Configuration Management and Infrastructure as Code
What to know
This domain tests CloudFormation deeply plus configuration tooling (SSM, OpsWorks, Elastic Beanstalk). For CloudFormation, understand templates (Resources, Parameters, Mappings, Conditions, Outputs, Metadata), intrinsic functions (Ref, GetAtt, Sub, Join, If, ImportValue), and stack operations (create/update/delete, change sets, drift detection). Know nested stacks vs. cross-stack references via Export/ImportValue, and when to use StackSets for multi-account/multi-region deployment. Understand DeletionPolicy (Retain/Snapshot), UpdateReplacePolicy, and how updates behave: immutable resource replacement vs. in-place update. For SSM, know Parameter Store (Standard vs. Advanced tiers, SecureString with KMS), documents, associations, and State Manager for ongoing compliance. Know that Elastic Beanstalk uses .ebextensions and platform hooks.
Traps
- Assuming changes to a resource property always update in place - some force replacement, causing downtime or data loss unless DeletionPolicy is set.
- Confusing change sets (preview) with drift detection (detects out-of-band changes).
- Forgetting StackSets require a delegated administrator for service-managed permissions.
- Parameter Store SecureString requires KMS decrypt permission for the calling principal.
Rule of thumb
Need the same stack across many accounts/regions? Use StackSets. Need to share a value between stacks in one account? Export/ImportValue. Need to protect data on delete? DeletionPolicy: Retain or Snapshot.
Worked example
A database resource gets a new property that forces replacement. Set DeletionPolicy: Snapshot and UpdateReplacePolicy: Snapshot so CloudFormation snapshots the old instance before replacing it.