This content originally appeared on DEV Community and was authored by Wakeup Flower
CloudFormation is infrastructure as code (IaC), so your stack template is the source of truth.
That means:
-
If someone changes resources manually (outside CloudFormation):
- You can detect drift (CloudFormation Drift Detection).
- You can re-apply the stack to bring it back into compliance.
-
If someone modifies the template in Git/repo incorrectly:
- You’ll catch it with code reviews / CI checks / cfn-guard rules.
- If it still gets deployed, you can roll back to a previous version of the template.
So yes — CloudFormation gives you a way to recover from misconfigurations by redeploying the known-good template.
What it does not do by itself
- CloudFormation doesn’t stop someone from creating a separate RDS instance manually in the console.
- It doesn’t magically fix bad parameters unless you enforce guardrails (like Service Catalog, SCPs, Config rules).
- If data is impacted (e.g., DB deleted with no backups), IaC won’t restore the data — only the infrastructure. That’s why backups and deletion protection are best practices.
How to make recovery safer
- Enable RDS deletion protection → prevents accidental DB drops.
- Automated backups & snapshots → ensures data can be restored even if infra is rebuilt.
- Use Git version control for templates → rollback to last working state.
- Use CloudFormation Drift Detection → see if someone changed the stack outside IaC.
But to make it bulletproof, you need backups + guardrails in addition to IaC.
┌──────────────────────────┐
│ Git Repo (IaC Code) │
│ - CloudFormation YAML │
│ - Best practices baked │
└─────────────┬────────────┘
│
▼
┌─────────────────┐
│ CI/CD Pipeline │
│ - cfn-lint │
│ - cfn-guard rules│
└─────────┬───────┘
│
▼
┌─────────────────────┐
│ CloudFormation Stack │
│ - Creates RDS safely │
│ - Enforces defaults │
└─────────┬───────────┘
│
┌──────────────┴─────────────────┐
│ │
▼ ▼
┌────────────────────┐ ┌──────────────────────┐
│ AWS Config Rules │ │ Automated Backups & │
│ - Detect drift │ │ Snapshots │
│ - Check encryption │ │ - Deletion protection│
│ - Check no public │ │ - Point-in-time │
└─────────┬───────────┘ └───────────┬─────────┘
│ │
▼ ▼
┌──────────────────────┐ ┌──────────────────────────┐
│ If misconfigured: │ │ If DB deleted/corrupted: │
│ - Roll back template │ │ - Restore from snapshot │
│ - Re-deploy good IaC │ │ - Reapply CFN template │
└──────────────────────┘ └──────────────────────────┘
This content originally appeared on DEV Community and was authored by Wakeup Flower
Wakeup Flower | Sciencx (2025-09-30T11:56:23+00:00) CloudFormation as best practice. Retrieved from https://www.scien.cx/2025/09/30/cloudformation-as-best-practice/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.