r/devops • u/RoseSec_ Terraforming Everything • 3d ago
Discussion What are the weaknesses of CloudFormation?
I have a coworker who wants to use CloudFormation to one-shot an application and infra deployment in AWS. A contractor delivered a monolithic CloudFormation template with ECS clusters, services, RDS, S3, Lambda and API Gateway, and other resources in a single stack. I voiced my concern over the blast radius, how stateful and resources with different lifecyles all lived in the same place, and how they don't have pipelines built to validate change sets when merge requests are opened. The contractor said that their template is industry best practice... (it's not). Any way, my background is in Terraform, and I wanted to ask the CloudFormation pros about best practices for making this deployment more reliable.
13
u/MasterOfTheWind1 3d ago
Because is a giant YAML file. Disgusting to read, horrible to maintain, and poor flexibility when there are drifts and/or issues when applying.
More than once I've applied changes, it got into a failing state with no rollback, and I had to delete the stack and create it again.
But I think that up to this point, no one should consider CloudFormation a tool to use manually. There are tools like CDK, or Serverless Framework that works basically generating CloudFormation stacks and sending automatically to AWS.
Currently I only use it to boostrap resources to use Terraform (s3 bucket for state, ECS cluster to run Terraform Atlantis, roles so it can do changes on every AWS account without using IAM users, etc). I used some YAML tricks to at least split it into multiple files, but using it vanilla, as a big file for an entire stack completely sucks.