Domain 2: Infrastructure as Code on Album69

AWS CDK (Cloud Development Kit)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CDK is an open-source software development framework for defining cloud infrastructure using familiar programming languages like TypeScript, Python, Java, C#, and Go.

Key Characteristics

Programming languages - Use familiar languages instead of JSON/YAML
Higher-level abstractions - Constructs provide sensible defaults
Type safety - Compile-time error checking
IDE support - IntelliSense, refactoring, debugging
Reusable components - Share constructs across projects
CloudFormation integration - Synthesizes to CloudFormation templates
AWS service integration - Native support for all AWS services

What Problem Does It Solve?

Eliminates verbose CloudFormation JSON/YAML syntax
Provides programming language benefits (loops, conditions, functions)
Enables infrastructure testing with standard testing frameworks
Facilitates code reuse through object-oriented programming
Supports complex logic and data transformations
Integrates with existing development workflows

2. Core Concepts

Constructs

// Level 1 (L1) - Direct CloudFormation mapping
import { CfnBucket } from 'aws-cdk-lib/aws-s3';

const cfnBucket = new CfnBucket(this, 'MyBucket', {
 bucketName: 'my-bucket-name',
 versioningConfiguration: {
 status: 'Enabled'
 }
});

// Level 2 (L2) - Higher-level with sensible defaults
import { Bucket, BucketEncryption } from 'aws-cdk-lib/aws-s3';

const bucket = new Bucket(this, 'MyBucket', {
 bucketName: 'my-bucket-name',
 versioned: true,
 encryption: BucketEncryption.S3_MANAGED,
 removalPolicy: RemovalPolicy.DESTROY
});

// Level 3 (L3) - Patterns combining multiple resources
import { ApplicationLoadBalancedFargateService } from 'aws-cdk-lib/aws-ecs-patterns';

const service = new ApplicationLoadBalancedFargateService(this, 'MyService', {
 taskImageOptions: {
 image: ContainerImage.fromRegistry('nginx'),
 containerPort: 80
 },
 memoryLimitMiB: 512,
 cpu: 256,
 desiredCount: 2
});

Stacks and Apps

// app.ts
import { App } from 'aws-cdk-lib';
import { VpcStack } from './vpc-stack';
import { DatabaseStack } from './database-stack';
import { WebStack } from './web-stack';

const app = new App();

const vpcStack = new VpcStack(app, 'VpcStack', {
 env: {
 account: process.env.CDK_DEFAULT_ACCOUNT,
 region: process.env.CDK_DEFAULT_REGION
 }
});

const dbStack = new DatabaseStack(app, 'DatabaseStack', {
 vpc: vpcStack.vpc,
 env: vpcStack.env
});

const webStack = new WebStack(app, 'WebStack', {
 vpc: vpcStack.vpc,
 database: dbStack.database,
 env: vpcStack.env
});

// Add dependencies
dbStack.addDependency(vpcStack);
webStack.addDependency(dbStack);

Stack Definition

// vpc-stack.ts
import { Stack, StackProps } from 'aws-cdk-lib';
import { Vpc, SubnetType } from 'aws-cdk-lib/aws-ec2';
import { Construct } from 'constructs';

export interface VpcStackProps extends StackProps {
 cidrBlock?: string;
}

export class VpcStack extends Stack {
 public readonly vpc: Vpc;

 constructor(scope: Construct, id: string, props?: VpcStackProps) {
 super(scope, id, props);

 this.vpc = new Vpc(this, 'MainVpc', {
 cidr: props?.cidrBlock || '10.0.0.0/16',
 maxAzs: 3,
 subnetConfiguration: [
 {
 cidrMask: 24,
 name: 'Public',
 subnetType: SubnetType.PUBLIC
 },
 {
 cidrMask: 24,
 name: 'Private',
 subnetType: SubnetType.PRIVATE_WITH_EGRESS
 },
 {
 cidrMask: 28,
 name: 'Database',
 subnetType: SubnetType.PRIVATE_ISOLATED
 }
 ],
 natGateways: 1
 });
 }
}

3. CDK Pipelines

Self-Mutating Pipeline

// pipeline-stack.ts
import { Stack, StackProps } from 'aws-cdk-lib';
import { CodePipeline, CodePipelineSource, ShellStep } from 'aws-cdk-lib/pipelines';
import { Repository } from 'aws-cdk-lib/aws-codecommit';

export class PipelineStack extends Stack {
 constructor(scope: Construct, id: string, props?: StackProps) {
 super(scope, id, props);

 const repo = Repository.fromRepositoryName(this, 'Repo', 'my-cdk-app');

 const pipeline = new CodePipeline(this, 'Pipeline', {
 pipelineName: 'MyAppPipeline',
 synth: new ShellStep('Synth', {
 input: CodePipelineSource.codeCommit(repo, 'main'),
 commands: [
 'npm ci',
 'npm run build',
 'npx cdk synth'
 ]
 })
 });

 // Add application stages
 const devStage = new MyAppStage(this, 'Dev', {
 env: { account: '111111111111', region: 'us-east-1' }
 });
 
 const prodStage = new MyAppStage(this, 'Prod', {
 env: { account: '222222222222', region: 'us-east-1' }
 });

 pipeline.addStage(devStage, {
 pre: [
 new ShellStep('UnitTests', {
 commands: ['npm test']
 })
 ],
 post: [
 new ShellStep('IntegrationTests', {
 commands: ['npm run test:integration']
 })
 ]
 });

 pipeline.addStage(prodStage, {
 pre: [
 new ManualApprovalStep('PromoteToProd')
 ]
 });
 }
}

Application Stage

// app-stage.ts
import { Stage, StageProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { VpcStack } from './vpc-stack';
import { DatabaseStack } from './database-stack';
import { WebStack } from './web-stack';

export class MyAppStage extends Stage {
 constructor(scope: Construct, id: string, props?: StageProps) {
 super(scope, id, props);

 const vpcStack = new VpcStack(this, 'VpcStack');
 const dbStack = new DatabaseStack(this, 'DatabaseStack', {
 vpc: vpcStack.vpc
 });
 const webStack = new WebStack(this, 'WebStack', {
 vpc: vpcStack.vpc,
 database: dbStack.database
 });
 }
}

4. Testing CDK Applications

Unit Testing

// test/vpc-stack.test.ts
import { Template } from 'aws-cdk-lib/assertions';
import { App } from 'aws-cdk-lib';
import { VpcStack } from '../lib/vpc-stack';

describe('VpcStack', () => {
 test('creates VPC with correct configuration', () => {
 const app = new App();
 const stack = new VpcStack(app, 'TestVpcStack');
 const template = Template.fromStack(stack);

 // Assert VPC exists
 template.hasResourceProperties('AWS::EC2::VPC', {
 CidrBlock: '10.0.0.0/16',
 EnableDnsHostnames: true,
 EnableDnsSupport: true
 });

 // Assert subnets are created
 template.resourceCountIs('AWS::EC2::Subnet', 6); // 3 AZs * 2 subnet types
 
 // Assert NAT Gateway exists
 template.resourceCountIs('AWS::EC2::NatGateway', 1);
 });

 test('allows custom CIDR block', () => {
 const app = new App();
 const stack = new VpcStack(app, 'TestVpcStack', {
 cidrBlock: '172.16.0.0/16'
 });
 const template = Template.fromStack(stack);

 template.hasResourceProperties('AWS::EC2::VPC', {
 CidrBlock: '172.16.0.0/16'
 });
 });
});

Integration Testing

// test/integration.test.ts
import { IntegTest } from '@aws-cdk/integ-tests-alpha';
import { App } from 'aws-cdk-lib';
import { VpcStack } from '../lib/vpc-stack';

const app = new App();
const stack = new VpcStack(app, 'IntegTestVpcStack');

new IntegTest(app, 'VpcIntegTest', {
 testCases: [stack],
 diffAssets: true,
 stackUpdateWorkflow: true
});

5. Custom Constructs

Reusable Construct

// lib/constructs/web-server.ts
import { Construct } from 'constructs';
import { Instance, InstanceType, MachineImage, Vpc, SecurityGroup } from 'aws-cdk-lib/aws-ec2';
import { Role, ServicePrincipal, ManagedPolicy } from 'aws-cdk-lib/aws-iam';

export interface WebServerProps {
 vpc: Vpc;
 instanceType?: InstanceType;
 keyName?: string;
}

export class WebServer extends Construct {
 public readonly instance: Instance;
 public readonly securityGroup: SecurityGroup;

 constructor(scope: Construct, id: string, props: WebServerProps) {
 super(scope, id);

 // Security Group
 this.securityGroup = new SecurityGroup(this, 'SecurityGroup', {
 vpc: props.vpc,
 description: 'Security group for web server',
 allowAllOutbound: true
 });

 this.securityGroup.addIngressRule(
 Peer.anyIpv4(),
 Port.tcp(80),
 'Allow HTTP traffic'
 );

 this.securityGroup.addIngressRule(
 Peer.anyIpv4(),
 Port.tcp(443),
 'Allow HTTPS traffic'
 );

 // IAM Role
 const role = new Role(this, 'Role', {
 assumedBy: new ServicePrincipal('ec2.amazonaws.com'),
 managedPolicies: [
 ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore')
 ]
 });

 // EC2 Instance
 this.instance = new Instance(this, 'Instance', {
 vpc: props.vpc,
 instanceType: props.instanceType || InstanceType.of(InstanceClass.T3, InstanceSize.MICRO),
 machineImage: MachineImage.latestAmazonLinux(),
 securityGroup: this.securityGroup,
 role: role,
 keyName: props.keyName,
 userData: UserData.forLinux()
 });

 // User data script
 this.instance.userData.addCommands(
 'yum update -y',
 'yum install -y httpd',
 'systemctl start httpd',
 'systemctl enable httpd',
 'echo "<h1>Hello from CDK!</h1>" > /var/www/html/index.html'
 );
 }
}

Using Custom Construct

// lib/web-stack.ts
import { Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import { WebServer } from './constructs/web-server';

export interface WebStackProps extends StackProps {
 vpc: Vpc;
}

export class WebStack extends Stack {
 constructor(scope: Construct, id: string, props: WebStackProps) {
 super(scope, id, props);

 const webServer = new WebServer(this, 'WebServer', {
 vpc: props.vpc,
 instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.SMALL)
 });

 new CfnOutput(this, 'WebServerInstanceId', {
 value: webServer.instance.instanceId,
 description: 'Web server instance ID'
 });
 }
}

6. Environment and Context

Environment Configuration

// cdk.json
{
 "app": "npx ts-node --prefer-ts-exts bin/app.ts",
 "context": {
 "@aws-cdk/core:enableStackNameDuplicates": true,
 "aws-cdk:enableDiffNoFail": true,
 "@aws-cdk/core:stackRelativeExports": true
 }
}

// Environment-specific configuration
const app = new App();

// Development environment
new MyAppStack(app, 'MyApp-Dev', {
 env: {
 account: '111111111111',
 region: 'us-east-1'
 },
 tags: {
 Environment: 'Development',
 CostCenter: 'Engineering'
 }
});

// Production environment
new MyAppStack(app, 'MyApp-Prod', {
 env: {
 account: '222222222222',
 region: 'us-east-1'
 },
 tags: {
 Environment: 'Production',
 CostCenter: 'Operations'
 }
});

Context Values

// Using context for configuration
export class MyStack extends Stack {
 constructor(scope: Construct, id: string, props?: StackProps) {
 super(scope, id, props);

 const instanceType = this.node.tryGetContext('instanceType') || 't3.micro';
 const enableMonitoring = this.node.tryGetContext('enableMonitoring') === 'true';
 
 const instance = new Instance(this, 'Instance', {
 instanceType: new InstanceType(instanceType),
 // ... other properties
 });

 if (enableMonitoring) {
 // Add CloudWatch monitoring
 }
 }
}

// Set context via CLI
// cdk deploy -c instanceType=t3.small -c enableMonitoring=true

7. CDK CLI Commands

# Initialize new CDK project
cdk init app --language typescript
cdk init app --language python

# Install dependencies
npm install
pip install -r requirements.txt

# Synthesize CloudFormation template
cdk synth
cdk synth MyStack

# Deploy stacks
cdk deploy
cdk deploy MyStack
cdk deploy --all

# Destroy stacks
cdk destroy
cdk destroy MyStack

# Diff changes
cdk diff
cdk diff MyStack

# List stacks
cdk list

# Bootstrap CDK environment
cdk bootstrap
cdk bootstrap aws://123456789012/us-east-1

# Watch for changes (CDK v2)
cdk watch
cdk watch MyStack

8. CDK vs CloudFormation vs Terraform

Feature	CDK	CloudFormation	Terraform
Language	Programming languages	JSON/YAML	HCL
Type Safety	Yes	No	Limited
IDE Support	Full	Limited	Good
Testing	Unit/Integration	Limited	Limited
Reusability	High (OOP)	Medium (nested stacks)	High (modules)
Learning Curve	Moderate	Steep	Moderate
Multi-cloud	AWS only	AWS only	Yes
State Management	CloudFormation	AWS managed	External

9. Common Exam Scenarios

Scenario 1: Multi-Stack Application

// Cross-stack references
export class DatabaseStack extends Stack {
 public readonly database: DatabaseInstance;
 
 constructor(scope: Construct, id: string, props: StackProps) {
 super(scope, id, props);
 
 this.database = new DatabaseInstance(this, 'Database', {
 // configuration
 });
 }
}

export class WebStack extends Stack {
 constructor(scope: Construct, id: string, props: WebStackProps) {
 super(scope, id, props);
 
 // Reference database from another stack
 const dbEndpoint = props.database.instanceEndpoint.hostname;
 
 // Use in application configuration
 }
}

Scenario 2: Conditional Resources

export class ConditionalStack extends Stack {
 constructor(scope: Construct, id: string, props?: StackProps) {
 super(scope, id, props);

 const environment = this.node.tryGetContext('environment') || 'dev';
 
 // Conditional resource creation
 if (environment === 'prod') {
 new DatabaseInstance(this, 'Database', {
 instanceType: InstanceType.of(InstanceClass.R5, InstanceSize.LARGE),
 multiAz: true,
 backupRetention: Duration.days(30)
 });
 } else {
 new DatabaseInstance(this, 'Database', {
 instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MICRO),
 multiAz: false,
 backupRetention: Duration.days(7)
 });
 }
 }
}

Scenario 3: Custom Resource

import { CustomResource, CustomResourceProvider } from 'aws-cdk-lib';
import { Function, Runtime, Code } from 'aws-cdk-lib/aws-lambda';

export class CustomResourceStack extends Stack {
 constructor(scope: Construct, id: string, props?: StackProps) {
 super(scope, id, props);

 // Lambda function for custom resource
 const customResourceLambda = new Function(this, 'CustomResourceLambda', {
 runtime: Runtime.PYTHON_3_9,
 handler: 'index.handler',
 code: Code.fromInline(`
import boto3
import json

def handler(event, context):
 if event['RequestType'] == 'Create':
 # Custom logic here
 return {
 'PhysicalResourceId': 'custom-resource-id',
 'Data': {'Result': 'Success'}
 }
 return {'PhysicalResourceId': event['PhysicalResourceId']}
 `)
 });

 // Custom resource
 const customResource = new CustomResource(this, 'CustomResource', {
 serviceToken: customResourceLambda.functionArn,
 properties: {
 CustomProperty: 'CustomValue'
 }
 });
 }
}

10. Exam Tips

Understand construct levels - L1, L2, L3 constructs and when to use each
Master stack dependencies - Cross-stack references and deployment order
Know CDK Pipelines - Self-mutating pipelines and multi-environment deployment
Practice testing - Unit tests with assertions, integration tests
Understand synthesis - How CDK generates CloudFormation templates
Learn custom constructs - Creating reusable components
Know CLI commands - Bootstrap, deploy, diff, destroy operations
Understand context - Environment-specific configuration
Practice with patterns - Common architectural patterns in CDK
Compare with alternatives - When to use CDK vs CloudFormation vs Terraform

AWS CloudFormation

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CloudFormation is a service that helps you model and set up your AWS resources using Infrastructure as Code (IaC). You create templates that describe your AWS resources, and CloudFormation provisions and configures those resources for you.

Key Characteristics

Infrastructure as Code - Define infrastructure in JSON/YAML templates
Declarative - Specify what you want, not how to create it
Version controlled - Templates can be stored in source control
Repeatable - Create identical environments consistently
Rollback capable - Automatic rollback on failure
Change management - Preview changes before applying
Cross-region - Deploy to multiple regions

What Problem Does It Solve?

Eliminates manual resource provisioning
Ensures consistent infrastructure deployment
Enables version control of infrastructure
Provides automated rollback on failures
Manages resource dependencies automatically
Enables infrastructure replication across environments
Supports compliance and governance requirements

2. Core Concepts

Template

JSON or YAML file describing AWS resources
Declarative specification of infrastructure
Version controlled and reusable
Maximum size: 460,800 bytes (450 KB)

Stack

Collection of AWS resources created from template
Unit of deployment and management
Has lifecycle (create, update, delete)
Resources created/updated/deleted together

Change Set

Preview of changes before stack update
Shows what will be added, modified, or deleted
Allows review before execution
Can be executed or discarded

Parameters

Input values for templates
Make templates reusable and flexible
Can have default values and constraints
Referenced using !Ref or Ref function

Outputs

Values returned from stack
Can be exported for use by other stacks
Useful for sharing resource information
Referenced using !ImportValue function

Resources

AWS resources to be created
Only required section in template
Each resource has Type and Properties
Can reference other resources

Mappings

Static lookup tables in template
Key-value pairs for conditional logic
Often used for AMI IDs by region
Referenced using !FindInMap function

Conditions

Control resource creation based on parameters
Boolean logic (equals, not equals, and, or)
Applied to resources and outputs
Evaluated at stack creation/update time

3. Template Structure

Basic Template Structure (YAML)

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Sample CloudFormation template'

Parameters:
 EnvironmentName:
 Type: String
 Default: Development
 AllowedValues:
 - Development
 - Staging
 - Production
 Description: Environment name

 InstanceType:
 Type: String
 Default: t3.micro
 AllowedValues:
 - t3.micro
 - t3.small
 - t3.medium
 Description: EC2 instance type

Mappings:
 RegionMap:
 us-east-1:
 AMI: ami-0abcdef1234567890
 us-west-2:
 AMI: ami-0fedcba0987654321

Conditions:
 IsProduction: !Equals [!Ref EnvironmentName, Production]
 CreateLargeInstance: !Equals [!Ref InstanceType, t3.medium]

Resources:
 MyVPC:
 Type: AWS::EC2::VPC
 Properties:
 CidrBlock: 10.0.0.0/16
 EnableDnsHostnames: true
 EnableDnsSupport: true
 Tags:
 - Key: Name
 Value: !Sub '${EnvironmentName}-VPC'

 MySubnet:
 Type: AWS::EC2::Subnet
 Properties:
 VpcId: !Ref MyVPC
 CidrBlock: 10.0.1.0/24
 AvailabilityZone: !Select [0, !GetAZs '']
 MapPublicIpOnLaunch: true
 Tags:
 - Key: Name
 Value: !Sub '${EnvironmentName}-Subnet'

 MySecurityGroup:
 Type: AWS::EC2::SecurityGroup
 Properties:
 GroupDescription: Security group for web server
 VpcId: !Ref MyVPC
 SecurityGroupIngress:
 - IpProtocol: tcp
 FromPort: 80
 ToPort: 80
 CidrIp: 0.0.0.0/0
 - IpProtocol: tcp
 FromPort: 443
 ToPort: 443
 CidrIp: 0.0.0.0/0

 MyInstance:
 Type: AWS::EC2::Instance
 Condition: IsProduction
 Properties:
 ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]
 InstanceType: !Ref InstanceType
 SubnetId: !Ref MySubnet
 SecurityGroupIds:
 - !Ref MySecurityGroup
 Tags:
 - Key: Name
 Value: !Sub '${EnvironmentName}-Instance'

Outputs:
 VPCId:
 Description: VPC ID
 Value: !Ref MyVPC
 Export:
 Name: !Sub '${EnvironmentName}-VPC-ID'

 InstanceId:
 Description: Instance ID
 Value: !Ref MyInstance
 Condition: IsProduction

 WebsiteURL:
 Description: Website URL
 Value: !Sub 'http://${MyInstance.PublicDnsName}'
 Condition: IsProduction

Template Structure (JSON)

{
 "AWSTemplateFormatVersion": "2010-09-09",
 "Description": "Sample CloudFormation template",
 "Parameters": {
 "InstanceType": {
 "Type": "String",
 "Default": "t3.micro",
 "AllowedValues": ["t3.micro", "t3.small", "t3.medium"]
 }
 },
 "Resources": {
 "MyInstance": {
 "Type": "AWS::EC2::Instance",
 "Properties": {
 "ImageId": "ami-0abcdef1234567890",
 "InstanceType": {"Ref": "InstanceType"}
 }
 }
 },
 "Outputs": {
 "InstanceId": {
 "Value": {"Ref": "MyInstance"}
 }
 }
}

4. Intrinsic Functions

Common Functions

!Ref (Reference)

# Reference parameter
InstanceType: !Ref InstanceTypeParameter

# Reference resource (returns resource ID)
VpcId: !Ref MyVPC

!GetAtt (Get Attribute)

# Get resource attribute
PublicIP: !GetAtt MyInstance.PublicIp
DNSName: !GetAtt MyLoadBalancer.DNSName

!Sub (Substitute)

# String substitution
Name: !Sub '${EnvironmentName}-${AWS::Region}-bucket'
UserData: !Sub |
 #!/bin/bash
 echo "Instance ID: ${AWS::InstanceId}" > /tmp/instance-info

!Join

# Join strings with delimiter
SecurityGroupIds: !Join
 - ','
 - - !Ref SecurityGroup1
 - !Ref SecurityGroup2

!Select

# Select item from list by index
AvailabilityZone: !Select [0, !GetAZs '']

!GetAZs

# Get availability zones for region
AvailabilityZones: !GetAZs ''
SpecificRegionAZs: !GetAZs 'us-west-2'

!FindInMap

# Find value in mapping
ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]

!ImportValue

# Import exported value from another stack
VpcId: !ImportValue NetworkStack-VPC-ID

!If (Conditional)

# Conditional value assignment
InstanceType: !If [IsProduction, t3.large, t3.micro]

!Equals, !And, !Or, !Not

Conditions:
 IsProduction: !Equals [!Ref Environment, Production]
 IsLargeInstance: !Equals [!Ref InstanceType, t3.large]
 CreateProdLarge: !And
 - !Condition IsProduction
 - !Condition IsLargeInstance
 NotDevelopment: !Not [!Equals [!Ref Environment, Development]]

5. Stack Operations

Stack Lifecycle

Create Stack

aws cloudformation create-stack \
 --stack-name my-stack \
 --template-body file://template.yaml \
 --parameters ParameterKey=InstanceType,ParameterValue=t3.small \
 --capabilities CAPABILITY_IAM

Update Stack

aws cloudformation update-stack \
 --stack-name my-stack \
 --template-body file://updated-template.yaml \
 --parameters ParameterKey=InstanceType,ParameterValue=t3.medium

Delete Stack

aws cloudformation delete-stack --stack-name my-stack

Change Sets

Create Change Set

aws cloudformation create-change-set \
 --stack-name my-stack \
 --change-set-name my-changeset \
 --template-body file://updated-template.yaml \
 --parameters ParameterKey=InstanceType,ParameterValue=t3.medium

Execute Change Set

aws cloudformation execute-change-set \
 --change-set-name my-changeset \
 --stack-name my-stack

Stack Policies

{
 "Statement": [
 {
 "Effect": "Deny",
 "Principal": "*",
 "Action": "Update:Delete",
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "ResourceType": ["AWS::RDS::DBInstance"]
 }
 }
 },
 {
 "Effect": "Allow",
 "Principal": "*",
 "Action": "Update:*",
 "Resource": "*"
 }
 ]
}

6. Nested Stacks & Cross-Stack References

Nested Stacks

Resources:
 NetworkStack:
 Type: AWS::CloudFormation::Stack
 Properties:
 TemplateURL: https://s3.amazonaws.com/my-bucket/network-template.yaml
 Parameters:
 VpcCidr: 10.0.0.0/16
 Environment: !Ref Environment
 TimeoutInMinutes: 10

 ApplicationStack:
 Type: AWS::CloudFormation::Stack
 DependsOn: NetworkStack
 Properties:
 TemplateURL: https://s3.amazonaws.com/my-bucket/app-template.yaml
 Parameters:
 VpcId: !GetAtt NetworkStack.Outputs.VpcId
 SubnetId: !GetAtt NetworkStack.Outputs.SubnetId

Cross-Stack References

Export from Stack A

Outputs:
 VPCId:
 Description: VPC ID
 Value: !Ref MyVPC
 Export:
 Name: !Sub '${AWS::StackName}-VPC-ID'

Import in Stack B

Resources:
 MyInstance:
 Type: AWS::EC2::Instance
 Properties:
 SubnetId: !ImportValue NetworkStack-Subnet-ID
 SecurityGroupIds:
 - !ImportValue NetworkStack-SecurityGroup-ID

7. IAM Roles & Permissions

CloudFormation Service Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "ec2:*",
 "s3:*",
 "iam:*",
 "rds:*",
 "lambda:*"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:UpdateStack",
 "cloudformation:DeleteStack",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackEvents",
 "cloudformation:DescribeStackResources"
 ],
 "Resource": "*"
 }
 ]
}

User Permissions for CloudFormation

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateStack",
 "cloudformation:UpdateStack",
 "cloudformation:DeleteStack",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackEvents",
 "cloudformation:DescribeStackResources",
 "cloudformation:CreateChangeSet",
 "cloudformation:ExecuteChangeSet",
 "cloudformation:DescribeChangeSet",
 "cloudformation:DeleteChangeSet"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": "iam:PassRole",
 "Resource": "arn:aws:iam::123456789012:role/CloudFormationServiceRole"
 }
 ]
}

Resource-Level Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": "cloudformation:*",
 "Resource": [
 "arn:aws:cloudformation:us-east-1:123456789012:stack/MyApp-*/*",
 "arn:aws:cloudformation:us-east-1:123456789012:stackset/MyApp-*:*"
 ]
 }
 ]
}

8. Advanced Features

Custom Resources

Resources:
 CustomResource:
 Type: AWS::CloudFormation::CustomResource
 Properties:
 ServiceToken: !GetAtt CustomResourceFunction.Arn
 CustomProperty1: Value1
 CustomProperty2: Value2

 CustomResourceFunction:
 Type: AWS::Lambda::Function
 Properties:
 Runtime: python3.9
 Handler: index.handler
 Code:
 ZipFile: |
 import json
 import boto3
 import cfnresponse
 
 def handler(event, context):
 try:
 if event['RequestType'] == 'Create':
 # Custom create logic
 response_data = {'Message': 'Resource created'}
 elif event['RequestType'] == 'Update':
 # Custom update logic
 response_data = {'Message': 'Resource updated'}
 elif event['RequestType'] == 'Delete':
 # Custom delete logic
 response_data = {'Message': 'Resource deleted'}
 
 cfnresponse.send(event, context, cfnresponse.SUCCESS, response_data)
 except Exception as e:
 cfnresponse.send(event, context, cfnresponse.FAILED, {})

Stack Sets

# Create stack set
aws cloudformation create-stack-set \
 --stack-set-name my-stackset \
 --template-body file://template.yaml \
 --capabilities CAPABILITY_IAM

# Create stack instances
aws cloudformation create-stack-instances \
 --stack-set-name my-stackset \
 --accounts 123456789012 210987654321 \
 --regions us-east-1 us-west-2

Drift Detection

# Detect drift
aws cloudformation detect-stack-drift --stack-name my-stack

# Get drift results
aws cloudformation describe-stack-drift-detection-status \
 --stack-drift-detection-id drift-detection-id

9. Integration with CI/CD Services

CodePipeline Integration

- Name: Deploy
 Actions:
 - Name: CreateChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyStack
 ChangeSetName: MyChangeSet
 TemplatePath: BuildArtifact::template.yaml
 Capabilities: CAPABILITY_IAM
 RoleArn: arn:aws:iam::123456789012:role/CloudFormationRole
 InputArtifacts:
 - Name: BuildArtifact

 - Name: ExecuteChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_EXECUTE
 StackName: MyStack
 ChangeSetName: MyChangeSet
 RunOrder: 2

CodeBuild Integration

# buildspec.yml
version: 0.2
phases:
 install:
 runtime-versions:
 python: 3.9
 pre_build:
 commands:
 - pip install cfn-lint
 build:
 commands:
 - cfn-lint template.yaml
 - aws cloudformation validate-template --template-body file://template.yaml
 post_build:
 commands:
 - echo "Template validation completed"
artifacts:
 files:
 - template.yaml
 - parameters.json

Parameter Overrides in Pipeline

{
 "ParameterOverrides": {
 "Environment": "Production",
 "InstanceType": "t3.large",
 "DBPassword": {"Fn::GetParam": ["MyParameters", "parameters.json", "DBPassword"]}
 }
}

10. Security Best Practices

Template Security

Use least privilege IAM roles
Avoid hardcoding secrets in templates
Use AWS Secrets Manager or Parameter Store
Enable termination protection for critical stacks
Use stack policies to prevent accidental deletions

Secrets Management

Parameters:
 DBPassword:
 Type: String
 NoEcho: true
 Description: Database password

Resources:
 DBInstance:
 Type: AWS::RDS::DBInstance
 Properties:
 MasterUserPassword: !Ref DBPassword
 # Better approach: use Secrets Manager
 ManageMasterUserPassword: true
 MasterUserSecret:
 Description: RDS Master User Secret
 KmsKeyId: alias/aws/secretsmanager

Using Secrets Manager

Resources:
 DBSecret:
 Type: AWS::SecretsManager::Secret
 Properties:
 Description: RDS Master User Secret
 GenerateSecretString:
 SecretStringTemplate: '{"username": "admin"}'
 GenerateStringKey: 'password'
 PasswordLength: 16
 ExcludeCharacters: '"@/\'

 DBInstance:
 Type: AWS::RDS::DBInstance
 Properties:
 MasterUsername: !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:username}}'
 MasterUserPassword: !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:password}}'

Cross-Account Deployment

# Assume role for cross-account deployment
Resources:
 CrossAccountRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 AWS: arn:aws:iam::111111111111:root
 Action: sts:AssumeRole
 Condition:
 StringEquals:
 'sts:ExternalId': 'unique-external-id'

11. Monitoring & Troubleshooting

CloudWatch Events Integration

Resources:
 StackEventRule:
 Type: AWS::Events::Rule
 Properties:
 Description: Monitor CloudFormation stack events
 EventPattern:
 source:
 - aws.cloudformation
 detail-type:
 - CloudFormation Stack Status Change
 detail:
 status-details:
 status:
 - CREATE_FAILED
 - UPDATE_FAILED
 - DELETE_FAILED
 Targets:
 - Arn: !Ref SNSTopic
 Id: StackFailureNotification

Stack Notifications

Resources:
 MyStack:
 Type: AWS::CloudFormation::Stack
 Properties:
 TemplateURL: https://s3.amazonaws.com/my-bucket/template.yaml
 NotificationARNs:
 - !Ref SNSTopic

Common Issues & Solutions

Stack Rollback

Cause: Resource creation failure
Solution: Check CloudFormation events, fix template, retry
Prevention: Validate template, test in dev environment

Resource Already Exists

Cause: Resource name conflict
Solution: Use unique names, check existing resources
Prevention: Use dynamic naming with !Sub function

Insufficient Permissions

Cause: IAM role lacks required permissions
Solution: Add necessary permissions to service role
Prevention: Use least privilege principle

Template Size Limit

Cause: Template exceeds 460KB limit
Solution: Use nested stacks, store template in S3
Prevention: Modularize templates

Troubleshooting Commands

# Describe stack events
aws cloudformation describe-stack-events --stack-name my-stack

# Get stack status
aws cloudformation describe-stacks --stack-name my-stack

# List stack resources
aws cloudformation list-stack-resources --stack-name my-stack

# Describe failed resource
aws cloudformation describe-stack-resource \
 --stack-name my-stack \
 --logical-resource-id MyResource

12. Common Exam Scenarios

Solution:

AWS CloudFormation Advanced Features

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

This document covers advanced CloudFormation features that are critical for the DOP-C02 exam but not covered in the general CloudFormation notes. These include StackSets, Custom Resources, Dynamic References, CloudFormation Registry, and advanced deployment patterns.

