Question 1

What is AWS CloudFormation?

Accepted Answer

CloudFormation is AWS's native infrastructure-as-code service. You describe resources in a YAML or JSON template and it creates, updates and deletes them as a stack, resolving dependencies, tracking state, and rolling back automatically on failure. Automatic rollback on failed create or update is a genuine advantage over some alternatives — a failed update returns the stack to its previous state without you intervening. The trade-off versus Terraform is multi-cloud support and ecosystem, which is the standard follow-up.

Question 2

What are the main sections of a CloudFormation template?

Accepted Answer

Resources is the only required section. Parameters take input at deploy time, Mappings provide lookup tables such as region-to-AMI, Conditions control whether resources are created, Outputs export values for other stacks or for humans, Metadata carries extra information, and Transform enables macros such as SAM. Conditions are the section people underuse — they let one template serve several environments by creating a Multi-AZ database only in production, for example. Outputs with Export are the mechanism for cross-stack references, which is the next question.

Question 3

How do you share values between CloudFormation stacks?

Accepted Answer

Either export an Output from one stack and import it with Fn::ImportValue in another, which creates a hard dependency preventing deletion or change of the exporting stack; or write values to SSM Parameter Store and read them, which is looser and does not block deletion. Nested stacks pass values as parameters. The export lock is the trap: once a value is imported, the exporting stack cannot change or delete it, which blocks refactoring. Parameter Store as a soft coupling is the pattern most teams end up preferring for exactly that reason.

Question 4

What is a change set?

Accepted Answer

A change set previews what an update would do — which resources are added, modified or replaced — before executing it, so a destructive change is visible in review rather than discovered during deployment. It is the CloudFormation equivalent of a Terraform plan. The critical field is the replacement column: a change that says Replacement: True means the resource will be destroyed and recreated, which for a database or an EBS volume is data loss. Reviewing change sets for replacements is the discipline this question tests.

Question 5

What causes a resource replacement in CloudFormation and why does it matter?

Accepted Answer

Changing an immutable property — an RDS instance identifier, an EC2 availability zone, a subnet CIDR — forces CloudFormation to create a new resource and delete the old one. For stateful resources that means data loss and a new endpoint, which can be catastrophic if unnoticed. DeletionPolicy: Retain and UpdateReplacePolicy: Retain are the guards that prevent the old resource being deleted, and stack policies can block updates to specific resources entirely. Naming those protections is what turns awareness into a control.

Question 6

What is a stack policy?

Accepted Answer

A stack policy is a JSON document attached to a stack that denies update actions on specified resources, so a stack update cannot modify or replace a protected resource unless the policy is temporarily overridden. It is a guard against accidental changes to production databases. It complements DeletionPolicy: the deletion policy protects on stack deletion, the stack policy protects during updates. Both are needed because the two failure modes are different, and knowing that distinction is the substance of the answer.

Question 7

What is drift detection?

Accepted Answer

Drift detection compares the actual configuration of stack resources against the template and reports differences caused by manual changes made outside CloudFormation. It reports drift but does not correct it — you must either update the template to match or reapply the stack. The organisational fix is removing standing human write access so drift cannot occur, with a break-glass path that is audited. Detection alone means finding the same class of problem repeatedly rather than solving it.

Question 8

What are CloudFormation StackSets?

Accepted Answer

StackSets deploy the same template across many accounts and regions from a single operation, with service-managed permissions through Organizations so new accounts in an organisational unit are automatically enrolled. Deployment can be staged with concurrency and failure tolerance settings. Automatic deployment to new accounts is the property that makes them the baseline mechanism for organisation-wide guardrails — Config rules, IAM roles, logging configuration. Without it, every new account starts unconfigured until someone remembers.

Question 9

What is the AWS CDK and how does it relate to CloudFormation?

Accepted Answer

The Cloud Development Kit lets you define infrastructure in TypeScript, Python, Java, Go or C#, using constructs that encapsulate best practices, and synthesises a CloudFormation template that CloudFormation then deploys. So it is an authoring layer over the same deployment engine. The benefit is abstraction and reuse — an L3 construct creates a dozen resources with sensible defaults from a few lines. The cost is that reviewing a pull request no longer tells you what will be created, so reviewing the synthesised diff becomes part of the process.

Question 10

What are CDK construct levels?

Accepted Answer

L1 constructs are direct one-to-one mappings of CloudFormation resources, prefixed Cfn. L2 constructs add sensible defaults, helper methods and type safety. L3 constructs, or patterns, compose several resources into a complete solution such as a load-balanced Fargate service. The practical guidance is to use L2 as the default, L3 to move fast where the pattern fits, and L1 to escape when a property is not yet exposed. Knowing you can reach into the L1 escape hatch from an L2 construct is what prevents being blocked by a missing property.

