CloudFormation is one of the most frequently asked topics in AWS Cloud Engineer, DevOps Engineer, Solutions Architect, Platform Engineer, Site Reliability Engineer (SRE), and Data Engineer interviews.

1. What is AWS CloudFormation?

Answer

AWS CloudFormation is an Infrastructure as Code (IaC) service that allows you to define, provision, and manage AWS infrastructure using code templates.

Instead of manually creating resources through the AWS Console, you define infrastructure in YAML or JSON templates.

Benefits

• Infrastructure as Code
• Automated deployments
• Version control
• Repeatable environments
• Reduced manual errors
• Easy rollback
• Compliance and governance

Example:

Resources:
  MyBucket:
    Type: AWS::S3::Bucket

This template creates an S3 bucket automatically.

2. What is Infrastructure as Code (IaC)?

Answer

Infrastructure as Code means managing infrastructure using code rather than manual processes.

Benefits:

• Automation
• Consistency
• Reusability
• Version Control
• Faster deployments

Examples:

• CloudFormation
• Terraform
• AWS CDK
• Pulumi

3. What are CloudFormation Templates?

Answer

Templates are text files written in:

• YAML
• JSON

They describe AWS resources and configurations.

Example:

AWSTemplateFormatVersion: '2010-09-09'
Description: Sample Template

Resources:
  MyEC2:
    Type: AWS::EC2::Instance

4. What are the main sections of a CloudFormation Template?

Answer

Common sections:

Example:

Parameters:
  InstanceType:
    Type: String

Resources:
  MyEC2:
    Type: AWS::EC2::Instance

5. Which formats are supported by CloudFormation?

Answer

Supported:

• YAML (Preferred)
• JSON

YAML advantages:

• Easier readability
• Smaller size
• Supports comments

6. What is a Stack?

Answer

A Stack is a collection of AWS resources created from a CloudFormation template.

Example:

A stack may contain:

• VPC
• Subnets
• EC2
• Security Groups
• Load Balancer

All resources are managed together.

7. What is a StackSet?

Answer

StackSets allow deployment of stacks across:

• Multiple AWS Accounts
• Multiple AWS Regions

Used for enterprise-wide deployments.

Example:

Deploy CloudTrail to:

• 100 AWS accounts
• 10 AWS regions

using one StackSet.

8. Difference Between Stack and StackSet?

9. What is Change Set?

Answer

A Change Set previews changes before applying them.

Benefits:

• Risk reduction
• Change visibility
• Safer deployments

Example:

Before update:

t3.micro

After update:

t3.medium

Change Set shows impact before execution.

10. What happens during Stack Creation?

Answer

CloudFormation:

1. Reads template
2. Validates syntax
3. Resolves dependencies
4. Creates resources
5. Monitors status
6. Marks stack complete

States:

CREATE_IN_PROGRESS
CREATE_COMPLETE
CREATE_FAILED

11. What happens if Stack Creation fails?

Answer

By default:

CloudFormation performs rollback.

CREATE_FAILED
ROLLBACK_IN_PROGRESS
ROLLBACK_COMPLETE

Failed resources are deleted automatically.

12. What is Rollback?

Answer

Rollback restores infrastructure to the previous stable state.

Example:

If RDS creation fails:

• EC2 removed
• VPC removed
• Stack reverted

13. What is Drift Detection?

Answer

Drift Detection identifies resources modified outside CloudFormation.

Example:

Template:

EC2 = t3.micro

Admin changes manually:

EC2 = t3.large

Drift detection reports difference.

14. Why is Drift Detection important?

Answer

Benefits:

• Compliance
• Governance
• Auditing
• Detect manual changes

Common enterprise requirement.

15. What are Parameters?

Answer

Parameters allow dynamic input.

Example:

Parameters:
  InstanceType:
    Type: String

User provides:

t3.micro

or

t3.medium

16. What are Mappings?

Answer

Mappings are static lookup tables.

Example:

Mappings:
  RegionMap:
    us-east-1:
      AMI: ami-12345

Useful for region-specific values.

17. What are Conditions?

Answer

Conditions control resource creation.

Example:

Conditions:
  IsProd: !Equals [!Ref Environment, prod]

Create resource only in production.

18. What are Outputs?

Answer

Outputs expose resource values.

Example:

Outputs:
  VPCID:
    Value: !Ref MyVPC

Used by other stacks.

19. What are Intrinsic Functions?

Answer

Built-in CloudFormation functions.

Examples:

!Ref
!Sub
!GetAtt
!Join
!ImportValue
!FindInMap
!If

20. Explain Ref Function

Answer

Returns resource identifier.

!Ref MyBucket

Returns bucket name.

21. Explain GetAtt

Answer

Retrieves resource attributes.

Example:

!GetAtt MyEC2.PublicIp

Returns EC2 public IP.

22. Explain Sub Function

Answer

String substitution.

!Sub arn:aws:s3:::${BucketName}

Dynamic string generation.

