Deployment, Provisioning, and Automation
What you must know
CloudFormation (templates, stacks, nested stacks, change sets, drift detection, StackSets, deletion policies, DependsOn); Elastic Beanstalk deployment policies (all-at-once, rolling, rolling with additional batch, immutable, blue/green); CodePipeline/CodeBuild/CodeDeploy (in-place vs blue/green, deployment configs); Systems Manager Automation and Run Command; OpsWorks (legacy); CDK and SAM; launch templates and Auto Scaling groups; AMI pipelines via EC2 Image Builder.
Traps that show up in questions
- CloudFormation rollback: a failed stack update rolls back to the last stable state by default. Disabling rollback is a deliberate choice, not the default.
- DeletionPolicy vs UpdateReplacePolicy:
Retainkeeps a resource on stack delete;Snapshottakes a snapshot before delete (RDS, EBS). UpdateReplacePolicy governs replacement during update. - Change sets preview changes but do not apply them - a question asking to "review impact before deploy" wants a change set, not a direct update.
- CodeDeploy blue/green shifts traffic via a new ASG or target group; in-place reuses instances. Blue/green gives fast rollback.
- Immutable Beanstalk launches a fresh set of instances and swaps them in - safest, slowest, highest cost; all-at-once is fastest and riskiest.
- StackSets deploy one template across accounts/Regions; nested stacks organize a large template, not multi-account rollout.
- Drift detection reports divergence from template; it does not fix it.
Worked rule of thumb
When a question asks for a repeatable, version-controlled, multi-account rollout of infrastructure, the answer is CloudFormation StackSets (often with service-managed permissions). When it asks for safe application release with instant rollback, choose CodeDeploy blue/green. Match the tool to infrastructure provisioning vs application deployment.