Key Advanced Features

StackSets - Multi-account and multi-region deployments
Custom Resources - Extend CloudFormation with Lambda
Dynamic References - Retrieve values from Parameter Store and Secrets Manager
CloudFormation Registry - Third-party resource providers
Rollback Configuration - Advanced rollback controls
Stack Notifications - SNS integration for stack events
Termination Protection - Prevent accidental stack deletion

2. StackSets

Overview

StackSets enable you to create, update, or delete stacks across multiple accounts and regions with a single operation.

AWS CloudFormation Drift Detection

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CloudFormation Drift Detection is a feature that identifies differences between the expected configuration of stack resources (as defined in CloudFormation templates) and their actual configuration in AWS. This helps maintain infrastructure consistency and detect unauthorized or accidental changes.

Key Characteristics

Configuration validation - Compares actual vs expected resource state
Automated detection - Identifies configuration drift across resources
Detailed reporting - Shows specific property differences
Stack-level analysis - Analyzes entire stacks or individual resources
Non-intrusive - Read-only operation, doesn’t modify resources
Scheduled capability - Can be automated for regular monitoring
Compliance support - Helps maintain governance and compliance

What Problem Does It Solve?

Detects manual changes made outside CloudFormation
Identifies configuration drift from intended state
Supports compliance and governance requirements
Helps troubleshoot unexpected resource behavior
Enables proactive infrastructure management
Provides audit trail for configuration changes
Supports automated remediation workflows

2. Core Concepts

Drift Detection

Process of comparing actual resource configuration with CloudFormation template
Identifies resources that have drifted from expected state
Provides detailed analysis of configuration differences
Supports both stack-level and resource-level detection

Drift Status

IN_SYNC - Resource matches template configuration
MODIFIED - Resource has been changed outside CloudFormation
DELETED - Resource was deleted outside CloudFormation
NOT_CHECKED - Resource doesn’t support drift detection

Stack Drift Status

DRIFTED - One or more resources have drifted
IN_SYNC - All resources match template configuration
UNKNOWN - Drift detection hasn’t been performed
NOT_CHECKED - Stack contains resources that don’t support drift detection

Drift Detection Operation

Asynchronous process that analyzes stack resources
Returns operation ID for tracking progress
Generates detailed drift report upon completion
Can be performed on entire stack or specific resources

Supported Resources

Most AWS resources support drift detection
Some resources have limitations or exclusions
New resources continuously added to support list
Custom resources don’t support drift detection

3. Drift Detection Process

Detection Workflow

Initiate Detection - Start drift detection operation
Resource Analysis - Compare actual vs expected configuration
Status Determination - Classify each resource drift status
Report Generation - Create detailed drift report
Result Retrieval - Access drift detection results

Detection Scope

Stack-level - Analyze all resources in stack
Resource-level - Analyze specific resources
Nested stacks - Analyze parent and child stacks
Cross-stack references - Handle imported values

4. Configuration Examples

Basic Drift Detection

# Detect drift for entire stack
aws cloudformation detect-stack-drift --stack-name MyStack

# Detect drift for specific resources
aws cloudformation detect-stack-resource-drift \
 --stack-name MyStack \
 --logical-resource-id MyEC2Instance

Automated Drift Detection Lambda

import boto3
import json
import logging

logger = logging.getLogger()
logger.setLevel(logging.INFO)

cloudformation = boto3.client('cloudformation')
sns = boto3.client('sns')

def lambda_handler(event, context):
 """
 Automated drift detection for CloudFormation stacks
 """
 try:
 # Get stacks to monitor
 stacks_to_monitor = get_monitored_stacks()
 
 drift_results = []
 
 for stack_name in stacks_to_monitor:
 logger.info(f"Starting drift detection for stack: {stack_name}")
 
 # Initiate drift detection
 response = cloudformation.detect_stack_drift(StackName=stack_name)
 drift_detection_id = response['StackDriftDetectionId']
 
 # Wait for completion and get results
 drift_status = wait_for_drift_detection(drift_detection_id)
 
 if drift_status == 'DRIFTED':
 # Get detailed drift information
 drift_details = get_drift_details(stack_name)
 drift_results.append({
 'StackName': stack_name,
 'Status': drift_status,
 'Details': drift_details
 })
 
 logger.warning(f"Drift detected in stack: {stack_name}")
 
 # Send notifications if drift detected
 if drift_results:
 send_drift_notification(drift_results)
 
 return {
 'statusCode': 200,
 'body': json.dumps({
 'message': 'Drift detection completed',
 'drifted_stacks': len(drift_results)
 })
 }
 
 except Exception as e:
 logger.error(f"Error in drift detection: {str(e)}")
 raise

def get_monitored_stacks():
 """Get list of stacks to monitor for drift"""
 
 # Get stacks with specific tag
 paginator = cloudformation.get_paginator('describe_stacks')
 
 monitored_stacks = []
 for page in paginator.paginate():
 for stack in page['Stacks']:
 # Check for monitoring tag
 tags = stack.get('Tags', [])
 for tag in tags:
 if tag['Key'] == 'DriftMonitoring' and tag['Value'] == 'Enabled':
 monitored_stacks.append(stack['StackName'])
 break
 
 return monitored_stacks

def wait_for_drift_detection(drift_detection_id):
 """Wait for drift detection to complete"""
 
 import time
 
 while True:
 response = cloudformation.describe_stack_drift_detection_status(
 StackDriftDetectionId=drift_detection_id
 )
 
 status = response['DetectionStatus']
 
 if status in ['DETECTION_COMPLETE', 'DETECTION_FAILED']:
 return response.get('StackDriftStatus', 'UNKNOWN')
 
 time.sleep(10) # Wait 10 seconds before checking again

def get_drift_details(stack_name):
 """Get detailed drift information for stack"""
 
 try:
 response = cloudformation.describe_stack_resource_drifts(
 StackName=stack_name,
 StackResourceDriftStatusFilters=['MODIFIED', 'DELETED']
 )
 
 drift_details = []
 for drift in response['StackResourceDrifts']:
 drift_details.append({
 'LogicalResourceId': drift['LogicalResourceId'],
 'ResourceType': drift['ResourceType'],
 'DriftStatus': drift['StackResourceDriftStatus'],
 'PropertyDifferences': drift.get('PropertyDifferences', [])
 })
 
 return drift_details
 
 except Exception as e:
 logger.error(f"Error getting drift details: {str(e)}")
 return []

def send_drift_notification(drift_results):
 """Send SNS notification about detected drift"""
 
 topic_arn = 'arn:aws:sns:us-east-1:123456789012:cloudformation-drift-alerts'
 
 message = {
 'Subject': 'CloudFormation Drift Detected',
 'DriftedStacks': drift_results,
 'Timestamp': context.aws_request_id
 }
 
 sns.publish(
 TopicArn=topic_arn,
 Message=json.dumps(message, indent=2),
 Subject='CloudFormation Drift Alert'
 )

EventBridge Rule for Scheduled Drift Detection

Resources:
 DriftDetectionSchedule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Schedule drift detection for CloudFormation stacks'
 ScheduleExpression: 'cron(0 2 * * ? *)' # Daily at 2 AM UTC
 State: ENABLED
 Targets:
 - Arn: !GetAtt DriftDetectionFunction.Arn
 Id: DriftDetectionTarget

 DriftDetectionPermission:
 Type: AWS::Lambda::Permission
 Properties:
 FunctionName: !Ref DriftDetectionFunction
 Action: lambda:InvokeFunction
 Principal: events.amazonaws.com
 SourceArn: !GetAtt DriftDetectionSchedule.Arn

Drift Remediation Lambda

import boto3
import json

cloudformation = boto3.client('cloudformation')

def lambda_handler(event, context):
 """
 Automated drift remediation
 """
 
 # Parse drift detection results
 drift_results = json.loads(event['Records'][0]['Sns']['Message'])
 
 for stack_info in drift_results['DriftedStacks']:
 stack_name = stack_info['StackName']
 
 # Analyze drift details
 remediation_action = determine_remediation_action(stack_info)
 
 if remediation_action == 'UPDATE_STACK':
 # Update stack to bring resources back in sync
 update_stack_to_fix_drift(stack_name)
 elif remediation_action == 'IMPORT_RESOURCES':
 # Import manually created resources
 import_drifted_resources(stack_name, stack_info['Details'])
 elif remediation_action == 'ALERT_ONLY':
 # Just log and alert, no automatic remediation
 log_drift_for_manual_review(stack_name, stack_info)

def determine_remediation_action(stack_info):
 """Determine appropriate remediation action based on drift type"""
 
 # Analyze drift details to determine action
 for detail in stack_info['Details']:
 if detail['DriftStatus'] == 'DELETED':
 return 'UPDATE_STACK' # Recreate deleted resources
 elif detail['DriftStatus'] == 'MODIFIED':
 # Check if changes are safe to revert
 if is_safe_to_revert(detail):
 return 'UPDATE_STACK'
 else:
 return 'ALERT_ONLY'
 
 return 'ALERT_ONLY'

def is_safe_to_revert(drift_detail):
 """Check if drift changes are safe to automatically revert"""
 
 # Define safe properties that can be automatically reverted
 safe_properties = [
 'Tags',
 'Description'
 # NOTE: UserData is deliberately excluded - changing it in the template
 # does NOT touch an already-running instance, so an "automatic revert"
 # of UserData drift would silently no-op. Handle it via instance replacement.
 ]
 
 for prop_diff in drift_detail.get('PropertyDifferences', []):
 if prop_diff['PropertyPath'] not in safe_properties:
 return False
 
 return True

5. IAM Roles & Permissions

Drift Detection Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:DetectStackDrift",
 "cloudformation:DetectStackResourceDrift",
 "cloudformation:DescribeStackDriftDetectionStatus",
 "cloudformation:DescribeStackResourceDrifts",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackResources"
 ],
 "Resource": "*"
 }
 ]
}

Comprehensive Drift Management Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:DetectStackDrift",
 "cloudformation:DetectStackResourceDrift",
 "cloudformation:DescribeStackDriftDetectionStatus",
 "cloudformation:DescribeStackResourceDrifts",
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackResources",
 "cloudformation:ListStacks"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "ec2:Describe*",
 "s3:GetBucketLocation",
 "s3:GetBucketVersioning",
 "s3:GetBucketPolicy",
 "iam:GetRole",
 "iam:GetRolePolicy",
 "lambda:GetFunction",
 "rds:DescribeDBInstances"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "sns:Publish"
 ],
 "Resource": "arn:aws:sns:*:*:cloudformation-drift-*"
 }
 ]
}

Cross-Account Drift Detection

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": "arn:aws:iam::111111111111:role/DriftDetectionRole"
 },
 "Action": [
 "cloudformation:DetectStackDrift",
 "cloudformation:DescribeStackDriftDetectionStatus",
 "cloudformation:DescribeStackResourceDrifts"
 ],
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "aws:RequestedRegion": ["us-east-1", "us-west-2"]
 }
 }
 }
 ]
}

6. Integration with AWS Services

CloudWatch Integration

Resources:
 DriftDetectionAlarm:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmName: CloudFormation-Drift-Detected
 AlarmDescription: Alert when CloudFormation drift is detected
 MetricName: DriftDetected
 Namespace: CloudFormation/Drift
 Statistic: Sum
 Period: 300
 EvaluationPeriods: 1
 Threshold: 1
 ComparisonOperator: GreaterThanOrEqualToThreshold
 AlarmActions:
 - !Ref DriftNotificationTopic

 DriftMetricFilter:
 Type: AWS::Logs::MetricFilter
 Properties:
 LogGroupName: /aws/lambda/drift-detection-function
 FilterPattern: '[timestamp, requestId, level="ERROR", message="Drift detected"]'
 MetricTransformations:
 - MetricNamespace: CloudFormation/Drift
 MetricName: DriftDetected
 MetricValue: '1'

EventBridge Integration

Resources:
 DriftDetectionRule:
 Type: AWS::Events::Rule
 Properties:
 Description: 'Trigger on CloudFormation drift detection completion'
 EventPattern:
 source:
 - aws.cloudformation
 detail-type:
 - CloudFormation Drift Detection Status Change
 detail:
 status:
 - DETECTION_COMPLETE
 drift-status:
 - DRIFTED
 Targets:
 - Arn: !GetAtt DriftRemediationFunction.Arn
 Id: DriftRemediationTarget

AWS Config Integration

Resources:
 ConfigRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: cloudformation-stack-drift-detection-check
 Description: Checks whether CloudFormation stacks have drift detection enabled
 Source:
 Owner: AWS
 SourceIdentifier: CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK
 InputParameters: |
 {
 "cloudformationRoleArn": "arn:aws:iam::123456789012:role/ConfigRole"
 }

Systems Manager Integration

Resources:
 DriftDetectionDocument:
 Type: AWS::SSM::Document
 Properties:
 DocumentType: Automation
 Content:
 schemaVersion: '0.3'
 description: 'Automated CloudFormation drift detection and remediation'
 assumeRole: '{{ AutomationAssumeRole }}'
 parameters:
 StackName:
 type: String
 description: Name of the CloudFormation stack
 AutomationAssumeRole:
 type: String
 description: IAM role for automation
 mainSteps:
 - name: DetectDrift
 action: 'aws:executeAwsApi'
 inputs:
 Service: cloudformation
 Api: DetectStackDrift
 StackName: '{{ StackName }}'
 outputs:
 - Name: DriftDetectionId
 Selector: $.StackDriftDetectionId
 - name: WaitForDetection
 action: 'aws:waitForAwsResourceProperty'
 inputs:
 Service: cloudformation
 Api: DescribeStackDriftDetectionStatus
 StackDriftDetectionId: '{{ DetectDrift.DriftDetectionId }}'
 PropertySelector: $.DetectionStatus
 DesiredValues:
 - DETECTION_COMPLETE
 - name: CheckDriftStatus
 action: 'aws:executeAwsApi'
 inputs:
 Service: cloudformation
 Api: DescribeStackDriftDetectionStatus
 StackDriftDetectionId: '{{ DetectDrift.DriftDetectionId }}'

7. Security Best Practices

Least Privilege Access

Grant minimum permissions required for drift detection
Use resource-level permissions where possible
Implement time-based access controls
Regular audit of drift detection permissions

Secure Automation

def secure_drift_detection(stack_name, allowed_stacks):
 """Secure drift detection with validation"""
 
 # Validate stack name against allowed list
 if stack_name not in allowed_stacks:
 raise ValueError(f"Stack {stack_name} not authorized for drift detection")
 
 # Validate stack exists and is accessible
 try:
 cloudformation.describe_stacks(StackName=stack_name)
 except ClientError as e:
 if e.response['Error']['Code'] == 'ValidationError':
 raise ValueError(f"Stack {stack_name} does not exist")
 raise
 
 # Perform drift detection
 response = cloudformation.detect_stack_drift(StackName=stack_name)
 
 return response['StackDriftDetectionId']

Audit and Compliance

Resources:
 DriftDetectionTrail:
 Type: AWS::CloudTrail::Trail
 Properties:
 TrailName: CloudFormation-Drift-Detection-Audit
 S3BucketName: !Ref AuditBucket
 IncludeGlobalServiceEvents: true
 IsMultiRegionTrail: true
 EnableLogFileValidation: true
 EventSelectors:
 - ReadWriteType: All
 IncludeManagementEvents: true
 # NOTE: CloudFormation stacks are NOT a valid CloudTrail data-event resource type.
 # Data events cover S3 objects, Lambda functions, and DynamoDB streams.
 # For stack API auditing, rely on management events (default) instead.

8. Monitoring & Troubleshooting

CloudWatch Metrics for Drift Detection

import boto3

cloudwatch = boto3.client('cloudwatch')

def publish_drift_metrics(stack_name, drift_status, resource_count, drifted_count):
 """Publish custom metrics for drift detection"""
 
 cloudwatch.put_metric_data(
 Namespace='CloudFormation/Drift',
 MetricData=[
 {
 'MetricName': 'StacksChecked',
 'Dimensions': [
 {'Name': 'StackName', 'Value': stack_name}
 ],
 'Value': 1,
 'Unit': 'Count'
 },
 {
 'MetricName': 'ResourcesChecked',
 'Dimensions': [
 {'Name': 'StackName', 'Value': stack_name}
 ],
 'Value': resource_count,
 'Unit': 'Count'
 },
 {
 'MetricName': 'DriftedResources',
 'Dimensions': [
 {'Name': 'StackName', 'Value': stack_name},
 {'Name': 'DriftStatus', 'Value': drift_status}
 ],
 'Value': drifted_count,
 'Unit': 'Count'
 }
 ]
 )

Comprehensive Drift Monitoring

def comprehensive_drift_analysis(stack_name):
 """Perform comprehensive drift analysis with detailed logging"""
 
 logger.info(f"Starting comprehensive drift analysis for {stack_name}")
 
 try:
 # Initiate drift detection
 response = cloudformation.detect_stack_drift(StackName=stack_name)
 drift_detection_id = response['StackDriftDetectionId']
 
 logger.info(f"Drift detection initiated: {drift_detection_id}")
 
 # Monitor detection progress
 while True:
 status_response = cloudformation.describe_stack_drift_detection_status(
 StackDriftDetectionId=drift_detection_id
 )
 
 detection_status = status_response['DetectionStatus']
 logger.info(f"Detection status: {detection_status}")
 
 if detection_status == 'DETECTION_COMPLETE':
 break
 elif detection_status == 'DETECTION_FAILED':
 logger.error(f"Drift detection failed: {status_response.get('DetectionStatusReason')}")
 return None
 
 time.sleep(30)
 
 # Get drift results
 stack_drift_status = status_response['StackDriftStatus']
 logger.info(f"Stack drift status: {stack_drift_status}")
 
 if stack_drift_status == 'DRIFTED':
 # Get detailed drift information
 drift_details = cloudformation.describe_stack_resource_drifts(
 StackName=stack_name,
 StackResourceDriftStatusFilters=['MODIFIED', 'DELETED']
 )
 
 # Log detailed drift information
 for drift in drift_details['StackResourceDrifts']:
 logger.warning(f"Drifted resource: {drift['LogicalResourceId']} "
 f"({drift['ResourceType']}) - Status: {drift['StackResourceDriftStatus']}")
 
 # Log property differences
 for prop_diff in drift.get('PropertyDifferences', []):
 logger.warning(f" Property: {prop_diff['PropertyPath']}")
 logger.warning(f" Expected: {prop_diff['ExpectedValue']}")
 logger.warning(f" Actual: {prop_diff['ActualValue']}")
 
 return {
 'StackName': stack_name,
 'DriftStatus': stack_drift_status,
 'DetectionId': drift_detection_id,
 'Timestamp': status_response['Timestamp']
 }
 
 except Exception as e:
 logger.error(f"Error in drift analysis: {str(e)}")
 raise

Common Issues & Solutions

Detection Timeout

Issue: Drift detection takes too long or times out
Solution: Check stack size, reduce concurrent detections
Prevention: Monitor detection duration, optimize stack design

Unsupported Resources

Issue: Some resources don’t support drift detection
Solution: Use AWS Config rules for unsupported resources
Prevention: Check resource support before relying on drift detection

False Positives

Issue: Drift detected for expected changes
Solution: Update CloudFormation template to match current state
Prevention: Keep templates synchronized with manual changes

9. Common Exam Scenarios

Scenario 1: Detect manual changes to EC2 security groups

Solution:

AWS CloudFormation Macros

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS CloudFormation Macros are custom processing functions that enable you to perform template-wide processing operations, such as transforming entire templates or specific template sections. Macros are powered by AWS Lambda functions and allow you to extend CloudFormation’s native capabilities.

Key Characteristics

Template transformation - Modify templates before processing
Lambda-powered - Custom logic implemented in Lambda functions
Reusable - Share macros across multiple templates and accounts
Flexible - Transform entire templates or specific sections
Extensible - Add custom functionality to CloudFormation
Version controlled - Macro versions can be managed and updated

What Problem Does It Solve?

Eliminates repetitive template code through abstraction
Enables custom template processing logic
Provides template-wide transformations
Allows creation of custom CloudFormation “functions”
Enables advanced template generation and manipulation
Supports complex conditional logic beyond native functions
Facilitates template standardization across organizations

2. Core Concepts

Macro

Lambda function that processes CloudFormation templates
Registered in CloudFormation with a unique name
Can be applied to entire templates or specific fragments
Returns transformed template content

Transform

Directive in CloudFormation template that invokes a macro
Can be template-level or resource-level
Processed before template validation and resource creation
Multiple transforms can be chained

Fragment

Portion of template processed by a macro
Can be a single resource, multiple resources, or template section
Passed to macro Lambda function as input
Replaced by macro output in final template

Template Processing Order

Template uploaded to CloudFormation
Transforms identified and executed in order
Macro Lambda functions process template/fragments
Transformed template validated
Resources created from final template

3. Macro Types

Template-Level Macros

Process entire CloudFormation template
Applied using Transform section at template root
Receive complete template as input
Return complete transformed template

Fragment-Level Macros

Process specific template sections
Applied using Fn::Transform intrinsic function
Receive template fragment as input
Return transformed fragment

4. Creating Macros

Macro Lambda Function Structure

import json
import boto3

def lambda_handler(event, context):
 """
 CloudFormation Macro Lambda function
 """
 # Extract macro input
 template_parameter_values = event.get('templateParameterValues', {})
 template = event.get('fragment', event.get('template'))
 account_id = event.get('accountId')
 region = event.get('region')
 
 # Process template/fragment
 try:
 # Custom transformation logic here
 transformed_template = process_template(template, template_parameter_values)
 
 # Return success response
 return {
 'requestId': event['requestId'],
 'status': 'SUCCESS',
 'fragment': transformed_template
 }
 except Exception as e:
 # Return failure response
 return {
 'requestId': event['requestId'],
 'status': 'FAILED',
 'errorMessage': str(e)
 }

def process_template(template, parameters):
 """
 Custom template processing logic
 """
 # Example: Add common tags to all resources
 if 'Resources' in template:
 for resource_name, resource in template['Resources'].items():
 if 'Properties' not in resource:
 resource['Properties'] = {}
 
 # Add tags if resource supports them
 if resource['Type'] in ['AWS::EC2::Instance', 'AWS::S3::Bucket']:
 if 'Tags' not in resource['Properties']:
 resource['Properties']['Tags'] = []
 
 # Add common tags
 resource['Properties']['Tags'].extend([
 {'Key': 'Environment', 'Value': parameters.get('Environment', 'Unknown')},
 {'Key': 'ManagedBy', 'Value': 'CloudFormation'},
 {'Key': 'CreatedBy', 'Value': 'Macro'}
 ])
 
 return template

Macro Registration Template

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Register CloudFormation Macro'

Parameters:
 MacroName:
 Type: String
 Default: CommonTagsMacro
 Description: Name of the macro

Resources:
 MacroFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: !Sub '${MacroName}-Function'
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt MacroExecutionRole.Arn
 Code:
 ZipFile: |
 import json
 
 def lambda_handler(event, context):
 template = event.get('fragment', event.get('template'))
 
 # Add common tags to all taggable resources
 if 'Resources' in template:
 for resource_name, resource in template['Resources'].items():
 if resource['Type'] in ['AWS::EC2::Instance', 'AWS::S3::Bucket']:
 if 'Properties' not in resource:
 resource['Properties'] = {}
 if 'Tags' not in resource['Properties']:
 resource['Properties']['Tags'] = []
 
 resource['Properties']['Tags'].extend([
 {'Key': 'ManagedBy', 'Value': 'CloudFormation'},
 {'Key': 'MacroProcessed', 'Value': 'true'}
 ])
 
 return {
 'requestId': event['requestId'],
 'status': 'SUCCESS',
 'fragment': template
 }

 MacroExecutionRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: lambda.amazonaws.com
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole

 Macro:
 Type: AWS::CloudFormation::Macro
 Properties:
 Name: !Ref MacroName
 FunctionName: !GetAtt MacroFunction.Arn
 Description: 'Adds common tags to resources'

Outputs:
 MacroName:
 Description: Name of the registered macro
 Value: !Ref MacroName
 Export:
 Name: !Sub '${AWS::StackName}-MacroName'

5. Using Macros in Templates

Template-Level Transform

AWSTemplateFormatVersion: '2010-09-09'
Transform: CommonTagsMacro
Description: 'Template using macro transform'

Parameters:
 Environment:
 Type: String
 Default: Development

Resources:
 MyBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: !Sub 'my-bucket-${Environment}'

 MyInstance:
 Type: AWS::EC2::Instance
 Properties:
 ImageId: ami-0abcdef1234567890
 InstanceType: t3.micro

Fragment-Level Transform

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Template using fragment transform'

Resources:
 ProcessedResources:
 Fn::Transform:
 Name: CommonTagsMacro
 Parameters:
 Environment: Production
 Fragment:
 MyBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: my-production-bucket
 
 MyInstance:
 Type: AWS::EC2::Instance
 Properties:
 ImageId: ami-0abcdef1234567890
 InstanceType: t3.small

Multiple Transforms

AWSTemplateFormatVersion: '2010-09-09'
Transform:
 - AWS::Serverless-2016-10-31  # SAM transform
 - CommonTagsMacro  # Custom macro
 - SecurityMacro  # Another custom macro

