Mastering Reusable Infrastructure: AWS CloudFormation Nested Stacks

In this lab, you will learn how to implement Task Statement 2.1 of the AWS DevOps Engineer Professional exam: defining cloud infrastructure using reusable components. You will build a parent-child stack architecture that allows for modular infrastructure management.

[!WARNING] This lab involves provisioning real AWS resources. Remember to run the teardown commands at the end to avoid ongoing charges.

Prerequisites

An active AWS Account.
AWS CLI installed and configured with appropriate credentials.
IAM Permissions: AdministratorAccess (or permissions for CloudFormation, S3, and IAM).
A text editor (VS Code, Vim, or similar).

Learning Objectives

Create modular, reusable CloudFormation templates.
Implement a Root Template using the AWS::CloudFormation::Stack resource.
Manage infrastructure lifecycles through nested stack updates.
Apply standardized tagging and security configurations across reusable components.

Architecture Overview

Loading Diagram...

Figure 1 — Mermaid diagram

Conceptual Model of Reusability

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Step-by-Step Instructions

Step 1: Create the Reusable S3 Component

First, we create a "Child" template that defines a standardized, encrypted S3 bucket. This template can be reused across different projects.

Create a file named s3-component.yaml:

yaml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  BucketName:
    Type: String
Resources:
  SecureBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
Outputs:
  BucketArn:
    Value: !GetAtt SecureBucket.Arn

Step 2: Upload Component to S3

CloudFormation nested stacks require the child templates to be stored in an S3 bucket that the service can access during deployment.

bash

# Replace <YOUR_LAB_ASSETS_BUCKET> with a unique name
aws s3 mb s3://brainybee-lab-assets-<YOUR_ACCOUNT_ID>
aws s3 cp s3-component.yaml s3://brainybee-lab-assets-<YOUR_ACCOUNT_ID>/templates/s3-component.yaml

Step 3: Create the Root Template

The root template "calls" the child template as a resource.

Create a file named main-stack.yaml:

yaml

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  StorageLayer:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://brainybee-lab-assets-<YOUR_ACCOUNT_ID>.s3.amazonaws.com/templates/s3-component.yaml
      Parameters:
        BucketName: !Sub "reusable-infra-bucket-${AWS::AccountId}"

Step 4: Deploy the Infrastructure

Deploy the root stack using the AWS CLI.

bash

aws cloudformation create-stack \
    --stack-name nested-infra-lab \
    --template-body file://main-stack.yaml \
    --capabilities CAPABILITY_IAM

▶Console alternative

Navigate to

CloudFormation

Create stack

(With new resources). 2. Upload the

main-stack.yaml

file. 3. Follow the wizard, acknowledging IAM capabilities at the end.

Checkpoints

Verification Task	Command / Action	Expected Result
Check Stack Status	`aws cloudformation describe-stacks --stack-name nested-infra-lab`	`StackStatus` is `CREATE_COMPLETE`
Verify Nested Stack	Check the CloudFormation console	Two stacks exist: `nested-infra-lab` and a child stack starting with `nested-infra-lab-StorageLayer`
Verify Encryption	Check S3 Bucket properties	"Server-side encryption" is enabled (AES-256)

Troubleshooting

Error	Likely Cause	Solution
`S3 Error: Access Denied`	The CloudFormation service role doesn't have access to your assets bucket.	Ensure the S3 bucket permits `s3:GetObject` or use a public-read ACL (not recommended for production).
`TemplateURL must point to a template located in an S3 bucket`	You provided a local file path in the `TemplateURL` field.	Ensure the URL starts with `https://...s3.amazonaws.com/...`
`Circular Dependency`	A resource is waiting for an output that depends on itself.	Use `!DependsOn` explicitly if needed, but check logic first.

Challenge

Objective: Modify the s3-component.yaml to include a LifecycleConfiguration that transitions objects to S3 Intelligent-Tiering after 30 days. Re-upload the file to S3 and update the root stack using the aws cloudformation update-stack command.

Cost Estimate

S3 Storage: Free Tier (if under 5GB). Minimal cost (~$0.023/GB) otherwise.
CloudFormation: No additional cost for AWS resources managed by CloudFormation.
Data Transfer: Negligible for this lab.
Total Estimated Spend: < $0.05 USD.

Concept Review

Feature	Nested Stacks	CloudFormation Modules
Primary Use	Creating groups of resources that are managed together.	Encapsulating resource definitions into a single resource type.
Visibility	Shows up as multiple stacks in the console.	Shows up as a single stack; module is abstracted.
Updates	Updating child template requires updating the root stack.	Managed via the CloudFormation Registry.

