Deployment, Provisioning, and Automation
Infrastructure as code
A CloudFormation template has Parameters (user input), Mappings (static lookups), Conditions, Resources (the only required section), and Outputs. Change sets preview update impact; drift detection reveals manual changes. DeletionPolicy defaults to Delete - set Retain or Snapshot for data-bearing resources, and set UpdateReplacePolicy similarly. Nested stacks compose templates, StackSets deploy across accounts and regions, and stack policies block updates to protected resources.
Bootstrapping instances
User data runs on every boot unless guarded by a condition. cfn-init reads AWS::CloudFormation::Init metadata to install packages and start services; cfn-signal reports success to a CreationPolicy or WaitCondition. Without the CreationPolicy the signal is ignored and the stack will not wait.
Release automation
CodeDeploy uses an AppSpec with lifecycle hooks (BeforeInstall, AfterInstall, ApplicationStart, ValidateService) for in-place deployments, or blue/green with a replacement fleet or target group. Elastic Beanstalk policies: all at once (downtime), rolling, rolling with additional batch, immutable (fresh ASG), and traffic splitting. Systems Manager offers Run Command for ad-hoc fleets, State Manager for desired state, Patch Manager for patching, Automation for runbooks, and Parameter Store for configuration.
Traps
A stack that hangs and rolls back with a zero-signals error points at a missing CreationPolicy or timeout, or cfn-signal invoked with the wrong exit code. Immutable deployments are the answer when batches must not reduce capacity.
Rule of thumb
Order of work: network template, then application template with cfn-init and cfn-signal, then CodePipeline plus CodeDeploy for ongoing releases. Never bootstrap secrets in user data.