Resources:
 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 Runtime: python3.9
 Handler: index.handler
 CodeUri: src/

6. Advanced Macro Examples

Resource Generator Macro

def lambda_handler(event, context):
 """
 Macro that generates multiple similar resources
 """
 template = event.get('fragment', event.get('template'))
 parameters = event.get('templateParameterValues', {})
 
 # Look for resource generators
 if 'Resources' in template:
 new_resources = {}
 resources_to_remove = []
 
 for resource_name, resource in template['Resources'].items():
 if resource.get('Type') == 'Custom::ResourceGenerator':
 # Generate multiple resources based on configuration
 config = resource.get('Properties', {})
 resource_type = config.get('ResourceType')
 count = int(config.get('Count', 1))
 base_properties = config.get('BaseProperties', {})
 
 # Generate resources
 for i in range(count):
 new_resource_name = f"{resource_name}{i+1}"
 new_resources[new_resource_name] = {
 'Type': resource_type,
 'Properties': {
 **base_properties,
 'Tags': [
 {'Key': 'Name', 'Value': f"{config.get('NamePrefix', 'Resource')}-{i+1}"},
 {'Key': 'Index', 'Value': str(i+1)}
 ]
 }
 }
 
 # Mark original for removal
 resources_to_remove.append(resource_name)
 
 # Add new resources and remove generators
 template['Resources'].update(new_resources)
 for resource_name in resources_to_remove:
 del template['Resources'][resource_name]
 
 return {
 'requestId': event['requestId'],
 'status': 'SUCCESS',
 'fragment': template
 }

Conditional Resource Macro

def lambda_handler(event, context):
 """
 Macro for advanced conditional resource creation
 """
 template = event.get('fragment', event.get('template'))
 parameters = event.get('templateParameterValues', {})
 
 if 'Resources' in template:
 resources_to_remove = []
 
 for resource_name, resource in template['Resources'].items():
 # Check for conditional properties
 if 'Condition' in resource:
 condition = resource['Condition']
 
 # Evaluate complex conditions
 if not evaluate_condition(condition, parameters):
 resources_to_remove.append(resource_name)
 
 # Remove resources that don't meet conditions
 for resource_name in resources_to_remove:
 del template['Resources'][resource_name]
 
 return {
 'requestId': event['requestId'],
 'status': 'SUCCESS',
 'fragment': template
 }

def evaluate_condition(condition, parameters):
 """
 Custom condition evaluation logic
 """
 # Example: Environment-based conditions
 if condition == 'IsProduction':
 return parameters.get('Environment') == 'Production'
 elif condition == 'HasHighAvailability':
 return parameters.get('HighAvailability', 'false').lower() == 'true'
 
 return True

7. IAM Roles & Permissions

Macro Lambda Execution Role

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "logs:CreateLogGroup",
 "logs:CreateLogStream",
 "logs:PutLogEvents"
 ],
 "Resource": "arn:aws:logs:*:*:*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:DescribeStacks",
 "cloudformation:DescribeStackResources"
 ],
 "Resource": "*"
 }
 ]
}

Macro Registration Permissions

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "cloudformation:CreateMacro",
 "cloudformation:UpdateMacro",
 "cloudformation:DeleteMacro",
 "cloudformation:DescribeMacro",
 "cloudformation:ListMacros"
 ],
 "Resource": "*"
 },
 {
 "Effect": "Allow",
 "Action": [
 "lambda:InvokeFunction"
 ],
 "Resource": "arn:aws:lambda:*:*:function:*-macro-*"
 }
 ]
}

Cross-Account Macro Usage

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": [
 "arn:aws:iam::111111111111:root",
 "arn:aws:iam::222222222222:root"
 ]
 },
 "Action": "lambda:InvokeFunction",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:shared-macro-function"
 }
 ]
}

8. Integration with CI/CD Services

CodePipeline with Macro Validation

- Name: ValidateMacro
 Actions:
 - Name: TestMacro
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: 1
 Configuration:
 FunctionName: MacroValidationFunction
 UserParameters: |
 {
 "templatePath": "template.yaml",
 "macroName": "CommonTagsMacro"
 }
 InputArtifacts:
 - Name: SourceOutput

- Name: DeployWithMacro
 Actions:
 - Name: CreateChangeSet
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: 1
 Configuration:
 ActionMode: CHANGE_SET_REPLACE
 StackName: MyStack
 ChangeSetName: MyChangeSet
 TemplatePath: SourceOutput::template.yaml
 Capabilities: CAPABILITY_IAM
 InputArtifacts:
 - Name: SourceOutput

CodeBuild Macro Testing

# buildspec.yml
version: 0.2
phases:
 install:
 runtime-versions:
 python: 3.9
 pre_build:
 commands:
 - pip install boto3 pytest
 build:
 commands:
 # Test macro function locally
 - python -m pytest tests/test_macro.py -v
 
 # Validate template with macro
 - aws cloudformation validate-template --template-body file://template-with-macro.yaml
 
 # Test macro transformation
 - python scripts/test_macro_transform.py
 post_build:
 commands:
 - echo "Macro validation completed"

Macro Testing Script

# scripts/test_macro_transform.py
import json
import boto3
from moto import mock_lambda, mock_cloudformation

def test_macro_transformation():
 """Test macro transformation logic"""
 
 # Mock event data
 event = {
 'requestId': 'test-request-id',
 'fragment': {
 'Resources': {
 'TestBucket': {
 'Type': 'AWS::S3::Bucket',
 'Properties': {
 'BucketName': 'test-bucket'
 }
 }
 }
 },
 'templateParameterValues': {
 'Environment': 'Test'
 }
 }
 
 # Import and test macro function
 from macro_function import lambda_handler
 
 result = lambda_handler(event, {})
 
 # Validate transformation
 assert result['status'] == 'SUCCESS'
 assert 'Tags' in result['fragment']['Resources']['TestBucket']['Properties']
 
 print("Macro transformation test passed!")

if __name__ == '__main__':
 test_macro_transformation()

9. Security Best Practices

Macro Function Security

Use least privilege IAM roles for Lambda functions
Validate all input parameters and template content
Implement proper error handling and logging
Use AWS Secrets Manager for sensitive configuration
Enable CloudTrail logging for macro invocations

Input Validation

def validate_input(event):
 """Validate macro input for security"""
 
 # Check required fields
 required_fields = ['requestId', 'fragment']
 for field in required_fields:
 if field not in event:
 raise ValueError(f"Missing required field: {field}")
 
 # Validate template size
 template_str = json.dumps(event['fragment'])
 if len(template_str) > 460800: # 450KB limit
 raise ValueError("Template fragment too large")
 
 # Validate resource types (whitelist approach)
 allowed_types = [
 'AWS::EC2::Instance',
 'AWS::S3::Bucket',
 'AWS::IAM::Role',
 'AWS::Lambda::Function'
 ]
 
 fragment = event['fragment']
 if 'Resources' in fragment:
 for resource_name, resource in fragment['Resources'].items():
 if resource.get('Type') not in allowed_types:
 raise ValueError(f"Unsupported resource type: {resource.get('Type')}")
 
 return True

Secure Macro Registration

Resources:
 MacroFunction:
 Type: AWS::Lambda::Function
 Properties:
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt MacroRole.Arn
 Environment:
 Variables:
 LOG_LEVEL: INFO
 ReservedConcurrencyLimit: 10 # Prevent abuse
 DeadLetterConfig:
 TargetArn: !GetAtt MacroErrorQueue.Arn

 MacroRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: lambda.amazonaws.com
 Action: sts:AssumeRole
 Condition:
 StringEquals:
 'aws:SourceAccount': !Ref 'AWS::AccountId'

10. Monitoring & Troubleshooting

CloudWatch Logging

import logging
import json

# Configure logging
logger = logging.getLogger()
logger.setLevel(logging.INFO)

def lambda_handler(event, context):
 """Macro with comprehensive logging"""
 
 request_id = event.get('requestId', 'unknown')
 
 try:
 logger.info(f"Processing macro request: {request_id}")
 logger.debug(f"Input event: {json.dumps(event, default=str)}")
 
 # Process template
 result = process_template(event)
 
 logger.info(f"Macro processing completed successfully: {request_id}")
 return result
 
 except Exception as e:
 logger.error(f"Macro processing failed: {request_id}, Error: {str(e)}")
 return {
 'requestId': request_id,
 'status': 'FAILED',
 'errorMessage': str(e)
 }

CloudWatch Metrics

import boto3

cloudwatch = boto3.client('cloudwatch')

def publish_macro_metrics(macro_name, status, processing_time):
 """Publish custom metrics for macro execution"""
 
 cloudwatch.put_metric_data(
 Namespace='CloudFormation/Macros',
 MetricData=[
 {
 'MetricName': 'Invocations',
 'Dimensions': [
 {'Name': 'MacroName', 'Value': macro_name},
 {'Name': 'Status', 'Value': status}
 ],
 'Value': 1,
 'Unit': 'Count'
 },
 {
 'MetricName': 'ProcessingTime',
 'Dimensions': [
 {'Name': 'MacroName', 'Value': macro_name}
 ],
 'Value': processing_time,
 'Unit': 'Milliseconds'
 }
 ]
 )

Error Handling Patterns

def lambda_handler(event, context):
 """Robust error handling for macros"""
 
 request_id = event.get('requestId', 'unknown')
 
 try:
 # Validate input
 validate_input(event)
 
 # Process template
 transformed_template = process_template(event['fragment'])
 
 return {
 'requestId': request_id,
 'status': 'SUCCESS',
 'fragment': transformed_template
 }
 
 except ValueError as e:
 # Input validation errors
 logger.error(f"Validation error: {str(e)}")
 return {
 'requestId': request_id,
 'status': 'FAILED',
 'errorMessage': f"Input validation failed: {str(e)}"
 }
 
 except KeyError as e:
 # Missing required data
 logger.error(f"Missing data error: {str(e)}")
 return {
 'requestId': request_id,
 'status': 'FAILED',
 'errorMessage': f"Required data missing: {str(e)}"
 }
 
 except Exception as e:
 # Unexpected errors
 logger.error(f"Unexpected error: {str(e)}")
 return {
 'requestId': request_id,
 'status': 'FAILED',
 'errorMessage': "Internal processing error"
 }

11. Common Exam Scenarios

Scenario 1: Standardize resource tagging across organization

Solution:

AWS Config

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It continuously monitors and records AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations.

Key Characteristics

Configuration recording - Tracks resource configuration changes over time
Compliance monitoring - Evaluates resources against configuration rules
Change tracking - Historical view of configuration changes
Automated remediation - Automatic correction of non-compliant resources
Multi-account aggregation - Centralized compliance across accounts
Integration - Works with CloudTrail, CloudWatch, SNS, Lambda
Inventory management - Complete inventory of AWS resources

What Problem Does It Solve?

Provides visibility into resource configurations and changes
Enables compliance monitoring and governance
Facilitates security analysis and troubleshooting
Supports change management and audit requirements
Automates compliance remediation
Enables configuration drift detection

2. Core Components

Configuration Recorder

{
 "name": "default",
 "roleARN": "arn:aws:iam::123456789012:role/config-role",
 "recordingGroup": {
 "allSupported": true,
 "includeGlobalResourceTypes": true,
 "resourceTypes": []
 }
}

Delivery Channel

{
 "name": "default",
 "s3BucketName": "config-bucket-123456789012",
 "s3KeyPrefix": "config",
 "snsTopicARN": "arn:aws:sns:us-east-1:123456789012:config-topic",
 "configSnapshotDeliveryProperties": {
 "deliveryFrequency": "TwentyFour_Hours"
 }
}

Configuration Items

{
 "version": "1.3",
 "accountId": "123456789012",
 "configurationItemCaptureTime": "2023-01-15T12:00:00.000Z",
 "configurationItemStatus": "ResourceDiscovered",
 "configurationStateId": "1642248000000",
 "resourceType": "AWS::EC2::Instance",
 "resourceId": "i-1234567890abcdef0",
 "resourceName": "MyInstance",
 "ARN": "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0",
 "awsRegion": "us-east-1",
 "availabilityZone": "us-east-1a",
 "resourceCreationTime": "2023-01-15T10:00:00.000Z",
 "tags": {
 "Environment": "Production",
 "Owner": "TeamA"
 },
 "configuration": {
 "instanceId": "i-1234567890abcdef0",
 "imageId": "ami-0abcdef1234567890",
 "state": {
 "code": 16,
 "name": "running"
 },
 "privateDnsName": "ip-10-0-1-100.ec2.internal",
 "publicDnsName": "ec2-54-123-45-67.compute-1.amazonaws.com",
 "instanceType": "t3.medium",
 "keyName": "my-key-pair",
 "securityGroups": [
 {
 "groupName": "default",
 "groupId": "sg-12345678"
 }
 ],
 "subnetId": "subnet-12345678",
 "vpcId": "vpc-12345678"
 }
}

3. Config Rules

AWS Managed Rules

# CloudFormation template for Config rules
Resources:
 # Check if EC2 instances are in VPC
 EC2InstancesInVPCRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ec2-instances-in-vpc
 Description: Checks whether EC2 instances are in a VPC
 Source:
 Owner: AWS
 SourceIdentifier: INSTANCES_IN_VPC
 DependsOn: ConfigurationRecorder

 # Check if S3 buckets are publicly readable
 S3BucketPublicReadProhibitedRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: s3-bucket-public-read-prohibited
 Description: Checks that S3 buckets do not allow public read access
 Source:
 Owner: AWS
 SourceIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
 DependsOn: ConfigurationRecorder

 # Check if RDS instances have backup enabled
 RDSBackupEnabledRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: rds-backup-enabled
 Description: Checks whether RDS DB instances have backups enabled
 Source:
 Owner: AWS
 SourceIdentifier: DB_INSTANCE_BACKUP_ENABLED
 InputParameters: |
 {
 "backupRetentionPeriod": "7"
 }
 DependsOn: ConfigurationRecorder

 # Check if security groups allow unrestricted SSH
 SecurityGroupSSHRestrictedRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: incoming-ssh-disabled
 Description: Checks whether security groups disallow unrestricted incoming SSH traffic
 Source:
 Owner: AWS
 SourceIdentifier: INCOMING_SSH_DISABLED
 DependsOn: ConfigurationRecorder

Custom Config Rules

# Lambda function for custom Config rule
import boto3
import json

def lambda_handler(event, context):
 """
 Custom Config rule to check if EC2 instances have required tags
 """
 
 # Get the configuration item
 config_item = event['configurationItem']
 
 # Check if this is an EC2 instance
 if config_item['resourceType'] != 'AWS::EC2::Instance':
 return {
 'compliance_type': 'NOT_APPLICABLE',
 'annotation': 'Rule only applies to EC2 instances'
 }
 
 # Required tags
 required_tags = ['Environment', 'Owner', 'Project']
 
 # Get instance tags
 instance_tags = config_item.get('tags', {})
 
 # Check if all required tags are present
 missing_tags = []
 for tag in required_tags:
 if tag not in instance_tags:
 missing_tags.append(tag)
 
 if missing_tags:
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': f'Missing required tags: {", ".join(missing_tags)}'
 }
 else:
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'All required tags are present'
 }

# CloudFormation template for custom rule
Resources:
 CustomConfigRuleFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: custom-config-rule-required-tags
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt ConfigRuleLambdaRole.Arn
 Code:
 ZipFile: |
 # Lambda function code here

 CustomConfigRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ec2-required-tags
 Description: Checks if EC2 instances have required tags
 Source:
 Owner: AWS_LAMBDA
 SourceIdentifier: !GetAtt CustomConfigRuleFunction.Arn
 SourceDetail:
 - EventSource: aws.config
 MessageType: ConfigurationItemChangeNotification
 - EventSource: aws.config
 MessageType: OversizedConfigurationItemChangeNotification
 DependsOn: ConfigurationRecorder

 ConfigRulePermission:
 Type: AWS::Lambda::Permission
 Properties:
 FunctionName: !Ref CustomConfigRuleFunction
 Action: lambda:InvokeFunction
 Principal: config.amazonaws.com

4. Remediation Actions

Automatic Remediation

Resources:
 # Remediation configuration for S3 bucket encryption
 S3BucketEncryptionRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref S3BucketServerSideEncryptionEnabledRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-EnableS3BucketDefaultEncryption
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 BucketName:
 ResourceValue: RESOURCE_ID
 SSEAlgorithm:
 StaticValue: AES256
 Automatic: true
 MaximumAutomaticAttempts: 3

 # Remediation for security group with unrestricted SSH
 SecurityGroupSSHRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref SecurityGroupSSHRestrictedRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-RemoveUnrestrictedSourceInSecurityGroup
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 GroupId:
 ResourceValue: RESOURCE_ID
 IpProtocol:
 StaticValue: tcp
 FromPort:
 StaticValue: "22"
 ToPort:
 StaticValue: "22"
 Automatic: true
 MaximumAutomaticAttempts: 2

 # Custom remediation using Lambda
 CustomRemediationFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: custom-config-remediation
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt RemediationLambdaRole.Arn
 Code:
 ZipFile: |
 import boto3
 import json
 
 def lambda_handler(event, context):
 """Custom remediation function"""
 
 # Get resource information from Config
 resource_id = event['configurationItem']['resourceId']
 resource_type = event['configurationItem']['resourceType']
 
 if resource_type == 'AWS::EC2::Instance':
 ec2 = boto3.client('ec2')
 
 # Add required tags to EC2 instance
 ec2.create_tags(
 Resources=[resource_id],
 Tags=[
 {'Key': 'ComplianceStatus', 'Value': 'Remediated'},
 {'Key': 'RemediationDate', 'Value': str(datetime.now())}
 ]
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps('Remediation completed')
 }

Manual Remediation Workflow

# Lambda function for manual remediation workflow
import boto3
import json

def lambda_handler(event, context):
 """
 Creates remediation tickets for non-compliant resources
 """
 
 # Parse Config rule evaluation result
 config_item = event['configurationItem']
 compliance_type = event['newEvaluationResult']['complianceType']
 
 if compliance_type == 'NON_COMPLIANT':
 # Create ServiceNow ticket or send notification
 sns = boto3.client('sns')
 
 message = {
 'resource_id': config_item['resourceId'],
 'resource_type': config_item['resourceType'],
 'compliance_issue': event['newEvaluationResult']['annotation'],
 'account_id': config_item['accountId'],
 'region': config_item['awsRegion']
 }
 
 sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:compliance-alerts',
 Message=json.dumps(message),
 Subject=f'Compliance Issue: {config_item["resourceType"]} {config_item["resourceId"]}'
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps('Notification sent')
 }

5. Multi-Account Configuration

Organization Config Setup

# Master account setup
Resources:
 ConfigurationAggregator:
 Type: AWS::Config::ConfigurationAggregator
 Properties:
 ConfigurationAggregatorName: OrganizationConfigAggregator
 OrganizationAggregationSource:
 RoleArn: !GetAtt AggregatorRole.Arn
 AllAwsRegions: true

 # Organizational Config rules
 OrganizationalConfigRule:
 Type: AWS::Config::OrganizationConfigRule
 Properties:
 OrganizationConfigRuleName: s3-bucket-ssl-requests-only
 OrganizationManagedRuleMetadata:
 RuleIdentifier: S3_BUCKET_SSL_REQUESTS_ONLY
 Description: Checks whether S3 buckets have policies that require SSL requests
 ExcludedAccounts:
 - "111111111111" # Exclude specific accounts if needed

 # Organizational remediation
 OrganizationalRemediationConfiguration:
 Type: AWS::Config::OrganizationRemediationConfiguration
 Properties:
 OrganizationConfigRuleName: !Ref OrganizationalConfigRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-EnableS3BucketSSLRequestsOnly
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !Sub "arn:aws:iam::{account}:role/ConfigRemediationRole"
 BucketName:
 ResourceValue: RESOURCE_ID
 Automatic: false
 MaximumAutomaticAttempts: 1

Cross-Account Access

# Member account role for Config aggregation
Resources:
 ConfigAggregationRole:
 Type: AWS::IAM::Role
 Properties:
 RoleName: ConfigAggregationRole
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 AWS: !Sub "arn:aws:iam::${MasterAccountId}:root"
 Action: sts:AssumeRole
 Condition:
 StringEquals:
 'sts:ExternalId': !Ref ExternalId
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/service-role/ConfigRole
 Policies:
 - PolicyName: ConfigAggregationPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - config:GetComplianceDetailsByConfigRule
 - config:GetComplianceDetailsByResource
 - config:ListDiscoveredResources
 - config:GetResourceConfigHistory
 Resource: '*'

6. Config with CI/CD Integration

Compliance Gates in Pipeline

# Lambda function for pipeline compliance check
import boto3
import json

def lambda_handler(event, context):
 """
 Check Config compliance before deployment
 """
 
 config_client = boto3.client('config')
 codepipeline = boto3.client('codepipeline')
 
 # Get job details from CodePipeline
 job_id = event['CodePipeline.job']['id']
 
 try:
 # Check compliance for critical rules
 critical_rules = [
 's3-bucket-public-read-prohibited',
 'incoming-ssh-disabled',
 'rds-backup-enabled'
 ]
 
 non_compliant_resources = []
 
 for rule_name in critical_rules:
 response = config_client.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name,
 ComplianceTypes=['NON_COMPLIANT']
 )
 
 if response['EvaluationResults']:
 non_compliant_resources.extend(response['EvaluationResults'])
 
 if non_compliant_resources:
 # Fail the pipeline
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={
 'message': f'Found {len(non_compliant_resources)} non-compliant resources',
 'type': 'JobFailed'
 }
 )
 else:
 # Continue the pipeline
 codepipeline.put_job_success_result(jobId=job_id)
 
 except Exception as e:
 codepipeline.put_job_failure_result(
 jobId=job_id,
 failureDetails={
 'message': str(e),
 'type': 'JobFailed'
 }
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps('Compliance check completed')
 }

Infrastructure Compliance Validation

# CodeBuild project for Config compliance validation
Resources:
 ComplianceValidationProject:
 Type: AWS::CodeBuild::Project
 Properties:
 Name: config-compliance-validation
 ServiceRole: !GetAtt CodeBuildRole.Arn
 Artifacts:
 Type: CODEPIPELINE
 Environment:
 Type: LINUX_CONTAINER
 ComputeType: BUILD_GENERAL1_SMALL
 Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
 Source:
 Type: CODEPIPELINE
 BuildSpec: |
 version: 0.2
 phases:
 install:
 runtime-versions:
 python: 3.9
 commands:
 - pip install boto3
 pre_build:
 commands:
 - echo "Starting compliance validation..."
 build:
 commands:
 - python compliance_check.py
 post_build:
 commands:
 - echo "Compliance validation completed"

7. Config API and CLI

Common CLI Commands

# Start configuration recorder
aws configservice start-configuration-recorder --configuration-recorder-name default

# Stop configuration recorder
aws configservice stop-configuration-recorder --configuration-recorder-name default

# Get configuration recorder status
aws configservice describe-configuration-recorder-status

# Get compliance by config rule
aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-public-read-prohibited

# Get compliance by resource
aws configservice get-compliance-details-by-resource --resource-type AWS::S3::Bucket --resource-id my-bucket

# List discovered resources
aws configservice list-discovered-resources --resource-type AWS::EC2::Instance

# Get resource config history
aws configservice get-resource-config-history --resource-type AWS::EC2::Instance --resource-id i-1234567890abcdef0

# Deliver configuration snapshot
aws configservice deliver-config-snapshot --delivery-channel-name default

# Put evaluations (for custom rules)
aws configservice put-evaluations --evaluations file://evaluations.json --result-token <token>

Programmatic Access

import boto3
from datetime import datetime, timedelta

def get_compliance_summary():
 """Get compliance summary across all rules"""
 
 config_client = boto3.client('config')
 
 # Get compliance summary
 response = config_client.get_compliance_summary_by_config_rule()
 
 summary = {
 'compliant': response['ComplianceSummary']['CompliantResourceCount']['CappedCount'],
 'non_compliant': response['ComplianceSummary']['NonCompliantResourceCount']['CappedCount'],
 'not_applicable': response['ComplianceSummary']['NotApplicableResourceCount']['CappedCount']
 }
 
 return summary

def get_configuration_changes(resource_type, hours=24):
 """Get configuration changes for a resource type in the last N hours"""
 
 config_client = boto3.client('config')
 
 end_time = datetime.utcnow()
 start_time = end_time - timedelta(hours=hours)
 
 # List resources
 resources = config_client.list_discovered_resources(
 resourceType=resource_type
 )
 
 changes = []
 
 for resource in resources['resourceIdentifiers']:
 # Get configuration history
 history = config_client.get_resource_config_history(
 resourceType=resource_type,
 resourceId=resource['resourceId'],
 laterTime=end_time,
 earlierTime=start_time
 )
 
 if history['configurationItems']:
 changes.extend(history['configurationItems'])
 
 return changes

def remediate_non_compliant_resources(rule_name):
 """Trigger remediation for non-compliant resources"""
 
 config_client = boto3.client('config')
 
 # Get non-compliant resources
 response = config_client.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name,
 ComplianceTypes=['NON_COMPLIANT']
 )
 
 resource_keys = []
 for evaluation in response['EvaluationResults']:
 resource_keys.append({
 'resourceType': evaluation['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceType'],
 'resourceId': evaluation['EvaluationResultIdentifier']['EvaluationResultQualifier']['ResourceId']
 })
 
 if resource_keys:
 # Start remediation
 config_client.start_remediation_execution(
 ConfigRuleName=rule_name,
 ResourceKeys=resource_keys
 )
 
 return len(resource_keys)

8. Common Exam Scenarios

Scenario 1: Compliance Monitoring Setup

# Complete Config setup for compliance monitoring
Resources:
 # S3 bucket for Config
 ConfigBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: !Sub "config-bucket-${AWS::AccountId}-${AWS::Region}"
 BucketEncryption:
 ServerSideEncryptionConfiguration:
 - ServerSideEncryptionByDefault:
 SSEAlgorithm: AES256

 # Config service role
 ConfigRole:
 Type: AWS::IAM::ServiceLinkedRole
 Properties:
 AWSServiceName: config.amazonaws.com

 # Configuration recorder
 ConfigurationRecorder:
 Type: AWS::Config::ConfigurationRecorder
 Properties:
 Name: default
 RoleARN: !Sub "arn:aws:iam::${AWS::AccountId}:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig"
 RecordingGroup:
 AllSupported: true
 IncludeGlobalResourceTypes: true

 # Delivery channel
 DeliveryChannel:
 Type: AWS::Config::DeliveryChannel
 Properties:
 Name: default
 S3BucketName: !Ref ConfigBucket
 ConfigSnapshotDeliveryProperties:
 DeliveryFrequency: TwentyFour_Hours

 # Essential compliance rules
 S3BucketPublicAccessProhibited:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: s3-bucket-public-access-prohibited
 Source:
 Owner: AWS
 SourceIdentifier: S3_BUCKET_PUBLIC_ACCESS_PROHIBITED
 DependsOn: ConfigurationRecorder

 EC2SecurityGroupAttachedToENI:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ec2-security-group-attached-to-eni
 Source:
 Owner: AWS
 SourceIdentifier: EC2_SECURITY_GROUP_ATTACHED_TO_ENI
 DependsOn: ConfigurationRecorder

Scenario 2: Automated Remediation Pipeline

# Complete automated remediation workflow
import boto3
import json
from datetime import datetime

class ConfigRemediationOrchestrator:
 def __init__(self):
 self.config_client = boto3.client('config')
 self.ssm_client = boto3.client('ssm')
 self.sns_client = boto3.client('sns')
 
 def lambda_handler(self, event, context):
 """Main handler for Config rule evaluation changes"""
 
 # Parse the Config evaluation result
 config_item = event['configurationItem']
 evaluation_result = event.get('newEvaluationResult', {})
 
 if evaluation_result.get('complianceType') == 'NON_COMPLIANT':
 return self.handle_non_compliance(config_item, evaluation_result)
 
 return {'statusCode': 200, 'body': 'No action required'}
 
 def handle_non_compliance(self, config_item, evaluation_result):
 """Handle non-compliant resources"""
 
 resource_type = config_item['resourceType']
 resource_id = config_item['resourceId']
 rule_name = evaluation_result.get('configRuleName', '')
 
 # Define remediation actions
 remediation_actions = {
 'AWS::S3::Bucket': {
 's3-bucket-public-read-prohibited': self.remediate_s3_public_access,
 's3-bucket-ssl-requests-only': self.remediate_s3_ssl_policy
 },
 'AWS::EC2::SecurityGroup': {
 'incoming-ssh-disabled': self.remediate_security_group_ssh
 },
 'AWS::EC2::Instance': {
 'ec2-instance-managed-by-systems-manager': self.remediate_ssm_agent
 }
 }
 
 # Execute remediation if available
 if resource_type in remediation_actions and rule_name in remediation_actions[resource_type]:
 try:
 result = remediation_actions[resource_type]rule_name
 self.send_notification(resource_id, rule_name, 'SUCCESS', result)
 return {'statusCode': 200, 'body': f'Remediation successful: {result}'}
 except Exception as e:
 self.send_notification(resource_id, rule_name, 'FAILED', str(e))
 return {'statusCode': 500, 'body': f'Remediation failed: {str(e)}'}
 else:
 # Manual remediation required
 self.create_manual_remediation_ticket(resource_id, resource_type, rule_name)
 return {'statusCode': 200, 'body': 'Manual remediation ticket created'}
 
 def remediate_s3_public_access(self, bucket_name, config_item):
 """Remove public access from S3 bucket"""
 s3_client = boto3.client('s3')
 
 # Block public access
 s3_client.put_public_access_block(
 Bucket=bucket_name,
 PublicAccessBlockConfiguration={
 'BlockPublicAcls': True,
 'IgnorePublicAcls': True,
 'BlockPublicPolicy': True,
 'RestrictPublicBuckets': True
 }
 )
 
 return f'Public access blocked for bucket {bucket_name}'
 
 def remediate_security_group_ssh(self, sg_id, config_item):
 """Remove unrestricted SSH access from security group"""
 ec2_client = boto3.client('ec2')
 
 # Revoke unrestricted SSH access
 ec2_client.revoke_security_group_ingress(
 GroupId=sg_id,
 IpPermissions=[
 {
 'IpProtocol': 'tcp',
 'FromPort': 22,
 'ToPort': 22,
 'IpRanges': [{'CidrIp': '0.0.0.0/0'}]
 }
 ]
 )
 
 return f'Removed unrestricted SSH access from security group {sg_id}'
 
 def send_notification(self, resource_id, rule_name, status, details):
 """Send remediation notification"""
 message = {
 'timestamp': datetime.utcnow().isoformat(),
 'resource_id': resource_id,
 'rule_name': rule_name,
 'remediation_status': status,
 'details': details
 }
 
 self.sns_client.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:config-remediation',
 Message=json.dumps(message),
 Subject=f'Config Remediation {status}: {resource_id}'
 )

9. Exam Tips

Understand Config components - Recorder, delivery channel, rules, remediation
Know rule types - AWS managed vs custom Lambda-based rules
Master remediation - Automatic vs manual remediation workflows
Practice multi-account - Organization Config and aggregation
Learn integration patterns - Config with CloudTrail, CloudWatch, SNS
Understand compliance - Evaluation results and compliance types
Know API operations - Key CLI commands and programmatic access
Practice troubleshooting - Common Config setup and rule issues
Understand costs - Configuration items, rule evaluations, remediation costs
Master CI/CD integration - Compliance gates and infrastructure validation

AWS Control Tower

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Control Tower provides an easy way to set up and govern a secure, multi-account AWS environment based on best practices established through AWS’s experience working with thousands of enterprises.

