusable constructs) that's painful in raw YAML. CDK Pipelines (pipelines.CodePipeline) is self-mutating: after synth, its UpdatePipeline stage (SelfMutate action) updates the pipeline itself from the new code before any application stage runs, so a change to the pipeline definition deploys itself — only the first deployment of the pipeline is manual. L2 constructs expose grant* methods — e.g. bucket.grantRead(fn) adds a read-only policy scoped to that bucket to the function's role, instead of a hand-written s3:* statement. A single stack is capped at 500 resources, so a large CDK app is split into multiple stacks; CDK wires cross-stack references as exports/imports and deploys the stacks in dependency order.

// CDK example: VPC + ECS Fargate service in ~10 lines
const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
const cluster = new ecs.Cluster(this, 'Cluster', { vpc });
new ecsPatterns.ApplicationLoadBalancedFargateService(this, 'Service', {
  cluster,
  taskImageOptions: { image: ecs.ContainerImage.fromRegistry('nginx') },
});

AWS SAM extends CloudFormation with serverless-specific shorthand. A AWS::Serverless::Function resource creates a Lambda function and its IAM role plus whatever each event source needs — an API Gateway API and invoke permission for an Api event, an event source mapping for a queue or stream — in one declaration. SAM CLI provides local testing (sam local invoke).

All of these are declarative, desired-state tools: you describe the end state and the engine works out which resources to create, update, or delete — checked when you deploy, not continuously (continuous enforcement is State Manager's job).

Terraform is the multi-cloud alternative using HCL syntax. It maintains its own state file and doesn't depend on CloudFormation. Use when managing resources across AWS + Azure/GCP, or when the team prefers HCL.

Exam Trap: CDK generates CloudFormation under the hood — debugging CDK deployment failures means reading CloudFormation events, not CDK logs. If the exam describes a CDK deployment failure, the troubleshooting path goes through the CloudFormation console.