Parameters

AWS

• Things like AMI Id, Instance Id, Vpc Id etc.

SSM

• AWS Doc
• Refer to a parameter (not secure string) saved in SSM parameter store
• Use parameter by name, don’t need to specify version
• Use cross account parameter by providing full arn.

Dynamic

• AWS doc
• Refer to parameters dynamically in templates. Useful to obscure secrets.
• No drift detection

SSM parameter store

• {{resolve:ssm-secure:parameter-name:version}} or {{resolve:ssm:parameter-name:version}}
• Can’t use secure string parameter for all resources. Very limited support, see this
• Can’t use cross-account parameters
• Can’t use public parameters or parameter labels
• Can’t use for custom resources

Secrets Manager

• {{resolve:secretsmanager:secret-id:secret-string:json-key:version-stage:version-id}}
• Can use for ALL resources, well, almost.
• Can’t use for custom resources
• When changing a referred secret, cloudformation still makes a list call to the old secret. Template update will fail if the old secret is marked for deletion ahead of cloudformation run.

Questions

1. What is stack sets?
2. How do you deploy cross-region cross-account?
3. How do you customize parameter values for different regions and/or accounts?
4. What is termination protection?
5. What is deletion policy attribute? What resources support it? What are the valid vales? Snapshot/retain
6. What is a stack policy? What is the use-case?
7. What is a change-set?
8. can use ssm appconfig?
9. can use ssm parameter store? cloudformation does not support creating secrets parameter, supply parameter values in a separate file, like terraform tfvars files
10. parameter types
11. update behaviour
12. How does it work with aws cdk?

Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html