23. Explain Join Function

Answer

Concatenates strings.

!Join
  - "-"
  - [dev, app]

Output:

dev-app

24. Explain ImportValue

Answer

Imports output from another stack.

Stack A:

Outputs:
  VPCID:
    Export:
      Name: SharedVPC

Stack B:

!ImportValue SharedVPC

25. What are Nested Stacks?

Answer

A stack inside another stack.

Benefits:

• Reusable modules
• Better organization
• Smaller templates

Example:

Network Stack
 ├── VPC
 ├── Subnet

Application Stack imports it.

26. What are CloudFormation Macros?

Answer

Macros transform templates before execution.

Often backed by:

AWS Lambda

Use cases:

• Custom syntax
• Reusable logic
• Template simplification

27. What is CloudFormation Registry?

Answer

Registry allows custom resource types.

Examples:

Third-party resources
Custom resources

28. What are Custom Resources?

Answer

Resources not natively supported by CloudFormation.

Implemented using:

Lambda
SNS

Example:

• Create Jira ticket
• Configure external system

during deployment.

29. How does CloudFormation interact with Lambda?

Answer

CloudFormation invokes Lambda for:

• Custom resources
• Macros

Workflow:

CloudFormation
      ↓
Lambda
      ↓
External System

30. What are CloudFormation Hooks?

Answer

Hooks validate resources before deployment.

Example:

Prevent:

Public S3 buckets

from being created.

31. What is DeletionPolicy?

Answer

Controls resource behavior during stack deletion.

Options:

DeletionPolicy: Delete
DeletionPolicy: Retain
DeletionPolicy: Snapshot

Example:

DeletionPolicy: Retain

RDS survives stack deletion.

32. Difference Between Retain and Snapshot?

Answer

Retain:

Resource stays intact

Snapshot:

Creates backup snapshot
Deletes resource

Common for RDS/EBS.

33. What is UpdateReplacePolicy?

Answer

Controls behavior when resources are replaced during updates.

UpdateReplacePolicy: Retain

Prevents accidental data loss.

34. What are CloudFormation Limits?

Answer

Common limits:

• 500 resources per template
• 200 outputs
• 200 parameters
• 60 dynamic references

Interviewers often ask about scaling strategies.

35. How do you secure CloudFormation templates?

Answer

Best practices:

• Use IAM least privilege
• Use Secrets Manager
• Use SSM Parameter Store
• Avoid hardcoded passwords
• Enable CloudTrail
• Use Stack Policies

36. What is a Stack Policy?

Answer

Protects critical resources from updates.

Example:

Prevent deletion of:

Production Database

even during stack updates.

37. What is CloudFormation Designer?

Answer

Visual template design tool.

Allows drag-and-drop architecture creation.

38. What is AWS CDK and how is it related?

Answer

AWS CDK generates CloudFormation templates using code.

Languages:

• Python
• Java
• TypeScript
• C#
• Go

Flow:

CDK Code
   ↓
CloudFormation Template
   ↓
AWS Resources

39. CloudFormation vs Terraform

40. Senior-Level Interview Question

How would you deploy a multi-account enterprise landing zone using CloudFormation?

Answer

Architecture:

AWS Organizations
       │
StackSets
       │
 ├── IAM Roles
 ├── CloudTrail
 ├── Config
 ├── Security Hub
 ├── GuardDuty
 ├── Logging Buckets
 └── SCP Policies

Approach:

1. Create Organization
2. Configure delegated admin
3. Deploy baseline via StackSets
4. Use Change Sets
5. Enable Drift Detection
6. Protect critical resources using Stack Policies
7. CI/CD integration with CodePipeline/GitHub Actions

This answer demonstrates senior-level AWS architecture expertise.

Top 25 CloudFormation Interview Questions Asked Most Frequently

1. What is CloudFormation?
2. Why use Infrastructure as Code?
3. What is a Stack?
4. What is a StackSet?
5. What are Parameters?
6. What are Outputs?
7. What is Drift Detection?
8. What is a Change Set?
9. What are Intrinsic Functions?
10. Explain Ref.
11. Explain GetAtt.
12. Explain Sub.
13. Explain ImportValue.
14. What are Nested Stacks?
15. What are Custom Resources?
16. How do Rollbacks work?
17. What is DeletionPolicy?
18. What is UpdateReplacePolicy?
19. What is a Stack Policy?
20. CloudFormation vs Terraform?
21. CloudFormation vs CDK?
22. How do you manage secrets?
23. How do StackSets work?
24. How do you secure templates?
25. Design a multi-account CloudFormation deployment strategy.

For AWS Solutions Architect, DevOps Engineer, Cloud Engineer, and Data Engineer interviews in the U.S. market, I would also recommend mastering advanced topics such as CloudFormation StackSets, Nested Stacks, Macros, Custom Resources with Lambda, CI/CD integration, cross-account deployments, drift detection, and enterprise landing zone automation, since these are commonly discussed in senior-level interviews.