Question 11

What is cdk diff and why does it matter?

Accepted Answer

cdk diff compares the synthesised template against the deployed stack and shows what would change, including resource replacements and IAM policy changes, which the CDK highlights separately and prompts you to approve before deploying. The IAM change confirmation is a genuinely good safety feature: a construct can quietly widen a policy, and the CDK forces you to acknowledge it. Making cdk diff part of the pull request pipeline is the practice that keeps abstraction reviewable.

Question 12

How does Terraform compare with CloudFormation for AWS?

Accepted Answer

Terraform is multi-cloud, has a large provider and module ecosystem, a mature plan workflow and explicit state you manage. CloudFormation is AWS-native with no state to manage, automatic rollback, StackSets for organisation-wide deployment and same-day support for new services. Terraform sometimes lags on brand-new AWS features. The honest answer is that both work and the decision is usually about team familiarity and whether multi-cloud matters. Naming state management as Terraform's main operational burden, and rollback as CloudFormation's main advantage, is the balanced comparison.

Question 13

How do you manage Terraform state on AWS?

Accepted Answer

In an S3 backend with versioning enabled and, in current Terraform versions, native S3 state locking — previously a DynamoDB table was used for locks. Keep the state bucket in a dedicated account with restricted IAM and encryption, and split state by environment and blast radius. The three requirements are remote, locked and versioned. State also contains every resource attribute in plaintext, including secrets, so the bucket must be treated as a secret store — that is the security point people frequently miss.

Question 14

How do you structure Terraform for a large AWS organisation?

Accepted Answer

Split state by blast radius and change rate — foundation (Organizations, accounts, SCPs), networking, shared platform, and per-application state — each with its own backend key and assume-role identity per account. Share versioned modules from a registry, and reference across boundaries with data sources or SSM parameters rather than remote state where possible. The blast-radius principle is the answer: a monolithic state means every change plans against everything, applies are slow, and one mistake can affect the whole estate. Splitting by change rate is the complement — networking changes rarely, applications change daily.

Question 15

What is the difference between count and for_each in Terraform?

Accepted Answer

count creates instances indexed by number, so resources are addressed as resource[0]. for_each creates instances keyed by a map or set key. for_each is almost always better because removing a middle element with count shifts every subsequent index, causing Terraform to destroy and recreate resources unnecessarily. That index-shifting destruction is exactly the failure interviewers are testing for, because it is a well-known way to accidentally delete production resources. Recommending for_each with a stable key as the default is the correct answer.

Question 16

How do you bring existing AWS resources under IaC management?

Accepted Answer

In Terraform, use import blocks so the import is planned and reviewed, then iterate on the configuration until the plan is empty. In CloudFormation, use resource import to bring resources into a stack, or the IaC generator which scans an account and produces a template from existing resources. The "iterate until the plan is empty" discipline is the substance: an import leaving a non-empty plan means your next apply will change the resource, possibly destructively. The CloudFormation IaC generator is worth naming as the newer tool for bulk adoption.

Question 17

How do you handle secrets in infrastructure as code?

Accepted Answer

Never put them in templates or variable files. Reference Secrets Manager or Parameter Store dynamically — CloudFormation supports dynamic references with the resolve syntax, Terraform reads them with data sources — or better, have the workload fetch the secret at runtime so IaC never touches it. The Terraform-specific warning is that state contains all attribute values in plaintext, so even a value marked sensitive is written to state. That is why keeping secrets out of Terraform entirely, rather than only marking them sensitive, is the stronger answer.

Question 18

What is policy as code and how would you apply it?

Accepted Answer

Policy as code evaluates infrastructure definitions against rules before deployment — no public buckets, no unencrypted volumes, required tags, approved regions — failing the pipeline on violation. Tools include cfn-guard, CloudFormation hooks, Checkov, OPA and Terraform Sentinel. The distinction from SCPs is worth making: SCPs enforce at the API regardless of tooling, while plan-time policy gives fast feedback in the pull request. Both are useful — one prevents, the other teaches — so defence in depth means using both.

Question 19

What are CloudFormation hooks?

Accepted Answer

Hooks run custom validation before a resource is created, updated or deleted, and can fail the operation — so a compliance rule is enforced by CloudFormation itself rather than only in a pipeline. They work regardless of who initiates the stack operation. The advantage over pipeline-only checks is that a hook applies even to a console-initiated stack update, closing the bypass. Guard hooks using cfn-guard rules are the accessible form, and naming them shows current knowledge.

Question 20

What is a nested stack and when would you use one?

Accepted Answer

A nested stack is a stack created as a resource inside a parent stack, used to break a large template into reusable components and to stay within template size limits. The parent passes parameters and consumes outputs, and updates cascade from the parent. The alternative is separate stacks linked by exports or Parameter Store, which are more independently deployable. Nested stacks couple lifecycle tightly — you update the parent to change a child — which is a real trade-off worth naming.

