How do CloudFormation change sets, stack policies, rollback, and drift detection work together in production change control?
Quick Answer
Change sets preview what CloudFormation intends to create, update, replace, or delete. Stack policies constrain dangerous updates, rollback returns a failed stack toward the prior stable state, and drift detection finds unmanaged changes made outside CloudFormation.
Detailed Answer
CloudFormation is like a building permit office. The template is the approved blueprint, a change set is the proposed renovation, a stack policy protects load-bearing walls, and drift detection finds rooms someone changed without a permit.
CloudFormation is built around declarative desired state for AWS resources. Production change control depends on reviewing the difference between template intent and deployed reality, then limiting which critical resources can be replaced.
When a stack update starts, CloudFormation builds a dependency graph from resources and references, calls AWS service APIs in order, waits for stabilization signals, and records stack events. Drift detection compares supported resource properties against current live configuration.
At scale, teams require change sets in CI, protect stateful resources with stack policies and deletion policies, and watch stack events during updates. They use drift detection after emergency console changes and before large refactors.
A non-obvious gotcha is that drift detection is not universal for every property or resource type. A clean drift report does not prove the system is identical; it proves CloudFormation found no drift in the properties it can check.
Code Example
aws cloudformation create-change-set --stack-name payments-prod --change-set-name release-2026-06-18 --template-body file://template.yaml --capabilities CAPABILITY_IAM # Creates a reviewable production change set. aws cloudformation describe-change-set --stack-name payments-prod --change-set-name release-2026-06-18 # Shows replacements, deletes, and IAM changes before execution. aws cloudformation detect-stack-drift --stack-name payments-prod # Starts drift detection to find unmanaged production edits.
Interview Tip
A junior engineer typically answers with the feature name and a happy-path command, but for a senior/architect role, the interviewer is actually looking for production judgment. Explain where the CloudFormation control plane stores intent, how changes are rolled out, what telemetry proves the system is healthy, and what failure mode creates the largest blast radius. Strong answers include rollback behavior, ownership boundaries, permissions, and the exact signal you would page on.