CloudFormation, CDK and Cost Basics

7 pages · ~5 min✓ Reviewed

Builds on Monitoring with CloudWatch and CloudTrail.

AWSPage 1

CloudFormation: Templates and Stacks Mental Model

1. Template vs Stack

Template (JSON/YAML) declares resources
Stack = one deployed instance of a template
Creates, updates, deletes resources as a unit

Section	Holds	Required?
`Parameters`	input values at deploy time	no
`Mappings`	static lookup tables	no
`Conditions`	if-logic for resources	no
`Resources`	the AWS resources	yes
`Outputs`	values to show or export	no

2. Intrinsic Functions

Function	Returns
`!Ref`	parameter value, or resource ID
`!GetAtt`	a resource attribute (e.g. Arn)
`!Sub`	string with `${}` substitution
`!ImportValue`	another stack's export

3. Declarative Ordering

State the desired end state, not the steps
Order comes from Ref/GetAtt dependencies
DependsOn only for hidden dependencies

yaml

Resources:
  Bucket:
    Type: AWS::S3::Bucket
Outputs:
  BucketArn:
    Value: !GetAtt Bucket.Arn

minimal template: one bucket, one output

Remember

Resources is the only required section. Don't add DependsOn when a !Ref already links two resources.

AWSPage 2

CloudFormation: Change Sets, Drift and Rollback

1. Change Sets

Change set = preview of an update: what it will add, modify, remove
Each change carries a Replacement flag
Review first, then execute-change-set

2. Update Behaviors

Behavior	Effect
No interruption	Updated in place, no downtime
Some interruption	Brief outage, same resource
Replacement	New physical resource, old one deleted

3. Drift and Rollback

Drift detection compares live resources with the template: IN_SYNC or DRIFTED
It only detects, it never fixes
Failed create → ROLLBACK_COMPLETE: delete only, no update
Failed update → rolls back to the last good state

4. Protect Data

AWSPage 3

CDK: Constructs, Synth and Deploy

1. Constructs and Levels

CDK defines infrastructure in code (TypeScript, Python and others)
Tree: App contains Stacks, which contain Constructs
cdk synth turns the code into a CloudFormation template

CodeApp, Stack
synthtemplate in cdk.out
deployCloudFormation stack

Level	What it is	Example
L1	`Cfn*` raw resource	`CfnBucket`
L2	curated defaults, helpers	`bucket.grantRead(fn)`
L3	pattern of several resources	load-balanced Fargate service

2. Commands and Bootstrap

Command	Does
`cdk init`

AWSPage 4

AWS Pricing Models and Savings Options

1. The Four Options

Option	Commitment	Discount
On-demand	None, pay per second/hour	None; most flexible, most expensive
Savings Plans	$/hour for 1 or 3 years	Up to ~70%
Reserved Instances	A specific instance configuration	Commitment discount
Spot	None	Up to ~90%

Compute Savings Plans: apply across EC2, Fargate and Lambda
EC2 Instance Savings Plans: fix family and region, deeper discount
Reserved Instances: Savings Plans are the more flexible modern default

2. Spot

Spare AWS capacity, up to 90% off
AWS can reclaim it with a 2-minute warning
Use only for stateless, fault-tolerant or batch work

3. Pick by Workload

AWSPage 5

Cost Explorer, Budgets and Cost Traps

1. Seeing and Capping Spend

Cost Explorer: past spend and forecast, by service, account, region or tag
Cost allocation tags must be activated in Billing first
Budget actions can apply IAM or SCP restrictions

Tool	Fires when	Alert
Budgets	your threshold: cost, usage or Savings Plans coverage; actual or forecasted %	email or SNS
Anomaly Detection	spend looks unusual, automatic	email or SNS

2. NAT Gateway Trap

Hourly charge plus per-GB processing on all traffic
Fix: S3 and DynamoDB gateway endpoints (free)
Other services: interface endpoints
Keep traffic in the same AZ

Private subnet
Gateway endpointfree
S3 / DynamoDB

3. Other Traps

AWSPage 6

AWS Cost and IaC Cheat Sheet

1. CloudFormation Flow

1Write template
2create-change-setaws cloudformation
3Reviewcheck Replacement
4execute-change-set
5detect-stack-driftdetect only

Stack state	Meaning
`CREATE_COMPLETE`	Healthy new stack
`UPDATE_ROLLBACK_COMPLETE`	Update failed, back to last good state
`ROLLBACK_COMPLETE`	Create failed: delete only
`DELETE_FAILED`	Resource blocked delete: fix, retry

2. CDK Flow

1cdk bootstraponce per account/region
2cdk synth
3cdk diff
4cdk deploy

L1 Cfn*: raw resource
L2: curated defaults
L3: patterns of many resources

3. Discounts

Option

AWSPage 7

Check yourself

The first create of a stack failed, leaving it in ROLLBACK_COMPLETE. You fix the template and run an update. What happens?

The update is rejected: this state allows delete only.
Delete the stack, then create it again.

You rename a Bucket construct ID in CDK and deploy. What happens to the bucket?

The new ID gives a new logical ID, so CDK creates a new bucket.
The old bucket is deleted only if its removal policy is DESTROY. The L2 default is RETAIN, so it stays behind as an orphan.
Run cdk diff first to see the change.

Private-subnet jobs read terabytes from S3 through a NAT Gateway, and the bill is high. What is the fix?

NAT charges hourly plus per GB processed.
Add a free S3 gateway endpoint so that traffic skips the NAT.

Trap	Fix
Cross-AZ / cross-region transfer	keep traffic local
Idle load balancers	delete
Unattached EBS, old snapshots	delete
Public IPv4 addresses	release unused
Logs set to never expire	set retention

Savings Plans	up to ~70%	1 or 3 year commit
Spot	up to ~90%	2-minute interruption notice
On-demand	none	no commitment