Question 21

What is AWS SAM?

Accepted Answer

The Serverless Application Model is a CloudFormation transform providing shorthand resource types for functions, APIs, tables and event sources, which expand into full CloudFormation. The SAM CLI adds local invocation, guided deployment, log tailing and built-in support for gradual deployments with CodeDeploy. The gradual deployment support is the underrated part: a few lines in a SAM template give you canary Lambda deployment with automatic rollback on a CloudWatch alarm. That would otherwise be a substantial amount of pipeline code.

Question 22

How do you handle a failed CloudFormation update?

Accepted Answer

By default the stack rolls back automatically to the previous state. If rollback itself fails, the stack enters UPDATE_ROLLBACK_FAILED and you must either continue the rollback skipping the problematic resources, or manually fix the underlying issue. Disabling rollback on create can help debugging by leaving resources in place. UPDATE_ROLLBACK_FAILED is the state that causes real pain, usually because a resource was modified outside CloudFormation so rollback cannot reconcile it. Naming ContinueUpdateRollback with a resources-to-skip list is the specific recovery step.

Question 23

What is a CloudFormation custom resource?

Accepted Answer

A custom resource invokes a Lambda function or SNS topic during stack operations so you can provision something CloudFormation does not natively support, or perform a side effect such as seeding a database. The function must signal success or failure back to CloudFormation. The failure mode to warn about is a function that never signals, which leaves the stack hanging until the timeout — often an hour. Robust custom resources signal in a finally block and handle the delete event idempotently, which is the detail that shows implementation experience.

Question 24

How do you manage multiple environments with IaC?

Accepted Answer

Separate state or stacks per environment with the same templates or modules parameterised by environment-specific variable files, deployed to separate accounts. Avoid conditionals that make the template diverge widely between environments, so staging genuinely predicts production behaviour. The test of a good setup is whether you can see the entire difference between staging and production in one small diff. If you cannot, the environments drift and staging stops being a useful signal, which is the real cost of divergence.

Question 25

What is the difference between imperative and declarative infrastructure management?

Accepted Answer

Imperative specifies the steps and depends on knowing the current state. Declarative specifies the desired end state and the tool computes the difference. Declarative is preferred because it is idempotent, reviewable and converges regardless of the starting point. CloudFormation templates and Terraform configurations are declarative; a shell script full of AWS CLI commands is imperative. Naming that comparison makes the abstract distinction concrete and explains why the industry moved.

Question 26

How do you review an infrastructure pull request?

Accepted Answer

Look first at whether anything is being replaced or destroyed; then at IAM changes and whether permissions are least-privilege; whether secrets appear anywhere they should not; whether resources are tagged for cost attribution; whether the change is reversible; and whether it matches what the description claims. Scanning the plan or change set for destroy and replace lines first is the practical habit, because those are the lines that cause outages and are easy to miss in a long diff. Automating a check that fails the pipeline on an unlabelled destroy is the enforced version.

Question 27

How do you roll back an infrastructure change?

Accepted Answer

CloudFormation rolls back automatically on a failed update. For a successful but wrong change, revert the template and redeploy. In Terraform, revert the commit and apply the previous configuration. Neither restores data destroyed by a replacement, which is why prevent-destroy protections and backups matter more than rollback. Being explicit that rollback is not universal is the mature answer: "infrastructure as code gives you rollback" is only true for non-destructive changes. Interviewers ask this to see whether you understand that limitation.

Question 28

What is the CDK bootstrap and why is it needed?

Accepted Answer

Bootstrapping provisions the resources the CDK needs in an account and region — an S3 bucket and ECR repository for assets, and IAM roles for deployment — before any stack can be deployed. It is a one-time operation per account and region. The security consideration is that bootstrap creates powerful deployment roles, and the default trust can be scoped with a qualifier and trusted account list. In a multi-account setup, understanding the bootstrap trust relationship is what makes cross-account deployment work safely.

Question 29

How do you test infrastructure as code?

Accepted Answer

Static validation and linting first — cfn-lint, terraform validate, format checks; policy-as-code scanning; then plan or change-set review in the pull request; then integration tests that deploy to a sandbox account, assert on the result and tear down. The CDK also supports unit-testing synthesised templates with assertions. CDK assertion tests are the distinctive capability: because the template is generated by code, you can unit-test that a construct produces the expected resources and properties without deploying. That is faster and cheaper than integration testing for most invariants.

Question 30

What is a Terraform module and how should you version it?

Accepted Answer

A module is a reusable, parameterised group of resources with defined inputs and outputs. Version modules with Git tags or a private registry, pin versions in consumers, expose a minimal well-documented interface with sensible defaults, and maintain a changelog with a deprecation policy. Pinning versions is what makes shared modules safe — without it a module change breaks every consumer simultaneously. A deprecation policy is what lets you evolve the interface without breaking teams unexpectedly.