Teardown

To avoid ongoing costs, delete the stacks and the assets bucket created during this lab.

bash

# Delete the stacks
aws cloudformation delete-stack --stack-name nested-infra-lab

# Empty and delete the assets bucket
aws s3 rm s3://brainybee-lab-assets-<YOUR_ACCOUNT_ID> --recursive
aws s3 rb s3://brainybee-lab-assets-<YOUR_ACCOUNT_ID>

Mastering Reusable Infrastructure: AWS CloudFormation Nested Stacks

[!WARNING] This lab involves provisioning real AWS resources. Remember to run the teardown commands at the end to avoid ongoing charges.

Prerequisites

An active AWS Account.
AWS CLI installed and configured with appropriate credentials.
IAM Permissions: AdministratorAccess (or permissions for CloudFormation, S3, and IAM).
A text editor (VS Code, Vim, or similar).

Learning Objectives

Create modular, reusable CloudFormation templates.
Implement a Root Template using the AWS::CloudFormation::Stack resource.
Manage infrastructure lifecycles through nested stack updates.
Apply standardized tagging and security configurations across reusable components.

Architecture Overview

Loading Diagram...

Figure 1 — Mermaid diagram

Conceptual Model of Reusability

Compiling TikZ diagram…

⏳

Running TeX engine…

This may take a few seconds

Figure 2 — TikZ diagram

Step-by-Step Instructions

Step 1: Create the Reusable S3 Component

First, we create a "Child" template that defines a standardized, encrypted S3 bucket. This template can be reused across different projects.

Create a file named s3-component.yaml:

yaml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  BucketName:
    Type: String
Resources:
  SecureBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref BucketName
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
Outputs:
  BucketArn:
    Value: !GetAtt SecureBucket.Arn

Step 2: Upload Component to S3

CloudFormation nested stacks require the child templates to be stored in an S3 bucket that the service can access during deployment.

bash

# Replace <YOUR_LAB_ASSETS_BUCKET> with a unique name
aws s3 mb s3://brainybee-lab-assets-<YOUR_ACCOUNT_ID>
aws s3 cp s3-component.yaml s3://brainybee-lab-assets-<YOUR_ACCOUNT_ID>/templates/s3-component.yaml

Step 3: Create the Root Template

The root template "calls" the child template as a resource.

Create a file named main-stack.yaml:

yaml

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  StorageLayer:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://brainybee-lab-assets-<YOUR_ACCOUNT_ID>.s3.amazonaws.com/templates/s3-component.yaml
      Parameters:
        BucketName: !Sub "reusable-infra-bucket-${AWS::AccountId}"

Step 4: Deploy the Infrastructure

Deploy the root stack using the AWS CLI.

bash

aws cloudformation create-stack \
    --stack-name nested-infra-lab \
    --template-body file://main-stack.yaml \
    --capabilities CAPABILITY_IAM

▶Console alternative

Navigate to

CloudFormation

Create stack

(With new resources). 2. Upload the

main-stack.yaml

file. 3. Follow the wizard, acknowledging IAM capabilities at the end.

Checkpoints

Verification Task	Command / Action	Expected Result
Check Stack Status	`aws cloudformation describe-stacks --stack-name nested-infra-lab`	`StackStatus` is `CREATE_COMPLETE`
Verify Nested Stack	Check the CloudFormation console	Two stacks exist: `nested-infra-lab` and a child stack starting with `nested-infra-lab-StorageLayer`
Verify Encryption	Check S3 Bucket properties	"Server-side encryption" is enabled (AES-256)

Troubleshooting

Error	Likely Cause	Solution
`S3 Error: Access Denied`	The CloudFormation service role doesn't have access to your assets bucket.	Ensure the S3 bucket permits `s3:GetObject` or use a public-read ACL (not recommended for production).
`TemplateURL must point to a template located in an S3 bucket`	You provided a local file path in the `TemplateURL` field.	Ensure the URL starts with `https://...s3.amazonaws.com/...`
`Circular Dependency`	A resource is waiting for an output that depends on itself.	Use `!DependsOn` explicitly if needed, but check logic first.

Challenge

Cost Estimate

S3 Storage: Free Tier (if under 5GB). Minimal cost (~$0.023/GB) otherwise.
CloudFormation: No additional cost for AWS resources managed by CloudFormation.
Data Transfer: Negligible for this lab.
Total Estimated Spend: < $0.05 USD.

Concept Review

Feature	Nested Stacks	CloudFormation Modules
Primary Use	Creating groups of resources that are managed together.	Encapsulating resource definitions into a single resource type.
Visibility	Shows up as multiple stacks in the console.	Shows up as a single stack; module is abstracted.
Updates	Updating child template requires updating the root stack.	Managed via the CloudFormation Registry.

Teardown

To avoid ongoing costs, delete the stacks and the assets bucket created during this lab.

bash

# Delete the stacks
aws cloudformation delete-stack --stack-name nested-infra-lab

# Empty and delete the assets bucket
aws s3 rm s3://brainybee-lab-assets-<YOUR_ACCOUNT_ID> --recursive
aws s3 rb s3://brainybee-lab-assets-<YOUR_ACCOUNT_ID>