Key Characteristics

Landing Zone - Pre-configured multi-account environment
Guardrails - Preventive and detective controls for governance
Account Factory - Automated account provisioning and configuration
Dashboard - Centralized visibility and compliance monitoring
Service Catalog integration - Self-service account provisioning
Organizations integration - Built on AWS Organizations foundation
Config integration - Continuous compliance monitoring
CloudTrail integration - Centralized logging and auditing

What Problem Does It Solve?

Simplifies multi-account AWS environment setup and governance
Enforces security and compliance policies across accounts
Provides centralized visibility and control
Automates account provisioning with consistent configuration
Reduces operational overhead for managing multiple accounts
Ensures adherence to AWS best practices and compliance requirements

2. Core Components

Landing Zone

# Landing Zone automatically creates:
# 1. Root Organization Unit (OU)
# 2. Security OU (for shared security accounts)
# 3. Sandbox OU (for development/testing accounts)
# 4. Log Archive Account (centralized logging)
# 5. Audit Account (security and compliance monitoring)

# Example OU structure after Control Tower setup:
Root
├── Security OU
│ ├── Log Archive Account
│ └── Audit Account
├── Sandbox OU
│ ├── Development Account 1
│ ├── Development Account 2
│ └── Testing Account
└── Production OU (custom)
 ├── Production Account 1
 └── Production Account 2

Guardrails

{
 "preventiveGuardrails": [
 {
 "name": "Disallow policy changes to log archive",
 "description": "Prevents modification of CloudTrail logs in log archive account",
 "severity": "Mandatory",
 "implementation": "SCP (Service Control Policy)"
 },
 {
 "name": "Disallow changes to encryption configuration for log archive",
 "description": "Prevents changes to S3 bucket encryption in log archive",
 "severity": "Mandatory",
 "implementation": "SCP"
 },
 {
 "name": "Disallow configuration changes to CloudTrail",
 "description": "Prevents unauthorized changes to CloudTrail configuration",
 "severity": "Mandatory",
 "implementation": "SCP"
 }
 ],
 "detectiveGuardrails": [
 {
 "name": "Detect whether public read access to Amazon S3 buckets is allowed",
 "description": "Monitors S3 buckets for public read access",
 "severity": "Strongly Recommended",
 "implementation": "AWS Config Rule"
 },
 {
 "name": "Detect whether public write access to Amazon S3 buckets is allowed",
 "description": "Monitors S3 buckets for public write access",
 "severity": "Strongly Recommended",
 "implementation": "AWS Config Rule"
 },
 {
 "name": "Detect whether MFA for the root user is enabled",
 "description": "Checks if MFA is enabled for root user",
 "severity": "Strongly Recommended",
 "implementation": "AWS Config Rule"
 }
 ]
}

Account Factory

# Account Factory creates accounts with:
# 1. Baseline security configuration
# 2. Guardrails applied
# 3. CloudTrail logging enabled
# 4. Config recording enabled
# 5. Cross-account access roles

# Example Account Factory configuration
AccountFactoryConfiguration:
 AccountEmail: "new-account@company.com"
 AccountName: "Production-WebApp"
 OrganizationalUnit: "Production OU"
 SSOUserEmail: "admin@company.com"
 SSOUserFirstName: "Admin"
 SSOUserLastName: "User"
 ManagedOrganizationalUnit: "Production OU"
 
 # Baseline configuration applied:
 BaselineConfiguration:
 - CloudTrail: Enabled
 - Config: Enabled
 - GuardrailsApplied: All mandatory + selected optional
 - CrossAccountRoles:
 - AWSControlTowerExecution
 - OrganizationAccountAccessRole

3. Guardrails Implementation

Service Control Policies (SCPs)

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "PreventCloudTrailDisabling",
 "Effect": "Deny",
 "Action": [
 "cloudtrail:StopLogging",
 "cloudtrail:DeleteTrail",
 "cloudtrail:PutEventSelectors"
 ],
 "Resource": "*",
 "Condition": {
 "StringNotEquals": {
 "aws:PrincipalArn": [
 "arn:aws:iam::*:role/AWSControlTowerExecution"
 ]
 }
 }
 },
 {
 "Sid": "PreventConfigDisabling",
 "Effect": "Deny",
 "Action": [
 "config:StopConfigurationRecorder",
 "config:DeleteConfigurationRecorder",
 "config:DeleteDeliveryChannel"
 ],
 "Resource": "*",
 "Condition": {
 "StringNotEquals": {
 "aws:PrincipalArn": [
 "arn:aws:iam::*:role/AWSControlTowerExecution"
 ]
 }
 }
 },
 {
 "Sid": "PreventLogArchiveModification",
 "Effect": "Deny",
 "Action": [
 "s3:DeleteBucket",
 "s3:DeleteBucketPolicy",
 "s3:PutBucketPolicy"
 ],
 "Resource": [
 "arn:aws:s3:::aws-controltower-logs-*",
 "arn:aws:s3:::aws-controltower-s3-access-logs-*"
 ],
 "Condition": {
 "StringNotEquals": {
 "aws:PrincipalArn": [
 "arn:aws:iam::*:role/AWSControlTowerExecution"
 ]
 }
 }
 }
 ]
}

Config Rules for Detective Guardrails

# CloudFormation template for custom guardrails
Resources:
 # Custom detective guardrail for EC2 instance compliance
 EC2InstanceComplianceRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ct-ec2-instance-compliance
 Description: Detect non-compliant EC2 instances
 Source:
 Owner: AWS_LAMBDA
 SourceIdentifier: !GetAtt ComplianceFunction.Arn
 SourceDetail:
 - EventSource: aws.config
 MessageType: ConfigurationItemChangeNotification
 MaximumExecutionFrequency: TwentyFour_Hours

 ComplianceFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: ct-ec2-compliance-check
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt ComplianceFunctionRole.Arn
 Code:
 ZipFile: |
 import boto3
 import json
 
 def lambda_handler(event, context):
 config_item = event['configurationItem']
 
 if config_item['resourceType'] != 'AWS::EC2::Instance':
 return {
 'compliance_type': 'NOT_APPLICABLE',
 'annotation': 'Rule only applies to EC2 instances'
 }
 
 # Check required tags
 required_tags = ['Environment', 'Owner', 'CostCenter']
 instance_tags = config_item.get('tags', {})
 
 missing_tags = [tag for tag in required_tags if tag not in instance_tags]
 
 if missing_tags:
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': f'Missing required tags: {", ".join(missing_tags)}'
 }
 
 # Check instance type restrictions
 allowed_types = ['t3.micro', 't3.small', 't3.medium', 't3.large']
 instance_type = config_item['configuration']['instanceType']
 
 if instance_type not in allowed_types:
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': f'Instance type {instance_type} not allowed'
 }
 
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'Instance meets all compliance requirements'
 }

 # Remediation for non-compliant resources
 ComplianceRemediation:
 Type: AWS::Config::RemediationConfiguration
 Properties:
 ConfigRuleName: !Ref EC2InstanceComplianceRule
 TargetType: SSM_DOCUMENT
 TargetId: !Ref RemediationDocument
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !GetAtt RemediationRole.Arn
 InstanceId:
 ResourceValue: RESOURCE_ID
 Automatic: false
 MaximumAutomaticAttempts: 1

 RemediationDocument:
 Type: AWS::SSM::Document
 Properties:
 DocumentType: Automation
 DocumentFormat: YAML
 Content:
 schemaVersion: '0.3'
 description: Remediate non-compliant EC2 instances
 assumeRole: '{{ AutomationAssumeRole }}'
 parameters:
 InstanceId:
 type: String
 description: EC2 Instance ID
 AutomationAssumeRole:
 type: String
 description: IAM role for automation
 mainSteps:
 - name: AddComplianceTags
 action: 'aws:executeAwsApi'
 inputs:
 Service: ec2
 Api: CreateTags
 Resources:
 - '{{ InstanceId }}'
 Tags:
 - Key: ComplianceStatus
 Value: Remediated
 - Key: RemediationDate
 Value: '{{ global:DATE_TIME }}'

4. Account Factory Automation

Service Catalog Integration

# Account Factory as Service Catalog product
Resources:
 AccountFactoryPortfolio:
 Type: AWS::ServiceCatalog::Portfolio
 Properties:
 DisplayName: AWS Control Tower Account Factory
 Description: Automated account provisioning with Control Tower
 ProviderName: AWS Control Tower

 AccountFactoryProduct:
 Type: AWS::ServiceCatalog::CloudFormationProduct
 Properties:
 Name: AWS Control Tower Account Factory
 Description: Create new AWS account with Control Tower baseline
 Owner: AWS Control Tower
 ProvisioningArtifactParameters:
 - Name: v1.0
 Description: Account Factory template
 Info:
 LoadTemplateFromURL: !Sub "https://${TemplateBucket}.s3.amazonaws.com/account-factory-template.yaml"

 # Custom account provisioning workflow
 CustomAccountFactory:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: custom-account-factory
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt AccountFactoryRole.Arn
 Code:
 ZipFile: |
 import boto3
 import json
 import time
 
 def lambda_handler(event, context):
 """Custom account factory with additional configuration"""
 
 servicecatalog = boto3.client('servicecatalog')
 organizations = boto3.client('organizations')
 
 # Extract account details from event
 account_name = event['AccountName']
 account_email = event['AccountEmail']
 ou_name = event['OrganizationalUnit']
 
 try:
 # Provision account through Service Catalog
 response = servicecatalog.provision_product(
 ProductId='prod-account-factory',
 ProvisioningArtifactId='pa-latest',
 ProvisionedProductName=f"Account-{account_name}",
 ProvisioningParameters=[
 {'Key': 'AccountName', 'Value': account_name},
 {'Key': 'AccountEmail', 'Value': account_email},
 {'Key': 'OrganizationalUnitName', 'Value': ou_name},
 {'Key': 'SSOUserEmail', 'Value': event.get('SSOUserEmail', account_email)},
 {'Key': 'SSOUserFirstName', 'Value': event.get('SSOUserFirstName', 'Admin')},
 {'Key': 'SSOUserLastName', 'Value': event.get('SSOUserLastName', 'User')}
 ]
 )
 
 record_id = response['RecordDetail']['RecordId']
 
 # Wait for provisioning to complete
 while True:
 record = servicecatalog.describe_record(Id=record_id)
 status = record['RecordDetail']['Status']
 
 if status == 'SUCCEEDED':
 # Get account ID from outputs
 account_id = None
 for output in record['RecordDetail']['RecordOutputs']:
 if output['OutputKey'] == 'AccountId':
 account_id = output['OutputValue']
 break
 
 if account_id:
 # Apply additional configuration
 apply_custom_configuration(account_id, event)
 
 return {
 'statusCode': 200,
 'body': json.dumps({
 'AccountId': account_id,
 'Status': 'SUCCESS'
 })
 }
 
 elif status in ['FAILED', 'ERROR']:
 return {
 'statusCode': 500,
 'body': json.dumps({
 'Status': 'FAILED',
 'Error': record['RecordDetail'].get('RecordErrors', [])
 })
 }
 
 time.sleep(30) # Wait 30 seconds before checking again
 
 except Exception as e:
 return {
 'statusCode': 500,
 'body': json.dumps({
 'Status': 'FAILED',
 'Error': str(e)
 })
 }
 
 def apply_custom_configuration(account_id, config):
 """Apply custom configuration to newly created account"""
 
 # Assume role in target account
 sts = boto3.client('sts')
 assumed_role = sts.assume_role(
 RoleArn=f"arn:aws:iam::{account_id}:role/OrganizationAccountAccessRole",
 RoleSessionName='CustomConfiguration'
 )
 
 # Create session with assumed role credentials
 session = boto3.Session(
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 # Apply custom configurations
 if config.get('EnableCloudTrail'):
 setup_additional_cloudtrail(session, config)
 
 if config.get('CreateVPC'):
 create_default_vpc(session, config)
 
 if config.get('SetupBudgets'):
 setup_cost_budgets(session, config)

Automated Account Onboarding

# Complete account onboarding workflow
import boto3
import json
from datetime import datetime, timedelta

class ControlTowerAccountManager:
 def __init__(self):
 self.servicecatalog = boto3.client('servicecatalog')
 self.organizations = boto3.client('organizations')
 self.sts = boto3.client('sts')
 self.stepfunctions = boto3.client('stepfunctions')
 
 def create_account_with_workflow(self, account_request):
 """Create account with complete onboarding workflow"""
 
 # Start Step Functions workflow for account creation
 workflow_input = {
 'AccountRequest': account_request,
 'Timestamp': datetime.utcnow().isoformat()
 }
 
 response = self.stepfunctions.start_execution(
 stateMachineArn='arn:aws:states:us-east-1:123456789012:stateMachine:AccountOnboarding',
 name=f"account-{account_request['AccountName']}-{int(time.time())}",
 input=json.dumps(workflow_input)
 )
 
 return response['executionArn']
 
 def provision_account_factory(self, account_details):
 """Provision account through Control Tower Account Factory"""
 
 # Find Account Factory product
 products = self.servicecatalog.search_products(
 Filters={'FullTextSearch': ['AWS Control Tower Account Factory']}
 )
 
 if not products['ProductViewSummaries']:
 raise ValueError("Account Factory product not found")
 
 product = products['ProductViewSummaries'][0]
 
 # Get latest provisioning artifact
 product_details = self.servicecatalog.describe_product(Id=product['ProductId'])
 latest_artifact = product_details['ProvisioningArtifacts'][-1]
 
 # Provision account
 response = self.servicecatalog.provision_product(
 ProductId=product['ProductId'],
 ProvisioningArtifactId=latest_artifact['Id'],
 ProvisionedProductName=f"Account-{account_details['AccountName']}",
 ProvisioningParameters=[
 {'Key': 'AccountName', 'Value': account_details['AccountName']},
 {'Key': 'AccountEmail', 'Value': account_details['AccountEmail']},
 {'Key': 'OrganizationalUnitName', 'Value': account_details['OrganizationalUnit']},
 {'Key': 'SSOUserEmail', 'Value': account_details['SSOUserEmail']},
 {'Key': 'SSOUserFirstName', 'Value': account_details['SSOUserFirstName']},
 {'Key': 'SSOUserLastName', 'Value': account_details['SSOUserLastName']}
 ],
 Tags=[
 {'Key': 'CreatedBy', 'Value': 'ControlTowerAccountManager'},
 {'Key': 'CreationDate', 'Value': datetime.utcnow().isoformat()},
 {'Key': 'Department', 'Value': account_details.get('Department', 'Unknown')}
 ]
 )
 
 return response['RecordDetail']
 
 def setup_account_baseline(self, account_id, baseline_config):
 """Setup baseline configuration for new account"""
 
 # Assume role in target account
 assumed_role = self.sts.assume_role(
 RoleArn=f"arn:aws:iam::{account_id}:role/OrganizationAccountAccessRole",
 RoleSessionName='BaselineSetup'
 )
 
 # Create session with assumed role
 session = boto3.Session(
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 # Setup baseline components
 results = {}
 
 if baseline_config.get('CreateVPC'):
 results['VPC'] = self.create_baseline_vpc(session, baseline_config['VPC'])
 
 if baseline_config.get('SetupBudgets'):
 results['Budgets'] = self.setup_cost_budgets(session, baseline_config['Budgets'])
 
 if baseline_config.get('CreateRoles'):
 results['Roles'] = self.create_baseline_roles(session, baseline_config['Roles'])
 
 if baseline_config.get('SetupCloudWatch'):
 results['CloudWatch'] = self.setup_cloudwatch_baseline(session, baseline_config['CloudWatch'])
 
 return results
 
 def create_baseline_vpc(self, session, vpc_config):
 """Create baseline VPC configuration"""
 
 ec2 = session.client('ec2')
 
 # Create VPC
 vpc_response = ec2.create_vpc(
 CidrBlock=vpc_config.get('CidrBlock', '10.0.0.0/16'),
 TagSpecifications=[
 {
 'ResourceType': 'vpc',
 'Tags': [
 {'Key': 'Name', 'Value': vpc_config.get('Name', 'BaselineVPC')},
 {'Key': 'CreatedBy', 'Value': 'ControlTowerBaseline'}
 ]
 }
 ]
 )
 
 vpc_id = vpc_response['Vpc']['VpcId']
 
 # Create subnets
 subnets = []
 for i, subnet_config in enumerate(vpc_config.get('Subnets', [])):
 subnet_response = ec2.create_subnet(
 VpcId=vpc_id,
 CidrBlock=subnet_config['CidrBlock'],
 AvailabilityZone=subnet_config['AvailabilityZone'],
 TagSpecifications=[
 {
 'ResourceType': 'subnet',
 'Tags': [
 {'Key': 'Name', 'Value': subnet_config['Name']},
 {'Key': 'Type', 'Value': subnet_config.get('Type', 'Private')}
 ]
 }
 ]
 )
 subnets.append(subnet_response['Subnet']['SubnetId'])
 
 return {
 'VpcId': vpc_id,
 'Subnets': subnets
 }
 
 def setup_cost_budgets(self, session, budget_config):
 """Setup cost budgets for the account"""
 
 budgets = session.client('budgets')
 account_id = session.client('sts').get_caller_identity()['Account']
 
 created_budgets = []
 
 for budget in budget_config:
 budget_definition = {
 'BudgetName': budget['Name'],
 'BudgetLimit': {
 'Amount': str(budget['Amount']),
 'Unit': 'USD'
 },
 'TimeUnit': budget.get('TimeUnit', 'MONTHLY'),
 'BudgetType': budget.get('Type', 'COST'),
 'CostFilters': budget.get('CostFilters', {}),
 'TimePeriod': {
 'Start': datetime.utcnow().replace(day=1),
 'End': datetime.utcnow().replace(day=28) + timedelta(days=4)
 }
 }
 
 # Create budget
 budgets.create_budget(
 AccountId=account_id,
 Budget=budget_definition,
 NotificationsWithSubscribers=[
 {
 'Notification': {
 'NotificationType': 'ACTUAL',
 'ComparisonOperator': 'GREATER_THAN',
 'Threshold': 80.0,
 'ThresholdType': 'PERCENTAGE'
 },
 'Subscribers': [
 {
 'SubscriptionType': 'EMAIL',
 'Address': budget['NotificationEmail']
 }
 ]
 }
 ]
 )
 
 created_budgets.append(budget['Name'])
 
 return created_budgets

# Step Functions state machine for account onboarding
step_functions_definition = {
 "Comment": "Account onboarding workflow",
 "StartAt": "ProvisionAccount",
 "States": {
 "ProvisionAccount": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:provision-account",
 "Next": "WaitForProvisioning"
 },
 "WaitForProvisioning": {
 "Type": "Wait",
 "Seconds": 300,
 "Next": "CheckProvisioningStatus"
 },
 "CheckProvisioningStatus": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:check-provisioning-status",
 "Next": "IsProvisioningComplete"
 },
 "IsProvisioningComplete": {
 "Type": "Choice",
 "Choices": [
 {
 "Variable": "$.Status",
 "StringEquals": "SUCCEEDED",
 "Next": "SetupBaseline"
 },
 {
 "Variable": "$.Status",
 "StringEquals": "FAILED",
 "Next": "ProvisioningFailed"
 }
 ],
 "Default": "WaitForProvisioning"
 },
 "SetupBaseline": {
 "Type": "Task",
 "Resource": "arn:aws:lambda:us-east-1:123456789012:function:setup-baseline",
 "Next": "NotifyCompletion"
 },
 "NotifyCompletion": {
 "Type": "Task",
 "Resource": "arn:aws:states:::sns:publish",
 "Parameters": {
 "TopicArn": "arn:aws:sns:us-east-1:123456789012:account-onboarding",
 "Message.$": "$.CompletionMessage"
 },
 "End": True
 },
 "ProvisioningFailed": {
 "Type": "Task",
 "Resource": "arn:aws:states:::sns:publish",
 "Parameters": {
 "TopicArn": "arn:aws:sns:us-east-1:123456789012:account-onboarding-failures",
 "Message.$": "$.ErrorMessage"
 },
 "End": True
 }
 }
}

5. Customization and Extensions

Custom Guardrails

# Custom guardrail for encryption compliance
Resources:
 EncryptionComplianceRule:
 Type: AWS::Config::ConfigRule
 Properties:
 ConfigRuleName: ct-encryption-compliance
 Description: Ensure all resources use encryption
 Source:
 Owner: AWS_LAMBDA
 SourceIdentifier: !GetAtt EncryptionComplianceFunction.Arn
 SourceDetail:
 - EventSource: aws.config
 MessageType: ConfigurationItemChangeNotification

 EncryptionComplianceFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: ct-encryption-compliance
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt ComplianceFunctionRole.Arn
 Code:
 ZipFile: |
 import boto3
 import json
 
 def lambda_handler(event, context):
 config_item = event['configurationItem']
 resource_type = config_item['resourceType']
 
 # Check encryption for different resource types
 if resource_type == 'AWS::S3::Bucket':
 return check_s3_encryption(config_item)
 elif resource_type == 'AWS::RDS::DBInstance':
 return check_rds_encryption(config_item)
 elif resource_type == 'AWS::EBS::Volume':
 return check_ebs_encryption(config_item)
 else:
 return {
 'compliance_type': 'NOT_APPLICABLE',
 'annotation': f'Encryption check not applicable for {resource_type}'
 }
 
 def check_s3_encryption(config_item):
 """Check S3 bucket encryption"""
 configuration = config_item['configuration']
 
 # Check if bucket has encryption configuration
 if 'serverSideEncryptionConfiguration' in configuration:
 encryption_rules = configuration['serverSideEncryptionConfiguration']['rules']
 if encryption_rules:
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'S3 bucket has encryption enabled'
 }
 
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': 'S3 bucket does not have encryption enabled'
 }
 
 def check_rds_encryption(config_item):
 """Check RDS encryption"""
 configuration = config_item['configuration']
 
 if configuration.get('storageEncrypted', False):
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'RDS instance has encryption enabled'
 }
 
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': 'RDS instance does not have encryption enabled'
 }
 
 def check_ebs_encryption(config_item):
 """Check EBS volume encryption"""
 configuration = config_item['configuration']
 
 if configuration.get('encrypted', False):
 return {
 'compliance_type': 'COMPLIANT',
 'annotation': 'EBS volume is encrypted'
 }
 
 return {
 'compliance_type': 'NON_COMPLIANT',
 'annotation': 'EBS volume is not encrypted'
 }

 # Deploy custom guardrail to all accounts
 CustomGuardrailStackSet:
 Type: AWS::CloudFormation::StackSet
 Properties:
 StackSetName: ct-custom-encryption-guardrail
 Description: Deploy custom encryption guardrail to all accounts
 Capabilities:
 - CAPABILITY_IAM
 Parameters:
 - ParameterKey: GuardrailName
 ParameterValue: ct-encryption-compliance
 PermissionModel: SERVICE_MANAGED
 AutoDeployment:
 Enabled: true
 RetainStacksOnAccountRemoval: false
 OperationPreferences:
 RegionConcurrencyType: PARALLEL
 MaxConcurrentPercentage: 100
 FailureTolerancePercentage: 10
 TemplateBody: !Sub |
 AWSTemplateFormatVersion: '2010-09-09'
 Description: Custom encryption compliance guardrail
 Parameters:
 GuardrailName:
 Type: String
 Resources:
 ${EncryptionComplianceRule}
 ${EncryptionComplianceFunction}
 ${ComplianceFunctionRole}

Lifecycle Management

# Account lifecycle management
import boto3
import json
from datetime import datetime, timedelta

class ControlTowerLifecycleManager:
 def __init__(self):
 self.organizations = boto3.client('organizations')
 self.controltower = boto3.client('controltower')
 self.config = boto3.client('config')
 self.cloudwatch = boto3.client('cloudwatch')
 
 def monitor_account_compliance(self):
 """Monitor compliance across all managed accounts"""
 
 # Get all accounts in organization
 accounts = self.organizations.list_accounts()
 
 compliance_report = {
 'timestamp': datetime.utcnow().isoformat(),
 'total_accounts': len(accounts['Accounts']),
 'compliant_accounts': 0,
 'non_compliant_accounts': 0,
 'violations': []
 }
 
 for account in accounts['Accounts']:
 account_id = account['Id']
 account_name = account['Name']
 
 # Skip master account and suspended accounts
 if account['Status'] != 'ACTIVE':
 continue
 
 # Check guardrail compliance
 violations = self.check_account_guardrails(account_id)
 
 if violations:
 compliance_report['non_compliant_accounts'] += 1
 compliance_report['violations'].extend([
 {
 'account_id': account_id,
 'account_name': account_name,
 'violation': violation
 } for violation in violations
 ])
 else:
 compliance_report['compliant_accounts'] += 1
 
 # Send compliance metrics to CloudWatch
 self.send_compliance_metrics(compliance_report)
 
 return compliance_report
 
 def check_account_guardrails(self, account_id):
 """Check guardrail compliance for a specific account"""
 
 violations = []
 
 try:
 # Assume role in target account to check Config compliance
 sts = boto3.client('sts')
 assumed_role = sts.assume_role(
 RoleArn=f"arn:aws:iam::{account_id}:role/AWSControlTowerExecution",
 RoleSessionName='ComplianceCheck'
 )
 
 # Create session with assumed role
 session = boto3.Session(
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 config_client = session.client('config')
 