Question 31

What is AWS Service Catalog?

Accepted Answer

Service Catalog lets a central team publish approved CloudFormation-based products that end users can launch with constrained parameters, so teams self-serve compliant infrastructure without needing broad IAM permissions. Launch constraints run the provisioning with a controlled role. It solves the delegation problem: developers need infrastructure but should not have permission to create arbitrary resources. The launch constraint role is what makes that possible — the user has permission to launch a product, not to create its underlying resources.

Question 32

How do you handle resources that AWS creates automatically?

Accepted Answer

Either import them into IaC, exclude them explicitly and document that the platform owns them, or use ignore_changes for attributes the platform mutates. The wrong approach is letting the tool fight the platform, producing a plan that never converges. The never-converging plan is the symptom to recognise: every plan shows the same change because something else reverts it after each apply. Diagnosing that as an ownership conflict rather than a tool bug is the insight.

Question 33

What is the risk of running terraform apply from a laptop?

Accepted Answer

Inconsistent tool and provider versions producing different plans; personal credentials with more permission than the change needs; no audit trail linking the change to a review; no plan review; and state locking conflicts. The fix is applying only from a pipeline with a dedicated role. The audit-trail point matters most in a regulated environment: an apply from a laptop is attributable only through CloudTrail with no link to a reviewed change. Removing human apply permission entirely is the strong version of the control.

Question 34

How do you manage IAM safely in Terraform on AWS?

Accepted Answer

Prefer aws_iam_role_policy_attachment and managed policies over inline authoritative resources; be careful with resources that manage the complete set of attachments, since they remove anything not declared; and never use an authoritative account-level resource without including everything that already exists. The authoritative-resource foot-gun is the specific risk: applying a resource that manages the full set removes bindings you did not declare, which can lock you out. Knowing which Terraform resources are authoritative versus additive is essential knowledge.

Question 35

What is CloudFormation Guard?

Accepted Answer

cfn-guard is an open-source policy-as-code tool with its own rules language for validating CloudFormation templates, Terraform plans and other JSON or YAML configuration against compliance rules, usable in a pipeline or as a CloudFormation hook. Being usable both in the pipeline and as a hook is the practical value: the same rules give fast feedback in review and enforcement at the API. Naming that dual deployment is what distinguishes a real policy implementation from a linting step.

Question 36

How do you deploy IaC across many accounts?

Accepted Answer

CloudFormation StackSets with service-managed permissions for organisation-wide baselines, automatically deploying to new accounts in an OU. For Terraform, a pipeline that assumes a role in each target account with per-account state, driven by a list of accounts, or a tool such as Terragrunt for orchestration. The automatic-enrolment property of StackSets is what makes them the right tool for guardrails, since a new account is compliant from creation. Terraform requires you to build that enrolment yourself, which is a real difference at organisation scale.

Question 37

What is the difference between provisioning and configuration management?

Accepted Answer

Provisioning creates infrastructure — CloudFormation, CDK, Terraform. Configuration management maintains the state inside a server — Ansible, Chef, Systems Manager State Manager. With immutable infrastructure the second largely disappears, because you rebuild the image rather than converge a running server. The modern position is that immutable infrastructure replaces most configuration management: bake the image, replace instances. Configuration management remains relevant for long-lived stateful servers that cannot be recreated, which is worth naming as the exception.

Question 38

How do you keep infrastructure and application deployment separate?

Accepted Answer

Run them as separate pipelines with a clear interface: infrastructure defines the platform and exports identifiers such as cluster name, role ARNs and queue URLs; the application pipeline deploys artefacts into it. They change at different rates, so coupling them makes both slower. The failure of coupling is that a Terraform apply on every application release is slow, risky and makes rollback awkward. Naming the interface — parameters or outputs the application pipeline consumes — is what makes the separation concrete.

Question 39

Design the IaC setup for a company adopting AWS from scratch.

Accepted Answer

Control Tower and Organizations for the account structure, with StackSets deploying organisation-wide baselines — Config rules, CloudTrail, IAM roles, guardrails — automatically to new accounts. A pipeline-only deployment model with no human apply permission, using OIDC federation from the CI system to per-environment roles. Terraform or CDK for workload infrastructure with state split by blast radius, shared versioned modules or constructs, policy-as-code and change-set review on every pull request, and approval gates on production. Service Catalog or a paved-path module library so teams self-serve compliant infrastructure. The closing scenario. The senior markers are automatic baseline enrolment for new accounts, removing human apply access entirely, and providing a paved path so the compliant route is also the easiest one — mandates without tooling produce workarounds.

AWS CloudFormation, CDK & Terraform Interview Questions and Answers

How to use this set