aws-cloudformation

Troubleshoot CloudFormation stack failures by identifying the first failure event and correlating it with CloudTrail logs within a tight time window. This distinguishes template-level versus environment-level causes to produce actionable remediation guidance for CREATE_FAILED and rollback states.

Validate CloudFormation templates before deployment by running cfn-lint for syntax and schema checks, cfn-guard for compliance, and change-set validation via describe-events. This layered readiness approach surfaces VALIDATION_ERRORs before execution.

Author CloudFormation templates with secure-by-default patterns by applying conventions like S3 public access blocking, encryption defaults, and stateful retention policies. This ensures safer naming and infrastructure as code compliance.

Change set validation fails due to syntax, schema, or compliance errors caught by cfn-lint and cfn-guard, or VALIDATION_ERRORs from describe-events. Diagnose the exact pre-deployment failure to receive the specific template-level or environment-level fix needed.

Yes, use cfn-lint and cfn-guard together for layered CloudFormation compliance checks. Run cfn-lint to validate syntax and schema, then apply cfn-guard rules to enforce security and compliance before executing CREATE or UPDATE change sets.