 # Get compliance summary
 compliance_summary = config_client.get_compliance_summary_by_config_rule()
 
 # Check for non-compliant rules
 for rule_name in self.get_mandatory_guardrails():
 try:
 compliance_details = config_client.get_compliance_details_by_config_rule(
 ConfigRuleName=rule_name,
 ComplianceTypes=['NON_COMPLIANT']
 )
 
 if compliance_details['EvaluationResults']:
 violations.append({
 'rule_name': rule_name,
 'non_compliant_resources': len(compliance_details['EvaluationResults']),
 'details': compliance_details['EvaluationResults'][:5] # First 5 violations
 })
 
 except config_client.exceptions.NoSuchConfigRuleException:
 violations.append({
 'rule_name': rule_name,
 'error': 'Config rule not found - guardrail may not be enabled'
 })
 
 except Exception as e:
 violations.append({
 'error': f'Unable to check compliance: {str(e)}'
 })
 
 return violations
 
 def get_mandatory_guardrails(self):
 """Get list of mandatory Control Tower guardrails"""
 return [
 'ct-s3-bucket-public-read-prohibited',
 'ct-s3-bucket-public-write-prohibited',
 'ct-cloudtrail-enabled',
 'ct-config-enabled',
 'ct-root-mfa-enabled'
 ]
 
 def remediate_account_violations(self, account_id, violations):
 """Attempt to remediate violations in an account"""
 
 remediation_results = []
 
 for violation in violations:
 rule_name = violation.get('rule_name')
 
 if rule_name == 'ct-s3-bucket-public-read-prohibited':
 result = self.remediate_s3_public_access(account_id, violation)
 remediation_results.append(result)
 
 elif rule_name == 'ct-cloudtrail-enabled':
 result = self.remediate_cloudtrail_configuration(account_id, violation)
 remediation_results.append(result)
 
 # Add more remediation actions as needed
 
 return remediation_results
 
 def send_compliance_metrics(self, compliance_report):
 """Send compliance metrics to CloudWatch"""
 
 self.cloudwatch.put_metric_data(
 Namespace='ControlTower/Compliance',
 MetricData=[
 {
 'MetricName': 'CompliantAccounts',
 'Value': compliance_report['compliant_accounts'],
 'Unit': 'Count',
 'Timestamp': datetime.utcnow()
 },
 {
 'MetricName': 'NonCompliantAccounts',
 'Value': compliance_report['non_compliant_accounts'],
 'Unit': 'Count',
 'Timestamp': datetime.utcnow()
 },
 {
 'MetricName': 'TotalViolations',
 'Value': len(compliance_report['violations']),
 'Unit': 'Count',
 'Timestamp': datetime.utcnow()
 }
 ]
 )

6. Integration with CI/CD

Account Provisioning Pipeline

# CodePipeline for automated account provisioning
Resources:
 AccountProvisioningPipeline:
 Type: AWS::CodePipeline::Pipeline
 Properties:
 RoleArn: !GetAtt CodePipelineRole.Arn
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactsBucket
 Stages:
 - Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: S3
 Version: '1'
 Configuration:
 S3Bucket: !Ref RequestsBucket
 S3ObjectKey: account-requests/
 PollForSourceChanges: true
 OutputArtifacts:
 - Name: SourceOutput

 - Name: Validate
 Actions:
 - Name: ValidateRequest
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: '1'
 Configuration:
 FunctionName: !Ref ValidateAccountRequestFunction
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: ValidatedOutput

 - Name: Approval
 Actions:
 - Name: ManualApproval
 ActionTypeId:
 Category: Approval
 Owner: AWS
 Provider: Manual
 Version: '1'
 Configuration:
 CustomData: 'Please review the account provisioning request'

 - Name: Provision
 Actions:
 - Name: ProvisionAccount
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: StepFunctions
 Version: '1'
 Configuration:
 StateMachineArn: !Ref AccountProvisioningStateMachine
 Input: |
 {
 "AccountRequest.$": "$.AccountRequest"
 }
 InputArtifacts:
 - Name: ValidatedOutput

 - Name: Configure
 Actions:
 - Name: ConfigureBaseline
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: '1'
 Configuration:
 FunctionName: !Ref ConfigureBaselineFunction
 InputArtifacts:
 - Name: ValidatedOutput

 - Name: Notify
 Actions:
 - Name: NotifyCompletion
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: SNS
 Version: '1'
 Configuration:
 TopicArn: !Ref AccountProvisioningNotifications
 Message: 'Account provisioning completed successfully'

7. Common Exam Scenarios

Scenario 1: Multi-Account Governance Setup

# Complete Control Tower setup with custom guardrails
Resources:
 # Custom OU for production workloads
 ProductionOU:
 Type: AWS::Organizations::OrganizationalUnit
 Properties:
 Name: Production
 ParentId: !Ref RootId

 # Custom guardrail for production OU
 ProductionGuardrail:
 Type: AWS::Config::OrganizationConfigRule
 Properties:
 OrganizationConfigRuleName: production-encryption-required
 OrganizationManagedRuleMetadata:
 RuleIdentifier: ENCRYPTED_VOLUMES
 Description: Ensure all EBS volumes are encrypted in production
 IncludedAccounts:
 - !Ref ProductionAccountId1
 - !Ref ProductionAccountId2

 # SCP for production OU
 ProductionSCP:
 Type: AWS::Organizations::Policy
 Properties:
 Name: ProductionSecurityPolicy
 Description: Security policy for production accounts
 Type: SERVICE_CONTROL_POLICY
 Content: |
 {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyUnencryptedStorage",
 "Effect": "Deny",
 "Action": [
 "ec2:CreateVolume",
 "rds:CreateDBInstance"
 ],
 "Resource": "*",
 "Condition": {
 "Bool": {
 "ec2:Encrypted": "false"
 }
 }
 },
 {
 "Sid": "RequireMFAForSensitiveActions",
 "Effect": "Deny",
 "Action": [
 "ec2:TerminateInstances",
 "rds:DeleteDBInstance",
 "s3:DeleteBucket"
 ],
 "Resource": "*",
 "Condition": {
 "BoolIfExists": {
 "aws:MultiFactorAuthPresent": "false"
 }
 }
 }
 ]
 }

 # Attach SCP to production OU
 ProductionSCPAttachment:
 Type: AWS::Organizations::PolicyAttachment
 Properties:
 PolicyId: !Ref ProductionSCP
 TargetId: !Ref ProductionOU
 TargetType: ORGANIZATIONAL_UNIT

Scenario 2: Automated Compliance Monitoring

# Complete compliance monitoring and remediation system
import boto3
import json
from datetime import datetime, timedelta

class ControlTowerComplianceOrchestrator:
 def __init__(self):
 self.organizations = boto3.client('organizations')
 self.config = boto3.client('config')
 self.sns = boto3.client('sns')
 self.stepfunctions = boto3.client('stepfunctions')
 
 def lambda_handler(self, event, context):
 """Main handler for compliance monitoring"""
 
 # Scheduled compliance check
 if event.get('source') == 'aws.events':
 return self.run_scheduled_compliance_check()
 
 # Config rule evaluation change
 elif event.get('source') == 'aws.config':
 return self.handle_config_evaluation_change(event)
 
 # Manual compliance check
 else:
 return self.run_manual_compliance_check(event)
 
 def run_scheduled_compliance_check(self):
 """Run scheduled compliance check across all accounts"""
 
 # Get all accounts in organization
 accounts = self.organizations.list_accounts()
 
 compliance_summary = {
 'timestamp': datetime.utcnow().isoformat(),
 'total_accounts': 0,
 'compliant_accounts': 0,
 'non_compliant_accounts': 0,
 'critical_violations': 0,
 'accounts_details': []
 }
 
 for account in accounts['Accounts']:
 if account['Status'] != 'ACTIVE':
 continue
 
 compliance_summary['total_accounts'] += 1
 account_compliance = self.check_account_compliance(account['Id'])
 
 if account_compliance['is_compliant']:
 compliance_summary['compliant_accounts'] += 1
 else:
 compliance_summary['non_compliant_accounts'] += 1
 
 # Count critical violations
 critical_violations = [v for v in account_compliance['violations'] 
 if v.get('severity') == 'CRITICAL']
 compliance_summary['critical_violations'] += len(critical_violations)
 
 # Trigger remediation for critical violations
 if critical_violations:
 self.trigger_remediation_workflow(account['Id'], critical_violations)
 
 compliance_summary['accounts_details'].append({
 'account_id': account['Id'],
 'account_name': account['Name'],
 'compliance_status': 'COMPLIANT' if account_compliance['is_compliant'] else 'NON_COMPLIANT',
 'violations_count': len(account_compliance['violations'])
 })
 
 # Send summary notification
 self.send_compliance_summary(compliance_summary)
 
 return compliance_summary
 
 def check_account_compliance(self, account_id):
 """Check compliance for a specific account"""
 
 violations = []
 is_compliant = True
 
 try:
 # Assume role in target account
 sts = boto3.client('sts')
 assumed_role = sts.assume_role(
 RoleArn=f"arn:aws:iam::{account_id}:role/AWSControlTowerExecution",
 RoleSessionName='ComplianceCheck'
 )
 
 session = boto3.Session(
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 config_client = session.client('config')
 
 # Check mandatory guardrails
 mandatory_rules = [
 {'name': 'ct-s3-bucket-public-read-prohibited', 'severity': 'CRITICAL'},
 {'name': 'ct-s3-bucket-public-write-prohibited', 'severity': 'CRITICAL'},
 {'name': 'ct-cloudtrail-enabled', 'severity': 'HIGH'},
 {'name': 'ct-config-enabled', 'severity': 'HIGH'},
 {'name': 'ct-root-mfa-enabled', 'severity': 'CRITICAL'}
 ]
 
 for rule in mandatory_rules:
 try:
 compliance_details = config_client.get_compliance_details_by_config_rule(
 ConfigRuleName=rule['name'],
 ComplianceTypes=['NON_COMPLIANT']
 )
 
 if compliance_details['EvaluationResults']:
 is_compliant = False
 violations.append({
 'rule_name': rule['name'],
 'severity': rule['severity'],
 'non_compliant_resources': len(compliance_details['EvaluationResults']),
 'resources': [r['EvaluationResultIdentifier']['EvaluationResultQualifier'] 
 for r in compliance_details['EvaluationResults'][:10]]
 })
 
 except config_client.exceptions.NoSuchConfigRuleException:
 is_compliant = False
 violations.append({
 'rule_name': rule['name'],
 'severity': 'CRITICAL',
 'error': 'Config rule not found - guardrail not enabled'
 })
 
 except Exception as e:
 is_compliant = False
 violations.append({
 'error': f'Unable to check compliance: {str(e)}',
 'severity': 'HIGH'
 })
 
 return {
 'is_compliant': is_compliant,
 'violations': violations
 }
 
 def trigger_remediation_workflow(self, account_id, violations):
 """Trigger Step Functions workflow for remediation"""
 
 workflow_input = {
 'AccountId': account_id,
 'Violations': violations,
 'Timestamp': datetime.utcnow().isoformat()
 }
 
 self.stepfunctions.start_execution(
 stateMachineArn='arn:aws:states:us-east-1:123456789012:stateMachine:ComplianceRemediation',
 name=f"remediation-{account_id}-{int(datetime.utcnow().timestamp())}",
 input=json.dumps(workflow_input)
 )
 
 def send_compliance_summary(self, summary):
 """Send compliance summary notification"""
 
 message = f"""
Control Tower Compliance Summary
===============================

Timestamp: {summary['timestamp']}
Total Accounts: {summary['total_accounts']}
Compliant Accounts: {summary['compliant_accounts']}
Non-Compliant Accounts: {summary['non_compliant_accounts']}
Critical Violations: {summary['critical_violations']}

Compliance Rate: {(summary['compliant_accounts'] / summary['total_accounts'] * 100):.1f}%

Account Details:
{json.dumps(summary['accounts_details'], indent=2)}
 """
 
 self.sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:controltower-compliance',
 Message=message,
 Subject=f"Control Tower Compliance Report - {summary['non_compliant_accounts']} Non-Compliant Accounts"
 )

8. Exam Tips

Understand Landing Zone - Core components and automatic setup
Master Guardrails - Preventive (SCP) vs Detective (Config) guardrails
Know Account Factory - Service Catalog integration and automation
Practice customization - Custom guardrails and OU structures
Learn integration - Organizations, Config, CloudTrail, Service Catalog
Understand governance - Multi-account governance and compliance
Know limitations - What Control Tower can and cannot do
Practice troubleshooting - Common setup and guardrail issues
Understand costs - Control Tower pricing and cost optimization
Master automation - Account provisioning and lifecycle management

AWS Organizations

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Organizations is an account management service that enables you to centrally manage and govern your environment as you grow and scale your AWS resources. It provides centralized billing, access control, compliance, security, and resource sharing across your AWS accounts.

Key Characteristics

Centralized management - Manage multiple AWS accounts from a single location
Consolidated billing - Single payment method and billing for all accounts
Hierarchical organization - Organize accounts using Organizational Units (OUs)
Service Control Policies - Centralized access control across accounts
Account creation - Programmatically create and manage AWS accounts
Resource sharing - Share resources across accounts in your organization
Compliance governance - Enforce policies and compliance requirements

What Problem Does It Solve?

Simplifies management of multiple AWS accounts
Provides centralized billing and cost management
Enables consistent security and compliance policies
Facilitates resource sharing and collaboration
Reduces administrative overhead
Supports organizational governance and control

2. Core Components

Organization Structure

Root Organization
├── Master Account (Management Account)
├── Security OU
│ ├── Log Archive Account
│ ├── Audit Account
│ └── Security Tools Account
├── Production OU
│ ├── Prod App Account 1
│ ├── Prod App Account 2
│ └── Prod Database Account
├── Development OU
│ ├── Dev Account 1
│ ├── Dev Account 2
│ └── Sandbox Account
└── Shared Services OU
 ├── Network Account
 ├── DNS Account
 └── Monitoring Account

Account Creation

# Programmatic account creation
import boto3
import json
import time

def create_account(account_name, email, role_name="OrganizationAccountAccessRole"):
 """Create new AWS account in organization"""
 
 organizations = boto3.client('organizations')
 
 try:
 # Create account
 response = organizations.create_account(
 Email=email,
 AccountName=account_name,
 RoleName=role_name
 )
 
 request_id = response['CreateAccountStatus']['Id']
 
 # Wait for account creation to complete
 while True:
 status_response = organizations.describe_create_account_status(
 CreateAccountRequestId=request_id
 )
 
 status = status_response['CreateAccountStatus']['State']
 
 if status == 'SUCCEEDED':
 account_id = status_response['CreateAccountStatus']['AccountId']
 print(f"Account created successfully: {account_id}")
 return account_id
 
 elif status == 'FAILED':
 failure_reason = status_response['CreateAccountStatus']['FailureReason']
 raise Exception(f"Account creation failed: {failure_reason}")
 
 print(f"Account creation in progress: {status}")
 time.sleep(30)
 
 except Exception as e:
 print(f"Error creating account: {str(e)}")
 raise

# CloudFormation template for account creation
Resources:
 NewAccount:
 Type: AWS::Organizations::Account
 Properties:
 AccountName: !Ref AccountName
 Email: !Ref AccountEmail
 RoleName: OrganizationAccountAccessRole
 Tags:
 - Key: Environment
 Value: !Ref Environment
 - Key: Department
 Value: !Ref Department

Organizational Units (OUs)

# CloudFormation template for OU structure
Resources:
 SecurityOU:
 Type: AWS::Organizations::OrganizationalUnit
 Properties:
 Name: Security
 ParentId: !Ref RootId
 Tags:
 - Key: Purpose
 Value: Security and Compliance

 ProductionOU:
 Type: AWS::Organizations::OrganizationalUnit
 Properties:
 Name: Production
 ParentId: !Ref RootId
 Tags:
 - Key: Purpose
 Value: Production Workloads

 DevelopmentOU:
 Type: AWS::Organizations::OrganizationalUnit
 Properties:
 Name: Development
 ParentId: !Ref RootId
 Tags:
 - Key: Purpose
 Value: Development and Testing

 # Move account to OU
 MoveAccountToOU:
 Type: AWS::Organizations::Account
 Properties:
 AccountId: !Ref TargetAccountId
 ParentId: !Ref ProductionOU

3. Service Control Policies (SCPs)

Preventive Controls

{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyRootUserActions",
 "Effect": "Deny",
 "Principal": {
 "AWS": "*"
 },
 "Action": "*",
 "Resource": "*",
 "Condition": {
 "StringEquals": {
 "aws:PrincipalType": "Root"
 },
 "StringNotEquals": {
 "aws:RequestedRegion": [
 "us-east-1",
 "us-west-2"
 ]
 }
 }
 },
 {
 "Sid": "DenyUnencryptedStorage",
 "Effect": "Deny",
 "Action": [
 "s3:PutObject",
 "ec2:CreateVolume",
 "rds:CreateDBInstance"
 ],
 "Resource": "*",
 "Condition": {
 "Bool": {
 "aws:SecureTransport": "false"
 }
 }
 },
 {
 "Sid": "RequireMFAForSensitiveActions",
 "Effect": "Deny",
 "Action": [
 "ec2:TerminateInstances",
 "rds:DeleteDBInstance",
 "s3:DeleteBucket",
 "iam:DeleteRole",
 "iam:DeleteUser"
 ],
 "Resource": "*",
 "Condition": {
 "BoolIfExists": {
 "aws:MultiFactorAuthPresent": "false"
 }
 }
 },
 {
 "Sid": "RestrictRegions",
 "Effect": "Deny",
 "NotAction": [
 "iam:*",
 "sts:*",
 "cloudfront:*",
 "route53:*",
 "support:*",
 "trustedadvisor:*"
 ],
 "Resource": "*",
 "Condition": {
 "StringNotEquals": {
 "aws:RequestedRegion": [
 "us-east-1",
 "us-west-2",
 "eu-west-1"
 ]
 }
 }
 }
 ]
}

Environment-Specific SCPs

{
 "DevelopmentSCP": {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyExpensiveInstances",
 "Effect": "Deny",
 "Action": [
 "ec2:RunInstances"
 ],
 "Resource": "arn:aws:ec2:*:*:instance/*",
 "Condition": {
 "ForAllValues:StringNotLike": {
 "ec2:InstanceType": [
 "t3.*",
 "t2.*"
 ]
 }
 }
 },
 {
 "Sid": "DenyProductionResources",
 "Effect": "Deny",
 "Action": [
 "rds:CreateDBInstance"
 ],
 "Resource": "*",
 "Condition": {
 "StringNotEquals": {
 "rds:db-instance-class": [
 "db.t3.micro",
 "db.t3.small"
 ]
 }
 }
 }
 ]
 },
 "ProductionSCP": {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "RequireEncryption",
 "Effect": "Deny",
 "Action": [
 "s3:PutObject",
 "ec2:CreateVolume",
 "rds:CreateDBInstance"
 ],
 "Resource": "*",
 "Condition": {
 "Bool": {
 "aws:SecureTransport": "false"
 }
 }
 },
 {
 "Sid": "PreventConfigChanges",
 "Effect": "Deny",
 "Action": [
 "config:StopConfigurationRecorder",
 "config:DeleteConfigurationRecorder",
 "cloudtrail:StopLogging",
 "cloudtrail:DeleteTrail"
 ],
 "Resource": "*",
 "Condition": {
 "StringNotEquals": {
 "aws:PrincipalArn": [
 "arn:aws:iam::*:role/OrganizationAccountAccessRole"
 ]
 }
 }
 }
 ]
 }
}

SCP Management

# SCP management functions
import boto3
import json

class SCPManager:
 def __init__(self):
 self.organizations = boto3.client('organizations')
 
 def create_scp(self, name, description, policy_document):
 """Create a new Service Control Policy"""
 
 response = self.organizations.create_policy(
 Name=name,
 Description=description,
 Type='SERVICE_CONTROL_POLICY',
 Content=json.dumps(policy_document, indent=2)
 )
 
 return response['Policy']['PolicySummary']['Id']
 
 def attach_scp_to_ou(self, policy_id, ou_id):
 """Attach SCP to an Organizational Unit"""
 
 self.organizations.attach_policy(
 PolicyId=policy_id,
 TargetId=ou_id
 )
 
 def attach_scp_to_account(self, policy_id, account_id):
 """Attach SCP to a specific account"""
 
 self.organizations.attach_policy(
 PolicyId=policy_id,
 TargetId=account_id
 )
 
 def get_effective_policies(self, account_id):
 """Get all effective policies for an account"""
 
 policies = []
 
 # Get policies attached directly to account
 account_policies = self.organizations.list_policies_for_target(
 TargetId=account_id,
 Filter='SERVICE_CONTROL_POLICY'
 )
 policies.extend(account_policies['Policies'])
 
 # Get policies from parent OUs
 parents = self.organizations.list_parents(ChildId=account_id)
 
 for parent in parents['Parents']:
 if parent['Type'] == 'ORGANIZATIONAL_UNIT':
 ou_policies = self.get_ou_policies(parent['Id'])
 policies.extend(ou_policies)
 
 return policies
 
 def get_ou_policies(self, ou_id):
 """Get policies for an OU and its parents"""
 
 policies = []
 
 # Get policies attached to this OU
 ou_policies = self.organizations.list_policies_for_target(
 TargetId=ou_id,
 Filter='SERVICE_CONTROL_POLICY'
 )
 policies.extend(ou_policies['Policies'])
 
 # Get policies from parent OUs
 parents = self.organizations.list_parents(ChildId=ou_id)
 
 for parent in parents['Parents']:
 if parent['Type'] == 'ORGANIZATIONAL_UNIT':
 parent_policies = self.get_ou_policies(parent['Id'])
 policies.extend(parent_policies)
 
 return policies
 
 def simulate_policy_effect(self, account_id, action, resource):
 """Simulate the effect of SCPs on a specific action"""
 
 # This is a simplified simulation
 # In practice, you'd need to evaluate all effective policies
 
 effective_policies = self.get_effective_policies(account_id)
 
 for policy in effective_policies:
 policy_content = json.loads(policy['Content'])
 
 for statement in policy_content.get('Statement', []):
 if statement.get('Effect') == 'Deny':
 # Check if action matches
 actions = statement.get('Action', [])
 if isinstance(actions, str):
 actions = [actions]
 
 for policy_action in actions:
 if self.action_matches(action, policy_action):
 return {
 'allowed': False,
 'reason': f'Denied by SCP: {policy["Name"]}',
 'policy_id': policy['Id']
 }
 
 return {
 'allowed': True,
 'reason': 'No explicit deny found in SCPs'
 }
 
 def action_matches(self, action, policy_action):
 """Check if an action matches a policy action pattern"""
 
 if policy_action == '*':
 return True
 
 if '*' in policy_action:
 # Simple wildcard matching
 pattern = policy_action.replace('*', '.*')
 import re
 return bool(re.match(pattern, action))
 
 return action == policy_action

4. Consolidated Billing and Cost Management

Cost Allocation and Tagging

# Cost management and allocation
import boto3
from datetime import datetime, timedelta

class OrganizationCostManager:
 def __init__(self):
 self.ce = boto3.client('ce') # Cost Explorer
 self.organizations = boto3.client('organizations')
 self.budgets = boto3.client('budgets')
 
 def get_organization_costs(self, start_date, end_date):
 """Get cost breakdown by account and service"""
 
 response = self.ce.get_cost_and_usage(
 TimePeriod={
 'Start': start_date.strftime('%Y-%m-%d'),
 'End': end_date.strftime('%Y-%m-%d')
 },
 Granularity='MONTHLY',
 Metrics=['BlendedCost', 'UnblendedCost'],
 GroupBy=[
 {'Type': 'DIMENSION', 'Key': 'LINKED_ACCOUNT'},
 {'Type': 'DIMENSION', 'Key': 'SERVICE'}
 ]
 )
 
 return response['ResultsByTime']
 
 def create_account_budget(self, account_id, budget_amount, notification_email):
 """Create budget for a specific account"""
 
 budget_name = f"Account-{account_id}-Monthly-Budget"
 
 budget = {
 'BudgetName': budget_name,
 'BudgetLimit': {
 'Amount': str(budget_amount),
 'Unit': 'USD'
 },
 'TimeUnit': 'MONTHLY',
 'BudgetType': 'COST',
 'CostFilters': {
 'LinkedAccount': [account_id]
 }
 }
 
 notifications = [
 {
 'Notification': {
 'NotificationType': 'ACTUAL',
 'ComparisonOperator': 'GREATER_THAN',
 'Threshold': 80.0,
 'ThresholdType': 'PERCENTAGE'
 },
 'Subscribers': [
 {
 'SubscriptionType': 'EMAIL',
 'Address': notification_email
 }
 ]
 },
 {
 'Notification': {
 'NotificationType': 'FORECASTED',
 'ComparisonOperator': 'GREATER_THAN',
 'Threshold': 100.0,
 'ThresholdType': 'PERCENTAGE'
 },
 'Subscribers': [
 {
 'SubscriptionType': 'EMAIL',
 'Address': notification_email
 }
 ]
 }
 ]
 
 # Create budget in master account
 master_account_id = self.get_master_account_id()
 
 self.budgets.create_budget(
 AccountId=master_account_id,
 Budget=budget,
 NotificationsWithSubscribers=notifications
 )
 
 return budget_name
 
 def get_cost_by_ou(self, ou_id, start_date, end_date):
 """Get aggregated costs for all accounts in an OU"""
 
 # Get all accounts in the OU
 accounts = self.get_accounts_in_ou(ou_id)
 account_ids = [acc['Id'] for acc in accounts]
 
 if not account_ids:
 return {'TotalCost': 0, 'AccountCosts': []}
 
 response = self.ce.get_cost_and_usage(
 TimePeriod={
 'Start': start_date.strftime('%Y-%m-%d'),
 'End': end_date.strftime('%Y-%m-%d')
 },
 Granularity='MONTHLY',
 Metrics=['BlendedCost'],
 GroupBy=[
 {'Type': 'DIMENSION', 'Key': 'LINKED_ACCOUNT'}
 ],
 Filter={
 'Dimensions': {
 'Key': 'LINKED_ACCOUNT',
 'Values': account_ids
 }
 }
 )
 
 total_cost = 0
 account_costs = []
 
 for result in response['ResultsByTime']:
 for group in result['Groups']:
 account_id = group['Keys'][0]
 cost = float(group['Metrics']['BlendedCost']['Amount'])
 total_cost += cost
 
 account_costs.append({
 'AccountId': account_id,
 'Cost': cost
 })
 
 return {
 'TotalCost': total_cost,
 'AccountCosts': account_costs
 }
 
 def get_accounts_in_ou(self, ou_id):
 """Get all accounts in an organizational unit"""
 
 accounts = []
 
 # Get direct child accounts
 children = self.organizations.list_children(
 ParentId=ou_id,
 ChildType='ACCOUNT'
 )
 
 for child in children['Children']:
 account = self.organizations.describe_account(AccountId=child['Id'])
 accounts.append(account['Account'])
 
 # Get accounts from child OUs
 child_ous = self.organizations.list_children(
 ParentId=ou_id,
 ChildType='ORGANIZATIONAL_UNIT'
 )
 
 for child_ou in child_ous['Children']:
 child_accounts = self.get_accounts_in_ou(child_ou['Id'])
 accounts.extend(child_accounts)
 
 return accounts
 
 def generate_cost_report(self):
 """Generate comprehensive cost report for the organization"""
 
 end_date = datetime.utcnow()
 start_date = end_date - timedelta(days=30)
 
 # Get organization structure
 root_id = self.organizations.list_roots()['Roots'][0]['Id']
 ous = self.get_all_ous(root_id)
 
 report = {
 'ReportDate': end_date.isoformat(),
 'Period': f"{start_date.strftime('%Y-%m-%d')} to {end_date.strftime('%Y-%m-%d')}",
 'OrganizationCosts': []
 }
 
 total_org_cost = 0
 
 for ou in ous:
 ou_costs = self.get_cost_by_ou(ou['Id'], start_date, end_date)
 total_org_cost += ou_costs['TotalCost']
 
 report['OrganizationCosts'].append({
 'OUName': ou['Name'],
 'OUId': ou['Id'],
 'TotalCost': ou_costs['TotalCost'],
 'AccountCosts': ou_costs['AccountCosts']
 })
 
 report['TotalOrganizationCost'] = total_org_cost
 
 return report

Reserved Instance Management

# CloudFormation template for RI management
Resources:
 RIRecommendationFunction:
 Type: AWS::Lambda::Function
 Properties:
 FunctionName: ri-recommendation-analyzer
 Runtime: python3.9
 Handler: index.lambda_handler
 Role: !GetAtt RIAnalysisRole.Arn
 Code:
 ZipFile: |
 import boto3
 import json
 from datetime import datetime, timedelta
 
 def lambda_handler(event, context):
 """Analyze RI recommendations across organization"""
 
 ce = boto3.client('ce')
 organizations = boto3.client('organizations')
 
 # Get all accounts
 accounts = organizations.list_accounts()
 
 recommendations = []
 
 for account in accounts['Accounts']:
 if account['Status'] != 'ACTIVE':
 continue
 
 # Get RI recommendations for account
 response = ce.get_reservation_purchase_recommendation(
 Service='Amazon Elastic Compute Cloud - Compute',
 AccountId=account['Id'],
 LookbackPeriodInDays='SIXTY_DAYS',
 TermInYears='ONE_YEAR',
 PaymentOption='PARTIAL_UPFRONT'
 )
 
 if response['Recommendations']:
 for rec in response['Recommendations']:
 recommendations.append({
 'AccountId': account['Id'],
 'AccountName': account['Name'],
 'InstanceType': rec['RecommendationDetails']['InstanceDetails']['EC2InstanceDetails']['InstanceType'],
 'EstimatedMonthlySavings': rec['RecommendationDetails']['EstimatedMonthlySavingsAmount'],
 'UpfrontCost': rec['RecommendationDetails']['UpfrontCost'],
 'RecommendedQuantity': rec['RecommendationDetails']['RecommendedNumberOfInstancesToPurchase']
 })
 
