AWS CloudFormation

Overview

CloudFormation organizes resources into stacks defined by templates, replacing separate, manual resource setup with a repeatable model. It supports workflows ranging from a single EC2 instance to complex multi-Region applications, including CI/CD automation. Managed state, resource import, policy as code, and self-hosted execution add flexibility, but the service supports AWS rather than a multi-cloud estate.

The service itself is free for AWS and Alexa resource providers, not the infrastructure it creates. AWS resources remain billed at standard rates, and third-party provider or custom hook operations may also incur charges.

Key features

Templates and authoring

Templates define AWS resources and their properties in YAML or JSON. Teams that prefer programming languages can use the AWS CDK, which supports TypeScript, Python, Java, and .NET and provisions through CloudFormation. For serverless deployments, AWS SAM offers shorthand YAML for functions, APIs, databases, and event source mappings, then transforms it into CloudFormation syntax. These options broaden how teams author infrastructure without changing the AWS provisioning foundation.

Change control and drift

Change Sets preview proposed stack updates and flag resources that may be deleted or replaced before execution. That makes consequential updates easier to assess, though teams still need to judge whether the proposed changes are acceptable. Drift Detection tracks changes made outside CloudFormation, helping teams find divergence between their templates and deployed resources.

Scale and integrations

StackSets deploy a common set of resources across multiple AWS accounts and Regions from one template, a practical fit for organizations standardizing environments. The CloudFormation Registry supports third-party resources and modules, including examples from MongoDB, Datadog, Atlassian Opsgenie, JFrog, and Splunk. Stack updates can also use a template from a remote Git repository, connecting infrastructure changes to a version-controlled workflow.

Security and oversight

CloudFormation encrypts data at rest and uses encrypted communications; AWS recommends TLS 1.3 and requires TLS 1.2. IAM can control access, while CloudTrail logs API calls. These controls give AWS teams established ways to govern and audit service use.

Pricing

AWS CloudFormation: 0.00 USD per free. There is no additional CloudFormation charge for AWS and Alexa resource providers, but created AWS resources are billed at their standard rates. Third-party provider and custom hook operations may incur charges: the first 1,000 operations are included in the Free Tier, and the first 30 seconds of each operation have no additional charge. This suits teams that want template-based provisioning without a separate service fee, provided they budget for the infrastructure and any chargeable operations. There is no free trial; the service is free.

Platforms

CloudFormation supports API, Linux, macOS, web, and Windows. Its configuration languages are YAML and JSON, and its supported cloud is AWS.

Who it's for

CloudFormation is a strong choice for AWS teams that need repeatable infrastructure deployments, multi-account or multi-Region stack management, and previews before updates. CI/CD teams can use templates to automate infrastructure changes. It is less suited to organizations that need the same infrastructure workflow across multiple cloud providers.

Pros and cons

• Pro: Change Sets expose possible deletions and replacements before execution, supporting more deliberate stack updates.
• Pro: StackSets deploy a shared template across accounts and Regions, reducing friction when standardizing AWS environments.
• Pro: CDK, SAM, and Registry support offer several authoring paths and third-party resource options within CloudFormation deployments.
• Con: CloudFormation is AWS-specific, so it is not a fit for teams seeking a common provisioning service across clouds.
• Con: A free service does not mean free infrastructure: AWS resources incur their standard charges, and some provider or hook operations may cost extra.

Alternatives

For infrastructure testing and adjacent configuration or policy work, these tools serve different needs; they are not direct replacements for CloudFormation's AWS stack provisioning.

• Conftest is a free option for readers seeking an Apache 2.0-licensed tool available on Linux, macOS, and Windows.
• Sonobuoy is an open-source option for readers who want support for self-hosted environments as well as Linux, macOS, and Windows.
• cfn-lint is a free, MIT-0-licensed option for readers looking for a CloudFormation-focused tool that supports Python 3.10–3.14.
• Chef InSpec may suit readers seeking a freemium option with a free plan for non-production workloads and personal, non-commercial use, plus a 30-day free trial.
• Cinc Auditor is a free distribution of Chef InSpec, though it comes without formal warranties or support.
• OpenSCAP is a free, open-source option for readers seeking Linux, macOS, self-hosted, and Windows support.
• Test Kitchen is a free Apache 2.0-licensed option installable from RubyGems, system packages, or Cinc/Chef Workstation.
• TFLint is a free open-source command-line Terraform linter for readers working with Terraform.

Browse Infrastructure Testing Tools, Infrastructure as Code Tools, Cloud Orchestration Software, IT Configuration Management Software, Infrastructure as Code Security Software, and Infrastructure Policy as Code Tools.

Verdict

Choose CloudFormation if your infrastructure is on AWS and you want managed, template-driven provisioning with stack previews and multi-account deployment support. Its AWS-specific scope is also the clearest reason to look elsewhere if your team needs one infrastructure workflow across clouds.