A financial services company is migrating its legacy applications to AWS. They have strict change management policies requiring all infrastructure modifications to be thoroughly reviewed and approved by a security team before being applied to production. They use AWS CloudFormation for infrastructure provisioning. Which CloudFormation feature allows them to preview the exact impact of a proposed stack update on their resources and get explicit approval before execution, without actually applying the changes?
- ACloudFormation Stack Policies
- BCloudFormation Change Sets
- CCloudFormation Drift Detection
- DCloudFormation Custom Resources
Show answer & explanationAnswer & explanation
Correct answer: B. CloudFormation Change Sets
CloudFormation Change Sets allow users to preview the changes that CloudFormation will make to a stack before executing them. This is crucial for environments with strict change management, as it provides a clear understanding of the impact and enables explicit approval from a security team before any actual modifications are applied to production resources.
Why the other options are wrong
- A. Stack Policies prevent unintended updates/deletions on existing resources, they don't preview changes.
- C. Drift Detection identifies differences between the deployed stack and the template, it doesn't preview future changes.
- D. Custom Resources extend CloudFormation capabilities but are not for previewing stack updates.
CloudFormation Change Sets
AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack template will impact your running resources before you implement them. This is essential for understanding potential disruptions and getting approvals before applying updates, especially in production environments.
- Previews changes to a stack's resources.
- Shows additions, modifications, or deletions.
- Allows for review and approval before execution.
- Crucial for controlled change management.
Memory trick: Change Sets let you 'see' before you 'do'.