 # Send recommendations to SNS
 sns = boto3.client('sns')
 sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:ri-recommendations',
 Message=json.dumps(recommendations, indent=2),
 Subject='Reserved Instance Recommendations'
 )
 
 return {
 'statusCode': 200,
 'body': json.dumps(f'Found {len(recommendations)} RI recommendations')
 }

 RIRecommendationSchedule:
 Type: AWS::Events::Rule
 Properties:
 Description: Weekly RI recommendation analysis
 ScheduleExpression: rate(7 days)
 State: ENABLED
 Targets:
 - Arn: !GetAtt RIRecommendationFunction.Arn
 Id: RIRecommendationTarget

 RIRecommendationPermission:
 Type: AWS::Lambda::Permission
 Properties:
 FunctionName: !Ref RIRecommendationFunction
 Action: lambda:InvokeFunction
 Principal: events.amazonaws.com
 SourceArn: !GetAtt RIRecommendationSchedule.Arn

AWS Resource Access Manager (RAM)

# Resource sharing with RAM
Resources:
 SharedVPCResourceShare:
 Type: AWS::RAM::ResourceShare
 Properties:
 Name: SharedVPCResourceShare
 ResourceArns:
 - !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/${PrivateSubnet1}"
 - !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:subnet/${PrivateSubnet2}"
 Principals:
 - !Ref TargetAccountId1
 - !Ref TargetAccountId2
 AllowExternalPrincipals: false
 Tags:
 - Key: Purpose
 Value: SharedNetworking

 SharedTransitGateway:
 Type: AWS::RAM::ResourceShare
 Properties:
 Name: SharedTransitGatewayShare
 ResourceArns:
 - !Sub "arn:aws:ec2:${AWS::Region}:${AWS::AccountId}:transit-gateway/${TransitGateway}"
 Principals:
 - !Ref ProductionOUId
 AllowExternalPrincipals: false
 Tags:
 - Key: Purpose
 Value: NetworkConnectivity

Cross-Account Resource Access

# Cross-account resource management
import boto3
import json

class CrossAccountResourceManager:
 def __init__(self):
 self.ram = boto3.client('ram')
 self.organizations = boto3.client('organizations')
 self.sts = boto3.client('sts')
 
 def share_resources_with_ou(self, resource_arns, ou_id, share_name):
 """Share resources with all accounts in an OU"""
 
 # Get all accounts in the OU
 accounts = self.get_accounts_in_ou(ou_id)
 account_ids = [acc['Id'] for acc in accounts]
 
 # Create resource share
 response = self.ram.create_resource_share(
 name=share_name,
 resourceArns=resource_arns,
 principals=account_ids,
 allowExternalPrincipals=False,
 tags=[
 {'key': 'CreatedBy', 'value': 'CrossAccountResourceManager'},
 {'key': 'TargetOU', 'value': ou_id}
 ]
 )
 
 return response['resourceShare']['arn']
 
 def accept_resource_share_invitation(self, invitation_arn):
 """Accept a resource share invitation"""
 
 self.ram.accept_resource_share_invitation(
 resourceShareInvitationArn=invitation_arn
 )
 
 def get_shared_resources(self, account_id):
 """Get resources shared with a specific account"""
 
 # Get resource shares where account is a principal
 shares = self.ram.get_resource_shares(
 resourceOwner='OTHER-ACCOUNTS',
 resourceShareStatus='ACTIVE'
 )
 
 shared_resources = []
 
 for share in shares['resourceShares']:
 # Get resources in this share
 resources = self.ram.get_resource_share_associations(
 resourceShareArns=[share['arn']],
 associationType='RESOURCE'
 )
 
 for resource in resources['resourceShareAssociations']:
 shared_resources.append({
 'ResourceArn': resource['associatedEntity'],
 'ShareName': share['name'],
 'ShareArn': share['arn'],
 'Status': resource['status']
 })
 
 return shared_resources
 
 def create_cross_account_role(self, target_account_id, role_name, policy_document):
 """Create a role that can be assumed by another account"""
 
 # Assume role in target account
 assumed_role = self.sts.assume_role(
 RoleArn=f"arn:aws:iam::{target_account_id}:role/OrganizationAccountAccessRole",
 RoleSessionName='CrossAccountRoleCreation'
 )
 
 # Create session with assumed role
 session = boto3.Session(
 aws_access_key_id=assumed_role['Credentials']['AccessKeyId'],
 aws_secret_access_key=assumed_role['Credentials']['SecretAccessKey'],
 aws_session_token=assumed_role['Credentials']['SessionToken']
 )
 
 iam = session.client('iam')
 
 # Create trust policy
 trust_policy = {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Principal": {
 "AWS": f"arn:aws:iam::{self.get_master_account_id()}:root"
 },
 "Action": "sts:AssumeRole",
 "Condition": {
 "StringEquals": {
 "sts:ExternalId": "unique-external-id"
 }
 }
 }
 ]
 }
 
 # Create role
 iam.create_role(
 RoleName=role_name,
 AssumeRolePolicyDocument=json.dumps(trust_policy),
 Description=f'Cross-account role for {role_name}',
 Tags=[
 {'Key': 'CreatedBy', 'Value': 'CrossAccountResourceManager'},
 {'Key': 'Purpose', 'Value': 'CrossAccountAccess'}
 ]
 )
 
 # Attach policy
 iam.put_role_policy(
 RoleName=role_name,
 PolicyName=f'{role_name}Policy',
 PolicyDocument=json.dumps(policy_document)
 )
 
 return f"arn:aws:iam::{target_account_id}:role/{role_name}"

6. Integration with Other Services

Organizations with Control Tower

# Integration with Control Tower
import boto3
import json

class OrganizationsControlTowerIntegration:
 def __init__(self):
 self.organizations = boto3.client('organizations')
 self.controltower = boto3.client('controltower')
 self.servicecatalog = boto3.client('servicecatalog')
 
 def setup_control_tower_integration(self):
 """Setup Control Tower with existing Organizations"""
 
 # Ensure organization has all features enabled
 org = self.organizations.describe_organization()
 
 if org['Organization']['FeatureSet'] != 'ALL':
 self.organizations.enable_all_features()
 
 # Create required OUs for Control Tower
 root_id = self.organizations.list_roots()['Roots'][0]['Id']
 
 # Security OU
 security_ou = self.organizations.create_organizational_unit(
 ParentId=root_id,
 Name='Security'
 )
 
 # Sandbox OU
 sandbox_ou = self.organizations.create_organizational_unit(
 ParentId=root_id,
 Name='Sandbox'
 )
 
 return {
 'SecurityOU': security_ou['OrganizationalUnit']['Id'],
 'SandboxOU': sandbox_ou['OrganizationalUnit']['Id']
 }
 
 def create_account_with_control_tower(self, account_details):
 """Create account using Control Tower Account Factory"""
 
 # Find Account Factory product
 products = self.servicecatalog.search_products(
 Filters={'FullTextSearch': ['AWS Control Tower Account Factory']}
 )
 
 if not products['ProductViewSummaries']:
 raise ValueError("Control Tower Account Factory not found")
 
 product = products['ProductViewSummaries'][0]
 
 # Provision account
 response = self.servicecatalog.provision_product(
 ProductId=product['ProductId'],
 ProvisioningArtifactId='pa-latest',
 ProvisionedProductName=f"Account-{account_details['AccountName']}",
 ProvisioningParameters=[
 {'Key': 'AccountName', 'Value': account_details['AccountName']},
 {'Key': 'AccountEmail', 'Value': account_details['AccountEmail']},
 {'Key': 'OrganizationalUnitName', 'Value': account_details['OrganizationalUnit']},
 {'Key': 'SSOUserEmail', 'Value': account_details['SSOUserEmail']},
 {'Key': 'SSOUserFirstName', 'Value': account_details['SSOUserFirstName']},
 {'Key': 'SSOUserLastName', 'Value': account_details['SSOUserLastName']}
 ]
 )
 
 return response['RecordDetail']

Organizations with Config

# Organization-wide Config setup
Resources:
 OrganizationConfigurationAggregator:
 Type: AWS::Config::ConfigurationAggregator
 Properties:
 ConfigurationAggregatorName: OrganizationAggregator
 OrganizationAggregationSource:
 RoleArn: !GetAtt ConfigAggregatorRole.Arn
 AllAwsRegions: true

 OrganizationConfigRule:
 Type: AWS::Config::OrganizationConfigRule
 Properties:
 OrganizationConfigRuleName: s3-bucket-public-read-prohibited
 OrganizationManagedRuleMetadata:
 RuleIdentifier: S3_BUCKET_PUBLIC_READ_PROHIBITED
 Description: Checks that S3 buckets do not allow public read access
 ExcludedAccounts:
 - !Ref LogArchiveAccountId  # Exclude log archive account

 OrganizationRemediationConfiguration:
 Type: AWS::Config::OrganizationRemediationConfiguration
 Properties:
 OrganizationConfigRuleName: !Ref OrganizationConfigRule
 TargetType: SSM_DOCUMENT
 TargetId: AWSConfigRemediation-RemoveS3BucketPublicReadAccess
 TargetVersion: "1"
 Parameters:
 AutomationAssumeRole:
 StaticValue: !Sub "arn:aws:iam::{account}:role/ConfigRemediationRole"
 BucketName:
 ResourceValue: RESOURCE_ID
 Automatic: false
 MaximumAutomaticAttempts: 1

7. Common Exam Scenarios

Scenario 1: Multi-Account Security Setup

# Complete multi-account security setup
import boto3
import json
from datetime import datetime

class MultiAccountSecuritySetup:
 def __init__(self):
 self.organizations = boto3.client('organizations')
 self.iam = boto3.client('iam')
 self.cloudtrail = boto3.client('cloudtrail')
 self.config = boto3.client('config')
 
 def setup_organization_security(self):
 """Setup comprehensive security across organization"""
 
 # 1. Create security-focused OU structure
 security_structure = self.create_security_ou_structure()
 
 # 2. Apply security SCPs
 security_policies = self.create_security_scps()
 
 # 3. Setup centralized logging
 logging_setup = self.setup_centralized_logging()
 
 # 4. Configure organization-wide Config
 config_setup = self.setup_organization_config()
 
 # 5. Create cross-account security roles
 security_roles = self.create_security_roles()
 
 return {
 'SecurityStructure': security_structure,
 'SecurityPolicies': security_policies,
 'LoggingSetup': logging_setup,
 'ConfigSetup': config_setup,
 'SecurityRoles': security_roles
 }
 
 def create_security_ou_structure(self):
 """Create security-focused OU structure"""
 
 root_id = self.organizations.list_roots()['Roots'][0]['Id']
 
 # Security OU for security-related accounts
 security_ou = self.organizations.create_organizational_unit(
 ParentId=root_id,
 Name='Security'
 )
 
 # Production OU with strict controls
 production_ou = self.organizations.create_organizational_unit(
 ParentId=root_id,
 Name='Production'
 )
 
 # Development OU with relaxed controls
 development_ou = self.organizations.create_organizational_unit(
 ParentId=root_id,
 Name='Development'
 )
 
 # Sandbox OU for experimentation
 sandbox_ou = self.organizations.create_organizational_unit(
 ParentId=root_id,
 Name='Sandbox'
 )
 
 return {
 'SecurityOU': security_ou['OrganizationalUnit']['Id'],
 'ProductionOU': production_ou['OrganizationalUnit']['Id'],
 'DevelopmentOU': development_ou['OrganizationalUnit']['Id'],
 'SandboxOU': sandbox_ou['OrganizationalUnit']['Id']
 }
 
 def create_security_scps(self):
 """Create and apply security-focused SCPs"""
 
 # Base security policy for all accounts
 base_security_policy = {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "DenyRootUserActions",
 "Effect": "Deny",
 "Principal": {"AWS": "*"},
 "Action": "*",
 "Resource": "*",
 "Condition": {
 "StringEquals": {"aws:PrincipalType": "Root"}
 }
 },
 {
 "Sid": "RequireMFAForSensitiveActions",
 "Effect": "Deny",
 "Action": [
 "ec2:TerminateInstances",
 "rds:DeleteDBInstance",
 "s3:DeleteBucket"
 ],
 "Resource": "*",
 "Condition": {
 "BoolIfExists": {"aws:MultiFactorAuthPresent": "false"}
 }
 },
 {
 "Sid": "PreventSecurityServiceDisabling",
 "Effect": "Deny",
 "Action": [
 "config:StopConfigurationRecorder",
 "cloudtrail:StopLogging",
 "guardduty:DeleteDetector"
 ],
 "Resource": "*",
 "Condition": {
 "StringNotEquals": {
 "aws:PrincipalArn": [
 "arn:aws:iam::*:role/OrganizationAccountAccessRole"
 ]
 }
 }
 }
 ]
 }
 
 # Production-specific policy
 production_policy = {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "RequireEncryption",
 "Effect": "Deny",
 "Action": [
 "s3:PutObject",
 "ec2:CreateVolume",
 "rds:CreateDBInstance"
 ],
 "Resource": "*",
 "Condition": {
 "Bool": {"aws:SecureTransport": "false"}
 }
 },
 {
 "Sid": "RestrictInstanceTypes",
 "Effect": "Deny",
 "Action": "ec2:RunInstances",
 "Resource": "arn:aws:ec2:*:*:instance/*",
 "Condition": {
 "ForAllValues:StringNotLike": {
 "ec2:InstanceType": [
 "t3.*", "m5.*", "c5.*", "r5.*"
 ]
 }
 }
 }
 ]
 }
 
 # Create policies
 base_policy_id = self.organizations.create_policy(
 Name='BaseSecurityPolicy',
 Description='Base security policy for all accounts',
 Type='SERVICE_CONTROL_POLICY',
 Content=json.dumps(base_security_policy)
 )['Policy']['PolicySummary']['Id']
 
 production_policy_id = self.organizations.create_policy(
 Name='ProductionSecurityPolicy',
 Description='Additional security policy for production accounts',
 Type='SERVICE_CONTROL_POLICY',
 Content=json.dumps(production_policy)
 )['Policy']['PolicySummary']['Id']
 
 return {
 'BasePolicyId': base_policy_id,
 'ProductionPolicyId': production_policy_id
 }
 
 def setup_centralized_logging(self):
 """Setup centralized CloudTrail logging"""
 
 # Create organization trail
 trail_response = self.cloudtrail.create_trail(
 Name='OrganizationTrail',
 S3BucketName='organization-cloudtrail-logs',
 IncludeGlobalServiceEvents=True,
 IsMultiRegionTrail=True,
 EnableLogFileValidation=True,
 IsOrganizationTrail=True,
 EventSelectors=[
 {
 'ReadWriteType': 'All',
 'IncludeManagementEvents': True,
 'DataResources': [
 {
 'Type': 'AWS::S3::Object',
 'Values': ['arn:aws:s3:::*/*']
 }
 ]
 }
 ]
 )
 
 # Start logging
 self.cloudtrail.start_logging(Name='OrganizationTrail')
 
 return {
 'TrailArn': trail_response['TrailARN']
 }
 
 def setup_organization_config(self):
 """Setup organization-wide Config"""
 
 # Create configuration aggregator
 aggregator_response = self.config.put_configuration_aggregator(
 ConfigurationAggregatorName='OrganizationAggregator',
 OrganizationAggregationSource={
 'RoleArn': 'arn:aws:iam::123456789012:role/ConfigAggregatorRole',
 'AllAwsRegions': True
 }
 )
 
 # Create organization Config rules
 config_rules = [
 {
 'name': 's3-bucket-public-read-prohibited',
 'identifier': 'S3_BUCKET_PUBLIC_READ_PROHIBITED'
 },
 {
 'name': 'cloudtrail-enabled',
 'identifier': 'CLOUD_TRAIL_ENABLED'
 },
 {
 'name': 'root-mfa-enabled',
 'identifier': 'ROOT_MFA_ENABLED'
 }
 ]
 
 created_rules = []
 
 for rule in config_rules:
 rule_response = self.config.put_organization_config_rule(
 OrganizationConfigRuleName=rule['name'],
 OrganizationManagedRuleMetadata={
 'RuleIdentifier': rule['identifier'],
 'Description': f'Organization-wide {rule["name"]} rule'
 }
 )
 created_rules.append(rule_response['OrganizationConfigRuleArn'])
 
 return {
 'AggregatorArn': aggregator_response['ConfigurationAggregator']['ConfigurationAggregatorArn'],
 'ConfigRules': created_rules
 }

8. Exam Tips

Understand organization structure - Root, OUs, accounts hierarchy
Master SCPs - Preventive controls and policy inheritance
Know consolidated billing - Cost allocation, budgets, RI management
Practice account management - Creation, movement, lifecycle
Learn resource sharing - RAM integration and cross-account access
Understand integration - Control Tower, Config, CloudTrail integration
Know limitations - What Organizations can and cannot control
Practice troubleshooting - Common SCP and account issues
Understand governance - Compliance, security, and operational governance
Master automation - Programmatic account and policy management

AWS SAM (Serverless Application Model)

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS SAM is an open-source framework for building serverless applications on AWS. It provides shorthand syntax to express functions, APIs, databases, and event source mappings.

Key Characteristics

Simplified syntax - Shorthand CloudFormation for serverless resources
Local development - Test and debug locally with SAM CLI
Built-in best practices - Security, performance, and cost optimization
CloudFormation extension - Transforms SAM templates to CloudFormation
CI/CD integration - Native support for deployment pipelines
Multi-runtime support - Node.js, Python, Java, C#, Go, Ruby, PowerShell
Event source integration - API Gateway, S3, DynamoDB, SQS, SNS, etc.

What Problem Does It Solve?

Simplifies serverless application development and deployment
Provides local testing environment for Lambda functions
Reduces CloudFormation template complexity for serverless resources
Enables rapid prototyping and development of serverless applications
Facilitates serverless application packaging and deployment
Supports serverless application monitoring and debugging

2. SAM Template Structure

Basic SAM Template

# template.yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Simple SAM application

Globals:
 Function:
 Timeout: 30
 Runtime: python3.9
 Environment:
 Variables:
 ENVIRONMENT: !Ref Environment

Parameters:
 Environment:
 Type: String
 Default: dev
 AllowedValues: [dev, staging, prod]

Resources:
 HelloWorldFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: hello_world/
 Handler: app.lambda_handler
 Runtime: python3.9
 Events:
 HelloWorld:
 Type: Api
 Properties:
 Path: /hello
 Method: get

 HelloWorldApi:
 Type: AWS::Serverless::Api
 Properties:
 StageName: !Ref Environment
 Cors:
 AllowMethods: "'GET,POST,OPTIONS'"
 AllowHeaders: "'content-type'"
 AllowOrigin: "'*'"

Outputs:
 HelloWorldApi:
 Description: "API Gateway endpoint URL"
 Value: !Sub "https://${ServerlessRestApi}.execute-api.${AWS::Region}.amazonaws.com/${Environment}/hello/"
 HelloWorldFunction:
 Description: "Hello World Lambda Function ARN"
 Value: !GetAtt HelloWorldFunction.Arn

Function with Multiple Event Sources

Resources:
 ProcessorFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: processor/
 Handler: app.lambda_handler
 Runtime: python3.9
 Events:
 # API Gateway event
 ApiEvent:
 Type: Api
 Properties:
 Path: /process
 Method: post
 
 # S3 event
 S3Event:
 Type: S3
 Properties:
 Bucket: !Ref ProcessingBucket
 Events: s3:ObjectCreated:*
 Filter:
 S3Key:
 Rules:
 - Name: prefix
 Value: uploads/
 
 # DynamoDB event
 DynamoDBEvent:
 Type: DynamoDB
 Properties:
 Stream: !GetAtt ProcessingTable.StreamArn
 StartingPosition: TRIM_HORIZON
 BatchSize: 10
 
 # SQS event
 SQSEvent:
 Type: SQS
 Properties:
 Queue: !GetAtt ProcessingQueue.Arn
 BatchSize: 10
 
 # CloudWatch Events
 ScheduleEvent:
 Type: Schedule
 Properties:
 Schedule: rate(5 minutes)
 Input: '{"source": "scheduled"}'

 ProcessingBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: !Sub "${AWS::StackName}-processing-bucket"

 ProcessingTable:
 Type: AWS::DynamoDB::Table
 Properties:
 TableName: !Sub "${AWS::StackName}-processing-table"
 AttributeDefinitions:
 - AttributeName: id
 AttributeType: S
 KeySchema:
 - AttributeName: id
 KeyType: HASH
 StreamSpecification:
 StreamViewType: NEW_AND_OLD_IMAGES
 BillingMode: PAY_PER_REQUEST

 ProcessingQueue:
 Type: AWS::SQS::Queue
 Properties:
 QueueName: !Sub "${AWS::StackName}-processing-queue"

3. SAM CLI Commands

Local Development

# Initialize new SAM application
sam init
sam init --runtime python3.9 --name my-sam-app

# Build application
sam build
sam build --use-container # Build in Docker container

# Local testing
sam local start-api # Start API Gateway locally
sam local start-api --port 8080 # Custom port
sam local start-lambda # Start Lambda service locally

# Invoke function locally
sam local invoke HelloWorldFunction
sam local invoke HelloWorldFunction --event events/event.json
sam local invoke --env-vars env.json

# Generate sample events
sam local generate-event apigateway aws-proxy
sam local generate-event s3 put
sam local generate-event dynamodb update

# Local debugging
sam local start-api --debug-port 5858
sam local invoke --debug-port 5858 HelloWorldFunction

Deployment Commands

# Deploy application
sam deploy --guided # Interactive deployment
sam deploy # Use samconfig.toml
sam deploy --parameter-overrides Environment=prod

# Package application
sam package --s3-bucket my-deployment-bucket --output-template-file packaged.yaml

# Validate template
sam validate
sam validate --template template.yaml

# Delete application
sam delete
sam delete --stack-name my-sam-app

Configuration File

# samconfig.toml
version = 0.1
[default]
[default.deploy]
[default.deploy.parameters]
stack_name = "my-sam-app"
s3_bucket = "my-deployment-bucket"
s3_prefix = "my-sam-app"
region = "us-east-1"
capabilities = "CAPABILITY_IAM"
parameter_overrides = "Environment=dev"
confirm_changeset = true
fail_on_empty_changeset = false

[production]
[production.deploy]
[production.deploy.parameters]
stack_name = "my-sam-app-prod"
s3_bucket = "my-deployment-bucket-prod"
region = "us-east-1"
parameter_overrides = "Environment=prod"

4. Advanced SAM Features

Nested Applications

# Parent template
Resources:
 AuthenticationApp:
 Type: AWS::Serverless::Application
 Properties:
 Location: auth/template.yaml
 Parameters:
 Environment: !Ref Environment

 ProcessingApp:
 Type: AWS::Serverless::Application
 Properties:
 Location: processing/template.yaml
 Parameters:
 Environment: !Ref Environment
 AuthTable: !GetAtt AuthenticationApp.Outputs.UserTable

# Child template (auth/template.yaml)
Parameters:
 Environment:
 Type: String

Resources:
 UserTable:
 Type: AWS::DynamoDB::Table
 Properties:
 TableName: !Sub "${Environment}-users"
 # ... table configuration

Outputs:
 UserTable:
 Description: User table name
 Value: !Ref UserTable
 Export:
 Name: !Sub "${AWS::StackName}-UserTable"

Layers

Resources:
 SharedLayer:
 Type: AWS::Serverless::LayerVersion
 Properties:
 LayerName: shared-dependencies
 Description: Shared dependencies layer
 ContentUri: layers/shared/
 CompatibleRuntimes:
 - python3.9
 - python3.8
 RetentionPolicy: Delete

 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: function/
 Handler: app.lambda_handler
 Runtime: python3.9
 Layers:
 - !Ref SharedLayer
 - arn:aws:lambda:us-east-1:123456789012:layer:external-layer:1

Custom Authorizers

Resources:
 MyApi:
 Type: AWS::Serverless::Api
 Properties:
 StageName: !Ref Environment
 Auth:
 DefaultAuthorizer: MyLambdaAuthorizer
 Authorizers:
 MyLambdaAuthorizer:
 FunctionArn: !GetAtt AuthorizerFunction.Arn
 Identity:
 Headers:
 - Authorization
 ReauthorizeEvery: 300

 AuthorizerFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: authorizer/
 Handler: app.lambda_handler
 Runtime: python3.9

 ProtectedFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: protected/
 Handler: app.lambda_handler
 Runtime: python3.9
 Events:
 ProtectedApi:
 Type: Api
 Properties:
 RestApiId: !Ref MyApi
 Path: /protected
 Method: get
 Auth:
 Authorizer: MyLambdaAuthorizer

5. SAM with CI/CD

CodePipeline Integration

# pipeline.yaml
Resources:
 ArtifactsBucket:
 Type: AWS::S3::Bucket
 Properties:
 BucketName: !Sub "${AWS::StackName}-artifacts"
 VersioningConfiguration:
 Status: Enabled

 CodePipeline:
 Type: AWS::CodePipeline::Pipeline
 Properties:
 RoleArn: !GetAtt CodePipelineRole.Arn
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactsBucket
 Stages:
 - Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: CodeCommit
 Version: '1'
 Configuration:
 RepositoryName: !Ref RepoName
 BranchName: main
 OutputArtifacts:
 - Name: SourceOutput

 - Name: Build
 Actions:
 - Name: BuildAction
 ActionTypeId:
 Category: Build
 Owner: AWS
 Provider: CodeBuild
 Version: '1'
 Configuration:
 ProjectName: !Ref CodeBuildProject
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: BuildOutput

 - Name: Deploy-Dev
 Actions:
 - Name: DeployDev
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: '1'
 Configuration:
 ActionMode: CREATE_UPDATE
 StackName: !Sub "${AWS::StackName}-dev"
 TemplatePath: BuildOutput::packaged-template.yaml
 Capabilities: CAPABILITY_IAM
 ParameterOverrides: |
 Environment=dev
 RoleArn: !GetAtt CloudFormationRole.Arn
 InputArtifacts:
 - Name: BuildOutput

 - Name: Deploy-Prod
 Actions:
 - Name: ApprovalAction
 ActionTypeId:
 Category: Approval
 Owner: AWS
 Provider: Manual
 Version: '1'
 Configuration:
 CustomData: 'Please review and approve production deployment'
 
 - Name: DeployProd
 ActionTypeId:
 Category: Deploy
 Owner: AWS
 Provider: CloudFormation
 Version: '1'
 Configuration:
 ActionMode: CREATE_UPDATE
 StackName: !Sub "${AWS::StackName}-prod"
 TemplatePath: BuildOutput::packaged-template.yaml
 Capabilities: CAPABILITY_IAM
 ParameterOverrides: |
 Environment=prod
 RoleArn: !GetAtt CloudFormationRole.Arn
 InputArtifacts:
 - Name: BuildOutput
 RunOrder: 2

CodeBuild Project

Resources:
 CodeBuildProject:
 Type: AWS::CodeBuild::Project
 Properties:
 Name: !Sub "${AWS::StackName}-build"
 ServiceRole: !GetAtt CodeBuildRole.Arn
 Artifacts:
 Type: CODEPIPELINE
 Environment:
 Type: LINUX_CONTAINER
 ComputeType: BUILD_GENERAL1_SMALL
 Image: aws/codebuild/amazonlinux2-x86_64-standard:3.0
 Source:
 Type: CODEPIPELINE
 BuildSpec: |
 version: 0.2
 phases:
 install:
 runtime-versions:
 python: 3.9
 commands:
 - pip install aws-sam-cli
 pre_build:
 commands:
 - echo Build started on `date`
 build:
 commands:
 - sam build
 - sam package --s3-bucket $ARTIFACTS_BUCKET --output-template-file packaged-template.yaml
 post_build:
 commands:
 - echo Build completed on `date`
 artifacts:
 files:
 - packaged-template.yaml

6. Testing SAM Applications

Unit Testing

# tests/unit/test_handler.py
import json
import pytest
from hello_world import app

@pytest.fixture()
def apigw_event():
 """Generates API GW Event"""
 return {
 "body": '{"test": "body"}',
 "resource": "/{proxy+}",
 "httpMethod": "POST",
 "isBase64Encoded": False,
 "queryStringParameters": {"foo": "bar"},
 "pathParameters": {"proxy": "/path/to/resource"},
 "stageVariables": {"baz": "qux"},
 "headers": {
 "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
 "Accept-Encoding": "gzip, deflate, sdch",
 "Accept-Language": "en-US,en;q=0.8",
 "Cache-Control": "max-age=0",
 "CloudFront-Forwarded-Proto": "https",
 "CloudFront-Is-Desktop-Viewer": "true",
 "CloudFront-Is-Mobile-Viewer": "false",
 "CloudFront-Is-SmartTV-Viewer": "false",
 "CloudFront-Is-Tablet-Viewer": "false",
 "CloudFront-Viewer-Country": "US",
 "Host": "1234567890.execute-api.us-east-1.amazonaws.com",
 "Upgrade-Insecure-Requests": "1",
 "User-Agent": "Custom User Agent String",
 "Via": "1.1 08f323deadbeefa7af34d5feb414ce27.cloudfront.net (CloudFront)",
 "X-Amz-Cf-Id": "cDehVQoZnx43VYQb9j2-nvCh-9z396Uhbp027Y2JvkCPNLmGJHqlaA==",
 "X-Forwarded-For": "127.0.0.1, 127.0.0.2",
 "X-Forwarded-Port": "443",
 "X-Forwarded-Proto": "https"
 },
 "requestContext": {
 "accountId": "123456789012",
 "resourceId": "123456",
 "stage": "prod",
 "requestId": "c6af9ac6-7b61-11e6-9a41-93e8deadbeef",
 "requestTime": "09/Apr/2015:12:34:56 +0000",
 "requestTimeEpoch": 1428582896000,
 "identity": {
 "cognitoIdentityPoolId": None,
 "accountId": None,
 "cognitoIdentityId": None,
 "caller": None,
 "accessKey": None,
 "sourceIp": "127.0.0.1",
 "cognitoAuthenticationType": None,
 "cognitoAuthenticationProvider": None,
 "userArn": None,
 "userAgent": "Custom User Agent String",
 "user": None
 },
 "path": "/prod/path/to/resource",
 "resourcePath": "/{proxy+}",
 "httpMethod": "POST",
 "apiId": "1234567890",
 "protocol": "HTTP/1.1"
 }
 }

def test_lambda_handler(apigw_event, mocker):
 ret = app.lambda_handler(apigw_event, "")
 data = json.loads(ret["body"])

 assert ret["statusCode"] == 200
 assert "message" in ret["body"]
 assert data["message"] == "hello world"

Integration Testing

# tests/integration/test_api_gateway.py
import boto3
import pytest
import requests

class TestApiGateway:
 @pytest.fixture(autouse=True)
 def setup(self):
 """Setup test fixtures"""
 self.api_endpoint = self.get_stack_output("HelloWorldApi")
 
 def get_stack_output(self, output_key):
 """Get CloudFormation stack output"""
 cf = boto3.client('cloudformation')
 stacks = cf.describe_stacks(StackName='sam-app')
 outputs = stacks['Stacks'][0]['Outputs']
 
 for output in outputs:
 if output['OutputKey'] == output_key:
 return output['OutputValue']
 
 raise ValueError(f"Output {output_key} not found")
 
 def test_api_gateway_response(self):
 """Test API Gateway endpoint"""
 response = requests.get(self.api_endpoint)
 
 assert response.status_code == 200
 data = response.json()
 assert "message" in data
 assert data["message"] == "hello world"

7. SAM Policy Templates

Built-in Policy Templates

Resources:
 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: function/
 Handler: app.lambda_handler
 Runtime: python3.9
 Policies:
 # Simple policy templates
 - S3ReadPolicy:
 BucketName: !Ref MyBucket
 - DynamoDBCrudPolicy:
 TableName: !Ref MyTable
 - SQSPollerPolicy:
 QueueName: !GetAtt MyQueue.QueueName
 - SNSPublishMessagePolicy:
 TopicName: !GetAtt MyTopic.TopicName
 - VPCAccessPolicy: {}
 - CloudWatchLogsFullAccess
 
 # Custom policy
 - Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - secretsmanager:GetSecretValue
 Resource: !Ref MySecret

Custom Policy Templates

# Create custom policy template
Resources:
 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: function/
 Handler: app.lambda_handler
 Runtime: python3.9
 Policies:
 - Statement:
 - Effect: Allow
 Action:
 - dynamodb:GetItem
 - dynamodb:PutItem
 - dynamodb:UpdateItem
 - dynamodb:DeleteItem
 Resource: 
 - !GetAtt MyTable.Arn
 - !Sub "${MyTable.Arn}/index/*"
 - Effect: Allow
 Action:
 - s3:GetObject
 - s3:PutObject
 Resource: !Sub "${MyBucket}/*"

8. Environment Variables and Secrets

Environment Variables

Globals:
 Function:
 Environment:
 Variables:
 ENVIRONMENT: !Ref Environment
 LOG_LEVEL: INFO
 REGION: !Ref AWS::Region

Resources:
 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: function/
 Handler: app.lambda_handler
 Runtime: python3.9
 Environment:
 Variables:
 TABLE_NAME: !Ref MyTable
 BUCKET_NAME: !Ref MyBucket
 API_ENDPOINT: !Sub "https://${MyApi}.execute-api.${AWS::Region}.amazonaws.com/${Environment}"

Secrets Management

Resources:
 DatabaseSecret:
 Type: AWS::SecretsManager::Secret
 Properties:
 Name: !Sub "${AWS::StackName}-db-secret"
 Description: Database credentials
 GenerateSecretString:
 SecretStringTemplate: '{"username": "admin"}'
 GenerateStringKey: 'password'
 PasswordLength: 32
 ExcludeCharacters: '"@/\'

 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: function/
 Handler: app.lambda_handler
 Runtime: python3.9
 Environment:
 Variables:
 SECRET_ARN: !Ref DatabaseSecret
 Policies:
 - Statement:
 - Effect: Allow
 Action:
 - secretsmanager:GetSecretValue
 Resource: !Ref DatabaseSecret

9. Common Exam Scenarios

Scenario 1: Multi-Stage Deployment

# Different configurations per environment
Parameters:
 Environment:
 Type: String
 Default: dev
 AllowedValues: [dev, staging, prod]

Mappings:
 EnvironmentMap:
 dev:
 InstanceType: t3.micro
 MinCapacity: 1
 MaxCapacity: 2
 staging:
 InstanceType: t3.small
 MinCapacity: 2
 MaxCapacity: 5
 prod:
 InstanceType: t3.medium
 MinCapacity: 5
 MaxCapacity: 20

Resources:
 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: function/
 Handler: app.lambda_handler
 Runtime: python3.9
 ReservedConcurrencyLimit: !FindInMap [EnvironmentMap, !Ref Environment, MaxCapacity]
 Environment:
 Variables:
 ENVIRONMENT: !Ref Environment

Scenario 2: Blue/Green Deployment

Resources:
 MyFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: function/
 Handler: app.lambda_handler
 Runtime: python3.9
 AutoPublishAlias: live
 DeploymentPreference:
 Type: Canary10Percent5Minutes
 Alarms:
 - !Ref AliasErrorMetricGreaterThanZeroAlarm
 - !Ref LatestVersionErrorMetricGreaterThanZeroAlarm
 Hooks:
 PreTraffic: !Ref PreTrafficHook
 PostTraffic: !Ref PostTrafficHook

 AliasErrorMetricGreaterThanZeroAlarm:
 Type: AWS::CloudWatch::Alarm
 Properties:
 AlarmDescription: Lambda function errors
 ComparisonOperator: GreaterThanThreshold
 EvaluationPeriods: 2
 MetricName: Errors
 Namespace: AWS/Lambda
 Period: 60
 Statistic: Sum
 Threshold: 0
 Dimensions:
 - Name: FunctionName
 Value: !Ref MyFunction
 - Name: Resource
 Value: !Sub "${MyFunction}:live"

Scenario 3: Event-Driven Architecture

Resources:
 # S3 trigger
 ProcessingFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: processing/
 Handler: app.lambda_handler
 Runtime: python3.9
 Events:
 S3Event:
 Type: S3
 Properties:
 Bucket: !Ref InputBucket
 Events: s3:ObjectCreated:*
 Filter:
 S3Key:
 Rules:
 - Name: prefix
 Value: input/
 - Name: suffix
 Value: .json

 # DynamoDB trigger
 NotificationFunction:
 Type: AWS::Serverless::Function
 Properties:
 CodeUri: notification/
 Handler: app.lambda_handler
 Runtime: python3.9
 Events:
 DynamoDBEvent:
 Type: DynamoDB
 Properties:
 Stream: !GetAtt ProcessingTable.StreamArn
 StartingPosition: TRIM_HORIZON
 BatchSize: 10
 FilterCriteria:
 Filters:
 - Pattern: '{"eventName": ["INSERT", "MODIFY"]}'

10. Exam Tips

Understand SAM transforms - How SAM templates become CloudFormation
Master local development - SAM CLI commands for testing and debugging
Know event sources - API Gateway, S3, DynamoDB, SQS, SNS integrations
Practice deployment - Guided deployment and CI/CD integration
Understand policy templates - Built-in and custom IAM policies
Learn nested applications - Modular serverless architecture
Know deployment preferences - Blue/green and canary deployments
Practice with layers - Shared code and dependencies
Understand globals - Template-wide configuration
Master troubleshooting - Common SAM CLI and deployment issues

AWS Service Catalog

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. It enables centralized management of commonly deployed IT services and helps achieve consistent governance and compliance requirements.

Key Characteristics

Self-service provisioning - End users can launch pre-approved products
Centralized governance - IT administrators control what can be deployed
Standardized templates - CloudFormation templates as products
Portfolio management - Organize products into portfolios
Access control - IAM-based permissions for portfolios and products
Versioning - Multiple versions of products with upgrade paths
Constraints - Launch, template, and notification constraints
Cost control - Budget and resource constraints

What Problem Does It Solve?

Enables self-service IT provisioning while maintaining governance
Standardizes infrastructure deployments across the organization
Reduces shadow IT by providing approved alternatives
Ensures compliance with organizational policies and standards
Facilitates cost control and resource management
Accelerates time-to-market for development teams

2. Core Components

Products

# CloudFormation template for a Service Catalog product
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Standard Web Server Product'

Parameters:
 InstanceType:
 Type: String
 Default: t3.micro
 AllowedValues: [t3.micro, t3.small, t3.medium]
 Description: EC2 instance type
 
 KeyPairName:
 Type: AWS::EC2::KeyPair::KeyName
 Description: EC2 Key Pair for SSH access
 
 Environment:
 Type: String
 Default: dev
 AllowedValues: [dev, staging, prod]
 Description: Environment name

Mappings:
 EnvironmentMap:
 dev:
 VpcId: vpc-12345678
 SubnetId: subnet-12345678
 staging:
 VpcId: vpc-87654321
 SubnetId: subnet-87654321
 prod:
 VpcId: vpc-11111111
 SubnetId: subnet-11111111

Resources:
 WebServerSecurityGroup:
 Type: AWS::EC2::SecurityGroup
 Properties:
 GroupDescription: Security group for web server
 VpcId: !FindInMap [EnvironmentMap, !Ref Environment, VpcId]
 SecurityGroupIngress:
 - IpProtocol: tcp
 FromPort: 80
 ToPort: 80
 CidrIp: 0.0.0.0/0
 - IpProtocol: tcp
 FromPort: 443
 ToPort: 443
 CidrIp: 0.0.0.0/0
 Tags:
 - Key: Name
 Value: !Sub "${Environment}-web-server-sg"

 WebServerInstance:
 Type: AWS::EC2::Instance
 Properties:
 ImageId: ami-0abcdef1234567890  # Amazon Linux 2
 InstanceType: !Ref InstanceType
 KeyName: !Ref KeyPairName
 SecurityGroupIds:
 - !Ref WebServerSecurityGroup
 SubnetId: !FindInMap [EnvironmentMap, !Ref Environment, SubnetId]
 UserData:
 Fn::Base64: !Sub |
 #!/bin/bash
 yum update -y
 yum install -y httpd
 systemctl start httpd
 systemctl enable httpd
 echo "<h1>Web Server - ${Environment}</h1>" > /var/www/html/index.html
 Tags:
 - Key: Name
 Value: !Sub "${Environment}-web-server"
 - Key: Environment
 Value: !Ref Environment

Outputs:
 InstanceId:
 Description: EC2 Instance ID
 Value: !Ref WebServerInstance
 
 PublicIP:
 Description: Public IP address
 Value: !GetAtt WebServerInstance.PublicIp
 
 WebsiteURL:
 Description: Website URL
 Value: !Sub "http://${WebServerInstance.PublicIp}"

Portfolio Management

# CloudFormation template for Service Catalog setup
Resources:
 # Create portfolio
 WebServicesPortfolio:
 Type: AWS::ServiceCatalog::Portfolio
 Properties:
 DisplayName: Web Services Portfolio
 Description: Standardized web server and database products
 ProviderName: IT Operations Team
 AcceptLanguage: en

 # Create product
 WebServerProduct:
 Type: AWS::ServiceCatalog::CloudFormationProduct
 Properties:
 Name: Standard Web Server
 Description: Pre-configured web server with security groups
 Owner: IT Operations
 AcceptLanguage: en
 ProvisioningArtifactParameters:
 - Name: v1.0
 Description: Initial version
 Info:
 LoadTemplateFromURL: !Sub "https://${TemplateBucket}.s3.amazonaws.com/web-server-template.yaml"

 # Associate product with portfolio
 ProductPortfolioAssociation:
 Type: AWS::ServiceCatalog::PortfolioProductAssociation
 Properties:
 PortfolioId: !Ref WebServicesPortfolio
 ProductId: !Ref WebServerProduct

 # Grant access to portfolio
 PortfolioPrincipalAssociation:
 Type: AWS::ServiceCatalog::PortfolioPrincipalAssociation
 Properties:
 PortfolioId: !Ref WebServicesPortfolio
 PrincipalARN: !Sub "arn:aws:iam::${AWS::AccountId}:role/DeveloperRole"
 PrincipalType: IAM

 # Add launch constraint
 LaunchConstraint:
 Type: AWS::ServiceCatalog::LaunchRoleConstraint
 Properties:
 PortfolioId: !Ref WebServicesPortfolio
 ProductId: !Ref WebServerProduct
 RoleArn: !GetAtt ServiceCatalogLaunchRole.Arn
 AcceptLanguage: en

 # Service Catalog launch role
 ServiceCatalogLaunchRole:
 Type: AWS::IAM::Role
 Properties:
 RoleName: ServiceCatalogLaunchRole
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: servicecatalog.amazonaws.com
 Action: sts:AssumeRole
 ManagedPolicyArns:
 - arn:aws:iam::aws:policy/AmazonEC2FullAccess
 - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
 Policies:
 - PolicyName: ServiceCatalogLaunchPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - cloudformation:CreateStack
 - cloudformation:UpdateStack
 - cloudformation:DeleteStack
 - cloudformation:DescribeStacks
 - cloudformation:DescribeStackEvents
 - cloudformation:DescribeStackResources
 - cloudformation:GetTemplate
 Resource: '*'

3. Constraints

Launch Constraints

# Launch role constraint
Resources:
 LaunchRoleConstraint:
 Type: AWS::ServiceCatalog::LaunchRoleConstraint
 Properties:
 PortfolioId: !Ref Portfolio
 ProductId: !Ref Product
 RoleArn: !GetAtt LaunchRole.Arn
 Description: Role for launching EC2 instances

 LaunchRole:
 Type: AWS::IAM::Role
 Properties:
 AssumeRolePolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Principal:
 Service: servicecatalog.amazonaws.com
 Action: sts:AssumeRole
 Policies:
 - PolicyName: LaunchPolicy
 PolicyDocument:
 Version: '2012-10-17'
 Statement:
 - Effect: Allow
 Action:
 - ec2:*
 - cloudformation:*
 Resource: '*'
 - Effect: Deny
 Action:
 - ec2:TerminateInstances
 Resource: '*'
 Condition:
 StringNotEquals:
 'ec2:ResourceTag/Environment': ['dev', 'test']

Template Constraints

# Template constraint to restrict parameter values
Resources:
 TemplateConstraint:
 Type: AWS::ServiceCatalog::LaunchTemplateConstraint
 Properties:
 PortfolioId: !Ref Portfolio
 ProductId: !Ref Product
 Rules: |
 {
 "Rules": {
 "InstanceTypeRule": {
 "Assertions": [
 {
 "Assert": {
 "Fn::Contains": [
 ["t3.micro", "t3.small", "t3.medium"],
 {"Ref": "InstanceType"}
 ]
 },
 "AssertDescription": "Instance type must be t3.micro, t3.small, or t3.medium"
 }
 ]
 },
 "EnvironmentTagRule": {
 "Assertions": [
 {
 "Assert": {
 "Fn::Not": [
 {"Fn::Equals": [{"Ref": "Environment"}, "prod"]}
 ]
 },
 "AssertDescription": "Production environment not allowed for this product"
 }
 ]
 }
 }
 }

Notification Constraints

# Notification constraint for provisioning events
Resources:
 NotificationConstraint:
 Type: AWS::ServiceCatalog::LaunchNotificationConstraint
 Properties:
 PortfolioId: !Ref Portfolio
 ProductId: !Ref Product
 NotificationArns:
 - !Ref ProvisioningNotificationTopic
 Description: Notify on provisioning events

 ProvisioningNotificationTopic:
 Type: AWS::SNS::Topic
 Properties:
 TopicName: service-catalog-provisioning
 DisplayName: Service Catalog Provisioning Notifications
 Subscription:
 - Protocol: email
 Endpoint: admin@company.com

4. Advanced Features

# Share portfolio across accounts
Resources:
 PortfolioShare:
 Type: AWS::ServiceCatalog::PortfolioShare
 Properties:
 PortfolioId: !Ref Portfolio
 AccountId: "123456789012" # Target account ID
 ShareTagOptions: true

 # Accept shared portfolio (in target account)
 AcceptedPortfolioShare:
 Type: AWS::ServiceCatalog::AcceptedPortfolioShare
 Properties:
 PortfolioId: port-abcdefghijklm  # Shared portfolio ID
 AcceptLanguage: en

TagOptions

# Create tag options for consistent tagging
Resources:
 EnvironmentTagOption:
 Type: AWS::ServiceCatalog::TagOption
 Properties:
 Key: Environment
 Value: dev
 Active: true

 ProjectTagOption:
 Type: AWS::ServiceCatalog::TagOption
 Properties:
 Key: Project
 Value: WebApp
 Active: true

 # Associate tag options with portfolio
 PortfolioTagOptionAssociation:
 Type: AWS::ServiceCatalog::TagOptionAssociation
 Properties:
 ResourceId: !Ref Portfolio
 TagOptionId: !Ref EnvironmentTagOption

 # Associate tag options with product
 ProductTagOptionAssociation:
 Type: AWS::ServiceCatalog::TagOptionAssociation
 Properties:
 ResourceId: !Ref Product
 TagOptionId: !Ref ProjectTagOption

Stack Set Constraints

# Stack set constraint for multi-region deployment
Resources:
 StackSetConstraint:
 Type: AWS::ServiceCatalog::StackSetConstraint
 Properties:
 PortfolioId: !Ref Portfolio
 ProductId: !Ref Product
 Description: Deploy across multiple regions
 AccountList:
 - "123456789012"
 - "210987654321"
 RegionList:
 - us-east-1
 - us-west-2
 - eu-west-1
 AdminRole: !GetAtt StackSetAdminRole.Arn
 ExecutionRole: StackSetExecutionRole

5. Service Catalog with CI/CD

Automated Product Updates

# Lambda function to update Service Catalog products
import boto3
import json

def lambda_handler(event, context):
 """
 Update Service Catalog product when CloudFormation template changes
 """
 
 servicecatalog = boto3.client('servicecatalog')
 s3 = boto3.client('s3')
 
 # Get S3 event details
 bucket = event['Records'][0]['s3']['bucket']['name']
 key = event['Records'][0]['s3']['object']['key']
 
 # Extract product information from S3 key
 # Expected format: products/{product-name}/template.yaml
 if key.startswith('products/') and key.endswith('/template.yaml'):
 product_name = key.split('/')[1]
 
 try:
 # Find the product
 products = servicecatalog.search_products_as_admin(
 Filters={
 'FullTextSearch': [product_name]
 }
 )
 
 if products['ProductViewDetails']:
 product_id = products['ProductViewDetails'][0]['ProductViewSummary']['ProductId']
 
 # Create new provisioning artifact (version)
 template_url = f"https://{bucket}.s3.amazonaws.com/{key}"
 
 response = servicecatalog.create_provisioning_artifact(
 ProductId=product_id,
 Parameters={
 'Name': f"v{int(time.time())}", # Version based on timestamp
 'Description': f"Auto-updated from {key}",
 'Info': {
 'LoadTemplateFromURL': template_url
 },
 'Type': 'CLOUD_FORMATION_TEMPLATE'
 }
 )
 
 print(f"Created new version for product {product_name}: {response['ProvisioningArtifactDetail']['Id']}")
 
 except Exception as e:
 print(f"Error updating product {product_name}: {str(e)}")
 raise
 
 return {
 'statusCode': 200,
 'body': json.dumps('Product update completed')
 }

CodePipeline Integration

# CodePipeline for Service Catalog product deployment
Resources:
 ServiceCatalogPipeline:
 Type: AWS::CodePipeline::Pipeline
 Properties:
 RoleArn: !GetAtt CodePipelineRole.Arn
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactsBucket
 Stages:
 - Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: CodeCommit
 Version: '1'
 Configuration:
 RepositoryName: service-catalog-products
 BranchName: main
 OutputArtifacts:
 - Name: SourceOutput

 - Name: Validate
 Actions:
 - Name: ValidateTemplates
 ActionTypeId:
 Category: Build
 Owner: AWS
 Provider: CodeBuild
 Version: '1'
 Configuration:
 ProjectName: !Ref ValidationProject
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: ValidatedOutput

 - Name: Deploy-Dev
 Actions:
 - Name: UpdateProducts
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: '1'
 Configuration:
 FunctionName: !Ref ProductUpdateFunction
 InputArtifacts:
 - Name: ValidatedOutput

 - Name: Test
 Actions:
 - Name: TestProvisioning
 ActionTypeId:
 Category: Build
 Owner: AWS
 Provider: CodeBuild
 Version: '1'
 Configuration:
 ProjectName: !Ref TestProject
 InputArtifacts:
 - Name: ValidatedOutput

 - Name: Deploy-Prod
 Actions:
 - Name: ApprovalAction
 ActionTypeId:
 Category: Approval
 Owner: AWS
 Provider: Manual
 Version: '1'
 
 - Name: UpdateProdProducts
 ActionTypeId:
 Category: Invoke
 Owner: AWS
 Provider: Lambda
 Version: '1'
 Configuration:
 FunctionName: !Ref ProductUpdateFunction
 UserParameters: '{"environment": "prod"}'
 InputArtifacts:
 - Name: ValidatedOutput
 RunOrder: 2

6. Governance and Compliance

Budget Constraints

# Lambda function for budget constraint enforcement
import boto3
import json

def lambda_handler(event, context):
 """
 Enforce budget constraints for Service Catalog provisioning
 """
 
 # Parse the provisioning request
 request_detail = event['detail']
 product_id = request_detail['productId']
 user_arn = request_detail['userArn']
 
 # Get user's department from IAM tags or external system
 department = get_user_department(user_arn)
 
 # Check department budget
 budgets_client = boto3.client('budgets')
 
 try:
 budget_response = budgets_client.describe_budget(
 AccountId=boto3.Session().get_credentials().access_key[:12],
 BudgetName=f"{department}-monthly-budget"
 )
 
 budget = budget_response['Budget']
 current_spend = float(budget['CalculatedSpend']['ActualSpend']['Amount'])
 budget_limit = float(budget['BudgetLimit']['Amount'])
 
 # Calculate estimated cost for the product
 estimated_cost = get_product_estimated_cost(product_id)
 
 if (current_spend + estimated_cost) > budget_limit:
 # Reject provisioning
 return {
 'status': 'REJECTED',
 'reason': f'Provisioning would exceed department budget. Current: ${current_spend:.2f}, Estimated: ${estimated_cost:.2f}, Limit: ${budget_limit:.2f}'
 }
 
 return {
 'status': 'APPROVED',
 'estimated_cost': estimated_cost
 }
 
 except Exception as e:
 # Default to approval if budget check fails
 return {
 'status': 'APPROVED',
 'note': f'Budget check failed: {str(e)}'
 }

def get_user_department(user_arn):
 """Extract department from user ARN or tags"""
 iam = boto3.client('iam')
 
 username = user_arn.split('/')[-1]
 
 try:
 user_tags = iam.list_user_tags(UserName=username)
 for tag in user_tags['Tags']:
 if tag['Key'] == 'Department':
 return tag['Value']
 except:
 pass
 
 return 'default'

def get_product_estimated_cost(product_id):
 """Get estimated monthly cost for a product"""
 
 # This would typically integrate with AWS Pricing API
 # or maintain a cost database
 cost_estimates = {
 'prod-web-server': 50.0,
 'prod-database': 100.0,
 'prod-load-balancer': 25.0
 }
 
 return cost_estimates.get(product_id, 0.0)

Compliance Monitoring

# Lambda function for compliance monitoring
import boto3
import json
from datetime import datetime, timedelta

def lambda_handler(event, context):
 """
 Monitor Service Catalog provisioned products for compliance
 """
 
 servicecatalog = boto3.client('servicecatalog')
 config_client = boto3.client('config')
 
 # Get all provisioned products
 provisioned_products = servicecatalog.search_provisioned_products()
 
 compliance_report = {
 'timestamp': datetime.utcnow().isoformat(),
 'total_products': len(provisioned_products['ProvisionedProducts']),
 'compliant': 0,
 'non_compliant': 0,
 'violations': []
 }
 
 for product in provisioned_products['ProvisionedProducts']:
 product_id = product['Id']
 product_name = product['Name']
 
 # Get provisioned product details
 details = servicecatalog.describe_provisioned_product(Id=product_id)
 
 # Check compliance rules
 violations = check_product_compliance(details, config_client)
 
 if violations:
 compliance_report['non_compliant'] += 1
 compliance_report['violations'].extend(violations)
 else:
 compliance_report['compliant'] += 1
 
 # Send compliance report
 sns = boto3.client('sns')
 sns.publish(
 TopicArn='arn:aws:sns:us-east-1:123456789012:service-catalog-compliance',
 Message=json.dumps(compliance_report, indent=2),
 Subject='Service Catalog Compliance Report'
 )
 
 return compliance_report

def check_product_compliance(product_details, config_client):
 """Check compliance rules for a provisioned product"""
 
 violations = []
 
 # Get CloudFormation stack resources
 stack_id = product_details['ProvisionedProductDetail']['CloudformationStackArn']
 
 try:
 cf_client = boto3.client('cloudformation')
 resources = cf_client.describe_stack_resources(StackName=stack_id)
 
 for resource in resources['StackResources']:
 resource_type = resource['ResourceType']
 resource_id = resource['PhysicalResourceId']
 
 # Check Config compliance for each resource
 if resource_type in ['AWS::EC2::Instance', 'AWS::S3::Bucket', 'AWS::RDS::DBInstance']:
 compliance = config_client.get_compliance_details_by_resource(
 ResourceType=resource_type,
 ResourceId=resource_id
 )
 
 for evaluation in compliance['EvaluationResults']:
 if evaluation['ComplianceType'] == 'NON_COMPLIANT':
 violations.append({
 'resource_type': resource_type,
 'resource_id': resource_id,
 'rule': evaluation['ConfigRuleName'],
 'annotation': evaluation.get('Annotation', '')
 })
 
 except Exception as e:
 print(f"Error checking compliance: {str(e)}")
 
 return violations

7. API and CLI Operations

Common CLI Commands

# List portfolios
aws servicecatalog list-portfolios

# Describe portfolio
aws servicecatalog describe-portfolio --id port-abcdefghijklm

# Search products
aws servicecatalog search-products --filters FullTextSearch=web

# Describe product
aws servicecatalog describe-product --id prod-abcdefghijklm

# Provision product
aws servicecatalog provision-product \
 --product-id prod-abcdefghijklm \
 --provisioning-artifact-id pa-abcdefghijklm \
 --provisioned-product-name my-web-server \
 --provisioning-parameters Key=InstanceType,Value=t3.small

# List provisioned products
aws servicecatalog search-provisioned-products

# Update provisioned product
aws servicecatalog update-provisioned-product \
 --provisioned-product-id pp-abcdefghijklm \
 --provisioning-artifact-id pa-newversion

# Terminate provisioned product
aws servicecatalog terminate-provisioned-product \
 --provisioned-product-id pp-abcdefghijklm

# Create product
aws servicecatalog create-product \
 --name "Database Server" \
 --owner "IT Team" \
 --description "Standard database server" \
 --provisioning-artifact-parameters Name=v1.0,Info='{LoadTemplateFromURL=https://bucket.s3.amazonaws.com/template.yaml}'

# Associate product with portfolio
aws servicecatalog associate-product-with-portfolio \
 --product-id prod-abcdefghijklm \
 --portfolio-id port-abcdefghijklm

Programmatic Access

import boto3

class ServiceCatalogManager:
 def __init__(self):
 self.client = boto3.client('servicecatalog')
 
 def provision_product_for_user(self, product_name, user_id, parameters):
 """Provision a product for a specific user"""
 
 # Search for product
 products = self.client.search_products(
 Filters={'FullTextSearch': [product_name]}
 )
 
 if not products['ProductViewSummaries']:
 raise ValueError(f"Product {product_name} not found")
 
 product = products['ProductViewSummaries'][0]
 product_id = product['ProductId']
 
 # Get latest provisioning artifact
 artifacts = self.client.describe_product(Id=product_id)
 latest_artifact = artifacts['ProvisioningArtifacts'][-1]
 
 # Provision product
 response = self.client.provision_product(
 ProductId=product_id,
 ProvisioningArtifactId=latest_artifact['Id'],
 ProvisionedProductName=f"{product_name}-{user_id}",
 ProvisioningParameters=[
 {'Key': k, 'Value': v} for k, v in parameters.items()
 ],
 Tags=[
 {'Key': 'Owner', 'Value': user_id},
 {'Key': 'ProvisionedBy', 'Value': 'ServiceCatalogManager'}
 ]
 )
 
 return response['RecordDetail']
 
 def get_user_products(self, user_id):
 """Get all products provisioned by a user"""
 
 provisioned_products = self.client.search_provisioned_products(
 Filters={
 'SearchQuery': [f'owner:{user_id}']
 }
 )
 
 return provisioned_products['ProvisionedProducts']
 
 def update_product_template(self, product_id, template_url, version_name):
 """Update product with new template version"""
 
 response = self.client.create_provisioning_artifact(
 ProductId=product_id,
 Parameters={
 'Name': version_name,
 'Description': f'Updated template version {version_name}',
 'Info': {'LoadTemplateFromURL': template_url},
 'Type': 'CLOUD_FORMATION_TEMPLATE'
 }
 )
 
 return response['ProvisioningArtifactDetail']
 
 def enforce_tagging_policy(self, portfolio_id, required_tags):
 """Enforce tagging policy for a portfolio"""
 
 # Get all products in portfolio
 products = self.client.search_products_as_admin(
 PortfolioId=portfolio_id
 )
 
 for product in products['ProductViewDetails']:
 product_id = product['ProductViewSummary']['ProductId']
 
 # Add tag options for required tags
 for tag_key in required_tags:
 try:
 # Create tag option if it doesn't exist
 tag_option = self.client.create_tag_option(
 Key=tag_key,
 Value='*' # Wildcard to allow any value
 )
 
 # Associate with product
 self.client.associate_tag_option_with_resource(
 ResourceId=product_id,
 TagOptionId=tag_option['TagOptionDetail']['Id']
 )
 except self.client.exceptions.DuplicateResourceException:
 pass # Tag option already exists

8. Common Exam Scenarios

Scenario 1: Self-Service Infrastructure

# Complete self-service infrastructure setup
Resources:
 # Developer Portfolio
 DeveloperPortfolio:
 Type: AWS::ServiceCatalog::Portfolio
 Properties:
 DisplayName: Developer Self-Service
 Description: Pre-approved infrastructure for development teams
 ProviderName: Platform Engineering

 # Web Application Product
 WebAppProduct:
 Type: AWS::ServiceCatalog::CloudFormationProduct
 Properties:
 Name: Web Application Stack
 Description: Complete web application with database
 Owner: Platform Engineering
 ProvisioningArtifactParameters:
 - Name: v1.0
 Description: Initial version with basic web app
 Info:
 LoadTemplateFromURL: !Sub "https://${TemplateBucket}.s3.amazonaws.com/web-app-stack.yaml"

 # Database Product
 DatabaseProduct:
 Type: AWS::ServiceCatalog::CloudFormationProduct
 Properties:
 Name: RDS Database
 Description: Managed database instance
 Owner: Platform Engineering
 ProvisioningArtifactParameters:
 - Name: v1.0
 Description: MySQL database with backup
 Info:
 LoadTemplateFromURL: !Sub "https://${TemplateBucket}.s3.amazonaws.com/rds-database.yaml"

 # Associate products with portfolio
 WebAppAssociation:
 Type: AWS::ServiceCatalog::PortfolioProductAssociation
 Properties:
 PortfolioId: !Ref DeveloperPortfolio
 ProductId: !Ref WebAppProduct

 DatabaseAssociation:
 Type: AWS::ServiceCatalog::PortfolioProductAssociation
 Properties:
 PortfolioId: !Ref DeveloperPortfolio
 ProductId: !Ref DatabaseProduct

 # Grant access to developer role
 DeveloperAccess:
 Type: AWS::ServiceCatalog::PortfolioPrincipalAssociation
 Properties:
 PortfolioId: !Ref DeveloperPortfolio
 PrincipalARN: !Sub "arn:aws:iam::${AWS::AccountId}:role/DeveloperRole"
 PrincipalType: IAM

 # Launch constraints
 WebAppLaunchConstraint:
 Type: AWS::ServiceCatalog::LaunchRoleConstraint
 Properties:
 PortfolioId: !Ref DeveloperPortfolio
 ProductId: !Ref WebAppProduct
 RoleArn: !GetAtt ServiceCatalogLaunchRole.Arn

 # Template constraints for cost control
 WebAppTemplateConstraint:
 Type: AWS::ServiceCatalog::LaunchTemplateConstraint
 Properties:
 PortfolioId: !Ref DeveloperPortfolio
 ProductId: !Ref WebAppProduct
 Rules: |
 {
 "Rules": {
 "InstanceSizeRule": {
 "Assertions": [
 {
 "Assert": {
 "Fn::Contains": [
 ["t3.micro", "t3.small"],
 {"Ref": "InstanceType"}
 ]
 },
 "AssertDescription": "Only t3.micro and t3.small allowed for development"
 }
 ]
 }
 }
 }

Scenario 2: Multi-Environment Deployment

# Automated multi-environment deployment
import boto3
import json

class MultiEnvironmentDeployer:
 def __init__(self):
 self.servicecatalog = boto3.client('servicecatalog')
 self.organizations = boto3.client('organizations')
 
 def deploy_to_environments(self, product_template, environments):
 """Deploy product to multiple environments"""
 
 deployment_results = {}
 
 for env_name, env_config in environments.items():
 try:
 # Create environment-specific product
 product_name = f"{env_config['product_base_name']}-{env_name}"
 
 # Customize template for environment
 customized_template = self.customize_template_for_environment(
 product_template, env_config
 )
 
 # Upload template to S3
 template_url = self.upload_template_to_s3(
 customized_template, product_name
 )
 
 # Create or update product
 product_id = self.create_or_update_product(
 product_name, template_url, env_config
 )
 
 # Share with target accounts if needed
 if env_config.get('target_accounts'):
 self.share_product_with_accounts(
 product_id, env_config['target_accounts']
 )
 
 deployment_results[env_name] = {
 'status': 'SUCCESS',
 'product_id': product_id,
 'template_url': template_url
 }
 
 except Exception as e:
 deployment_results[env_name] = {
 'status': 'FAILED',
 'error': str(e)
 }
 
 return deployment_results
 
 def customize_template_for_environment(self, template, env_config):
 """Customize CloudFormation template for specific environment"""
 
 # Parse template
 template_dict = json.loads(template) if isinstance(template, str) else template
 
 # Update parameters with environment-specific defaults
 if 'Parameters' in template_dict:
 for param_name, param_config in template_dict['Parameters'].items():
 if param_name in env_config.get('parameter_defaults', {}):
 param_config['Default'] = env_config['parameter_defaults'][param_name]
 
 # Update mappings for environment-specific values
 if 'Mappings' in template_dict and 'EnvironmentMap' in template_dict['Mappings']:
 template_dict['Mappings']['EnvironmentMap'][env_config['name']] = env_config.get('mappings', {})
 
 return json.dumps(template_dict, indent=2)

# Example usage
environments = {
 'dev': {
 'product_base_name': 'WebApp',
 'name': 'dev',
 'parameter_defaults': {
 'InstanceType': 't3.micro',
 'MinSize': '1',
 'MaxSize': '2'
 },
 'mappings': {
 'VpcId': 'vpc-dev123',
 'SubnetIds': ['subnet-dev1', 'subnet-dev2']
 }
 },
 'prod': {
 'product_base_name': 'WebApp',
 'name': 'prod',
 'parameter_defaults': {
 'InstanceType': 't3.large',
 'MinSize': '3',
 'MaxSize': '10'
 },
 'mappings': {
 'VpcId': 'vpc-prod123',
 'SubnetIds': ['subnet-prod1', 'subnet-prod2']
 },
 'target_accounts': ['123456789012', '210987654321']
 }
}

9. Exam Tips

Understand portfolio structure - Portfolios, products, provisioning artifacts
Master constraints - Launch, template, notification, and stack set constraints
Know access control - IAM integration and principal associations
Practice multi-account - Portfolio sharing and cross-account access
Learn automation - CI/CD integration and automated product updates
Understand governance - Budget constraints, compliance monitoring, tagging
Know API operations - Key CLI commands and programmatic access
Practice troubleshooting - Common provisioning and constraint issues
Understand costs - Service Catalog pricing and cost optimization
Master integration - CloudFormation, Organizations, Config integration

CDK Pipelines

Sun, 04 Oct 2026 00:00:00 +0000

CDK-General.md covers CDK fundamentals. This file focuses specifically on CDK Pipelines — the self-mutating pipeline construct — which is a distinct exam topic.

1. Overview

What it is: A high-level construct (aws-cdk-lib/pipelines) that builds a CodePipeline pipeline from your CDK app definition. The defining feature: the pipeline updates itself before deploying your application — if you change the pipeline structure in code, the next run applies those changes automatically.

What problem it solves: Manually keeping a CodePipeline in sync with your CDK app is error-prone. CDK Pipelines makes the pipeline itself part of the CDK app — infrastructure and pipeline are versioned together.

CloudFormation Guard and Hooks

Sun, 04 Oct 2026 00:00:00 +0000

What it is: An open-source policy-as-code engine. You write rules; Guard validates any JSON/YAML structured data against them — CloudFormation templates, change sets, Terraform JSON, Kubernetes manifests. It is the shift-left compliance tool: catch violations before anything deploys.

Exam-testable facts:

Three governance uses: preventative (validate IaC/templates pre-deploy — shift-left), detective (validate AWS Config configuration items continuously), deployment safety (validate change sets to catch replacement-causing edits, e.g., renaming a DynamoDB table).
Rule syntax (Guard 2.x): rule <name> [when <condition>] { <assertion> }.
Guard vs Hooks: Guard is the rule language; CloudFormation Hooks are the enforcement point — Hooks proactively run your Guard rules before create/update/delete operations (and Cloud Control API calls). Know which is which.
In CI/CD: run cfn-guard validate as a CodeBuild step — a policy violation fails the build, blocking the deploy.
Config custom rules can be authored in Guard (CUSTOM_POLICY type); conformance packs can bundle Guard-based rules for org-wide rollout.

Common traps:

SystemsManager-SSM — General Notes (DOP-C02)

Sun, 04 Oct 2026 00:00:00 +0000

What it is: The fleet-operations toolkit. The exam’s favorite question shape is “which SSM capability solves this scenario” — learn the one-line job of each.

Exam-testable facts:

Run Command: execute scripts/commands across many managed instances at once, no SSH. Rate controls and error thresholds for rolling execution.
Session Manager: interactive shell in browser/CLI with no inbound ports, no bastion, no SSH keys. Sessions can be logged to S3/CloudWatch for audit.
Patch Manager: automated OS patching via patch baselines (what’s approved) and patch groups (which instances); scan (report only) vs install; scheduled through Maintenance Windows.
Maintenance Windows: cron-like schedules defining when admin tasks run, with duration, cutoff (“stop initiating N hours before close”), and registered task types (Run Command, Automation, Lambda, Step Functions).
State Manager: associations that enforce desired state (e.g., “this config file must exist”) and remediate drift on a schedule.
Automation: multi-step runbooks (AWS-managed or custom documents) — the engine behind golden-AMI builds and incident runbooks.
Inventory: collects OS, application, and config metadata from managed instances for asset/compliance queries.
Fleet Manager / Explorer / OpsCenter: console views; OpsCenter centralizes operational issues as OpsItems with deduplication and ownership.
Hybrid: on-prem servers become managed instances via activation codes — then all of the above works on them.

Common traps:

SystemsManager-SSM Deep Dive — RunCommand

Sun, 04 Oct 2026 00:00:00 +0000

What it is: Run Command lets you execute scripts or commands across many managed instances at once — no SSH, no bastion hosts. You pick targets (by tags, instance IDs, or resource groups), pick a document (e.g. AWS-RunShellScript), and it runs everywhere in parallel.

Exam-testable facts:

No inbound ports needed. The SSM Agent on each instance polls Systems Manager outbound (HTTPS). This is the exam’s favorite contrast with SSH: “run commands on 500 instances without opening port 22” → Run Command.
Rate controls: set how many targets run concurrently (MaxConcurrency: count or percentage) and how many errors you tolerate before stopping (MaxErrors). Rolling execution across a fleet uses these two knobs.
Targets: instance IDs, tags (tag:Environment=prod), or resource groups. Tag-based targeting is how you hit “all web servers” without listing them.
Command documents: AWS-RunShellScript (Linux), AWS-RunPowerShellScript (Windows), plus AWS-managed documents for common tasks. Custom documents package your own scripts.
Output: command output is captured per instance and can be written to S3 or CloudWatch Logs; each invocation gets a Command ID you can query with list-command-invocations.
Notifications: SNS notifications on command state changes (InProgress, Success, Failed, TimedOut).
Prerequisite: instances must be managed instances — SSM Agent installed + an IAM instance profile with the AmazonSSMManagedInstanceCore policy.

Common traps:

SystemsManager-SSM Deep Dive — StateManager

Sun, 04 Oct 2026 00:00:00 +0000

What it is: State Manager enforces desired state on your fleet on a schedule. You define an association — a document + targets + schedule — and State Manager continuously makes reality match: e.g. “this config file must exist on all web servers,” “the CloudWatch agent must be installed everywhere.”

Exam-testable facts:

Association = the unit of work: document (what to enforce), targets (where), schedule (how often to check), parameters.
Drift correction: when an association run finds a target out of compliance, State Manager re-applies the document to bring it back — the self-healing loop for configuration.
One-time vs recurring: associations can run once immediately or on a cron/rate schedule. Compliance reporting works either way.
S3 compliance reporting: association execution results can be written to S3 for audit trails.
Common documents: AWS-RunShellScript, AWS-ConfigureAWSPackage (install/update packages like the CloudWatch agent), AWS-ApplyAnsiblePlaybooks.
Rate controls (same as Run Command): MaxConcurrency and MaxErrors govern how associations roll across large fleets.

Common traps:

Terraform

Sun, 04 Oct 2026 00:00:00 +0000

1. Overview

Terraform is an open-source Infrastructure as Code (IaC) tool that enables you to define and provision infrastructure using a declarative configuration language. It supports multiple cloud providers including AWS, Azure, and GCP.

Key Characteristics

Declarative syntax - Define desired state, not steps
Multi-cloud support - Single tool for multiple providers
State management - Tracks infrastructure state
Plan and apply - Preview changes before execution
Resource graph - Understands dependencies
Modular - Reusable modules and configurations
Version control - Infrastructure as code in Git

What Problem Does It Solve?

Eliminates manual infrastructure provisioning
Provides consistent, repeatable deployments
Enables infrastructure version control and collaboration
Supports multi-cloud and hybrid environments
Facilitates infrastructure testing and validation
Enables infrastructure automation and CI/CD integration

2. Core Concepts

Providers

# AWS Provider configuration
terraform {
 required_providers {
 aws = {
 source = "hashicorp/aws"
 version = "~> 5.0"
 }
 }
 required_version = ">= 1.0"
}

provider "aws" {
 region = var.aws_region
 
 default_tags {
 tags = {
 Environment = var.environment
 Project = var.project_name
 ManagedBy = "Terraform"
 }
 }
}

Resources

# EC2 Instance resource
resource "aws_instance" "web_server" {
 ami = data.aws_ami.amazon_linux.id
 instance_type = var.instance_type
 key_name = aws_key_pair.deployer.key_name
 
 vpc_security_group_ids = [aws_security_group.web.id]
 subnet_id = aws_subnet.public[0].id
 
 user_data = templatefile("${path.module}/user_data.sh", {
 db_endpoint = aws_db_instance.main.endpoint
 })
 
 tags = {
 Name = "${var.project_name}-web-server"
 }
}

# S3 Bucket resource
resource "aws_s3_bucket" "app_data" {
 bucket = "${var.project_name}-app-data-${random_id.bucket_suffix.hex}"
}

resource "aws_s3_bucket_versioning" "app_data" {
 bucket = aws_s3_bucket.app_data.id
 versioning_configuration {
 status = "Enabled"
 }
}

Variables

# variables.tf
variable "aws_region" {
 description = "AWS region for resources"
 type = string
 default = "us-east-1"
}

variable "environment" {
 description = "Environment name"
 type = string
 validation {
 condition = contains(["dev", "staging", "prod"], var.environment)
 error_message = "Environment must be dev, staging, or prod."
 }
}

variable "instance_config" {
 description = "EC2 instance configuration"
 type = object({
 type = string
 count = number
 })
 default = {
 type = "t3.micro"
 count = 1
 }
}

Outputs

# outputs.tf
output "web_server_public_ip" {
 description = "Public IP of web server"
 value = aws_instance.web_server.public_ip
}

output "database_endpoint" {
 description = "RDS instance endpoint"
 value = aws_db_instance.main.endpoint
 sensitive = true
}

output "s3_bucket_name" {
 description = "Name of S3 bucket"
 value = aws_s3_bucket.app_data.bucket
}

3. State Management

Remote State Configuration

# Backend configuration
terraform {
 backend "s3" {
 bucket = "my-terraform-state-bucket"
 key = "environments/prod/terraform.tfstate"
 region = "us-east-1"
 encrypt = true
 dynamodb_table = "terraform-state-locks"
 }
}

State Locking with DynamoDB

# DynamoDB table for state locking
resource "aws_dynamodb_table" "terraform_locks" {
 name = "terraform-state-locks"
 billing_mode = "PAY_PER_REQUEST"
 hash_key = "LockID"

 attribute {
 name = "LockID"
 type = "S"
 }

 tags = {
 Name = "Terraform State Lock Table"
 }
}

State Commands

# Initialize backend
terraform init

# Show current state
terraform show

# List resources in state
terraform state list

# Import existing resource
terraform import aws_instance.example i-1234567890abcdef0

# Remove resource from state
terraform state rm aws_instance.example

# Move resource in state
terraform state mv aws_instance.old aws_instance.new

4. Modules

Module Structure

modules/
├── vpc/
│ ├── main.tf
│ ├── variables.tf
│ ├── outputs.tf
│ └── README.md
├── ec2/
│ ├── main.tf
│ ├── variables.tf
│ └── outputs.tf
└── rds/
 ├── main.tf
 ├── variables.tf
 └── outputs.tf

VPC Module Example

# modules/vpc/main.tf
resource "aws_vpc" "main" {
 cidr_block = var.vpc_cidr
 enable_dns_hostnames = true
 enable_dns_support = true
 
 tags = merge(var.tags, {
 Name = "${var.name}-vpc"
 })
}

resource "aws_subnet" "public" {
 count = length(var.public_subnet_cidrs)
 
 vpc_id = aws_vpc.main.id
 cidr_block = var.public_subnet_cidrs[count.index]
 availability_zone = data.aws_availability_zones.available.names[count.index]
 map_public_ip_on_launch = true
 
 tags = merge(var.tags, {
 Name = "${var.name}-public-${count.index + 1}"
 Type = "Public"
 })
}

# modules/vpc/variables.tf
variable "name" {
 description = "Name prefix for resources"
 type = string
}

variable "vpc_cidr" {
 description = "CIDR block for VPC"
 type = string
 default = "10.0.0.0/16"
}

variable "public_subnet_cidrs" {
 description = "CIDR blocks for public subnets"
 type = list(string)
 default = ["10.0.1.0/24", "10.0.2.0/24"]
}

Using Modules

# main.tf
module "vpc" {
 source = "./modules/vpc"
 
 name = var.project_name
 vpc_cidr = "10.0.0.0/16"
 public_subnet_cidrs = ["10.0.1.0/24", "10.0.2.0/24"]
 
 tags = local.common_tags
}

module "web_servers" {
 source = "./modules/ec2"
 
 name = "${var.project_name}-web"
 instance_count = var.web_server_count
 subnet_ids = module.vpc.public_subnet_ids
 
 tags = local.common_tags
}

5. Terraform with AWS CI/CD

CodeBuild Integration

# buildspec.yml
version: 0.2

phases:
 install:
 runtime-versions:
 python: 3.9
 commands:
 - wget https://releases.hashicorp.com/terraform/1.5.0/terraform_1.5.0_linux_amd64.zip
 - unzip terraform_1.5.0_linux_amd64.zip
 - mv terraform /usr/local/bin/
 - terraform --version
 
 pre_build:
 commands:
 - echo Logging in to Amazon ECR...
 - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com
 - terraform init
 
 build:
 commands:
 - echo Build started on `date`
 - terraform plan -out=tfplan
 - terraform apply tfplan
 
 post_build:
 commands:
 - echo Build completed on `date`

artifacts:
 files:
 - '**/*'

CodePipeline with Terraform

Resources:
 TerraformPipeline:
 Type: AWS::CodePipeline::Pipeline
 Properties:
 RoleArn: !GetAtt CodePipelineRole.Arn
 ArtifactStore:
 Type: S3
 Location: !Ref ArtifactsBucket
 Stages:
 - Name: Source
 Actions:
 - Name: SourceAction
 ActionTypeId:
 Category: Source
 Owner: AWS
 Provider: S3
 Version: '1'
 Configuration:
 S3Bucket: !Ref SourceBucket
 S3ObjectKey: terraform-source.zip
 OutputArtifacts:
 - Name: SourceOutput
 
 - Name: Plan
 Actions:
 - Name: TerraformPlan
 ActionTypeId:
 Category: Build
 Owner: AWS
 Provider: CodeBuild
 Version: '1'
 Configuration:
 ProjectName: !Ref TerraformPlanProject
 InputArtifacts:
 - Name: SourceOutput
 OutputArtifacts:
 - Name: PlanOutput
 
 - Name: Approval
 Actions:
 - Name: ManualApproval
 ActionTypeId:
 Category: Approval
 Owner: AWS
 Provider: Manual
 Version: '1'
 Configuration:
 CustomData: 'Please review the Terraform plan before applying'
 
 - Name: Apply
 Actions:
 - Name: TerraformApply
 ActionTypeId:
 Category: Build
 Owner: AWS
 Provider: CodeBuild
 Version: '1'
 Configuration:
 ProjectName: !Ref TerraformApplyProject
 InputArtifacts:
 - Name: PlanOutput

6. Best Practices

Code Organization

# Use consistent naming
resource "aws_instance" "web_server" {
 # Use descriptive names
 tags = {
 Name = "${var.environment}-${var.application}-web-server"
 }
}

# Use locals for computed values
locals {
 common_tags = {
 Environment = var.environment
 Project = var.project_name
 ManagedBy = "Terraform"
 CreatedAt = timestamp()
 }
 
 vpc_cidr_blocks = {
 dev = "10.0.0.0/16"
 staging = "10.1.0.0/16"
 prod = "10.2.0.0/16"
 }
}

Security Best Practices

# Use data sources for sensitive information
data "aws_secretsmanager_secret_version" "db_password" {
 secret_id = "prod/myapp/db-password"
}

# Encrypt sensitive outputs
output "database_password" {
 value = data.aws_secretsmanager_secret_version.db_password.secret_string
 sensitive = true
}

# Use least privilege IAM policies
resource "aws_iam_policy" "app_policy" {
 name = "${var.project_name}-app-policy"
 
 policy = jsonencode({
 Version = "2012-10-17"
 Statement = [
 {
 Effect = "Allow"
 Action = [
 "s3:GetObject",
 "s3:PutObject"
 ]
 Resource = "${aws_s3_bucket.app_data.arn}/*"
 }
 ]
 })
}

7. Terraform vs CloudFormation

Feature	Terraform	CloudFormation
Language	HCL (HashiCorp Configuration Language)	JSON/YAML
Multi-cloud	Yes (AWS, Azure, GCP, etc.)	AWS only
State Management	External state file	AWS managed
Plan/Preview	terraform plan	Change sets
Modularity	Modules	Nested stacks
Community	Large ecosystem	AWS native
Learning Curve	Moderate	Steep
Rollback	Manual	Automatic

8. Common Exam Scenarios

Scenario 1: Multi-Environment Infrastructure

# terraform.tfvars.dev
environment = "dev"
instance_type = "t3.micro"
min_size = 1
max_size = 2

# terraform.tfvars.prod
environment = "prod"
instance_type = "t3.large"
min_size = 2
max_size = 10

# Deploy to different environments
terraform apply -var-file="terraform.tfvars.dev"
terraform apply -var-file="terraform.tfvars.prod"

Scenario 2: Blue/Green Deployment

variable "active_environment" {
 description = "Currently active environment (blue or green)"
 type = string
 default = "blue"
}

resource "aws_lb_target_group" "blue" {
 name = "${var.project_name}-blue-tg"
 port = 80
 protocol = "HTTP"
 vpc_id = module.vpc.vpc_id
}

resource "aws_lb_target_group" "green" {
 name = "${var.project_name}-green-tg"
 port = 80
 protocol = "HTTP"
 vpc_id = module.vpc.vpc_id
}

resource "aws_lb_listener" "main" {
 load_balancer_arn = aws_lb.main.arn
 port = "80"
 protocol = "HTTP"

 default_action {
 type = "forward"
 target_group_arn = var.active_environment == "blue" ? aws_lb_target_group.blue.arn : aws_lb_target_group.green.arn
 }
}

Scenario 3: Disaster Recovery

# Multi-region setup
provider "aws" {
 alias = "primary"
 region = "us-east-1"
}

provider "aws" {
 alias = "dr"
 region = "us-west-2"
}

module "primary_infrastructure" {
 source = "./modules/infrastructure"
 
 providers = {
 aws = aws.primary
 }
 
 environment = "prod-primary"
 region = "us-east-1"
}

module "dr_infrastructure" {
 source = "./modules/infrastructure"
 
 providers = {
 aws = aws.dr
 }
 
 environment = "prod-dr"
 region = "us-west-2"
}

9. CLI Commands

# Initialize Terraform
terraform init
terraform init -upgrade # Upgrade providers

# Plan changes
terraform plan
terraform plan -out=tfplan
terraform plan -var-file="prod.tfvars"

# Apply changes
terraform apply
terraform apply tfplan
terraform apply -auto-approve

# Destroy infrastructure
terraform destroy
terraform destroy -target=aws_instance.example

# Validate configuration
terraform validate
terraform fmt

# Workspace management
terraform workspace list
terraform workspace new prod
terraform workspace select prod

# State management
terraform state list
terraform state show aws_instance.example
terraform refresh

10. Exam Tips

Understand state management - Know how Terraform tracks resources
Master modules - Reusability and organization are key
Know provider configuration - Multi-cloud scenarios are common
Understand workspaces - Environment separation strategies
Practice with AWS resources - Focus on EC2, VPC, S3, RDS, IAM
Learn troubleshooting - State corruption, import scenarios
Understand CI/CD integration - CodePipeline and CodeBuild usage
Know security best practices - State encryption, sensitive data handling
Compare with CloudFormation - Understand when to use each tool
Practice disaster recovery - Multi-region deployments and backup strategies

Terraform Deep Dive — Workspaces

Sun, 04 Oct 2026 00:00:00 +0000

What it is: Workspaces let you manage multiple instances of the same Terraform configuration — typically one per environment (dev/stage/prod) — each with its own separate state file, without duplicating code.

Exam-testable facts:

One config, many states: terraform workspace new prod creates a workspace; terraform workspace select dev switches. Each workspace keeps an independent state, so prod and dev never clobber each other’s resources.
State separation: with local state, each workspace gets its own terraform.tfstate.d/<name>/ file; with remote backends (S3), each workspace gets its own state object/key prefix.
${terraform.workspace} interpolation: reference the current workspace name inside configuration — e.g. name = "app-${terraform.workspace}" or count = terraform.workspace == "prod" ? 3 : 1. This is how one codebase behaves differently per environment.
tfvars per workspace: pair workspaces with per-environment variable files (terraform apply -var-file=prod.tfvars) — workspaces separate state, tfvars separate inputs. The exam likes asking which does which.
Not for strong isolation: workspaces share the same backend credentials and provider configuration. For real blast-radius separation (separate AWS accounts per environment), use separate configurations/backends, not workspaces.

Common traps: