AWS IaC
with Python

Prerequisites

• Python 3.11 or a newer version defined by the project
• Node.js for the CDK CLI
• AWS CLI v2
• AWS CDK CLI v2
• Git and an editor with Python and YAML support
• SSO, OIDC or short-lived roles instead of static keys

Tokens: values from the future

bucket = s3.Bucket(self, "Data")

# No physical name exists while the Python code runs:
name = bucket.bucket_name

CfnOutput(self, "Name", value=name)

The bucket name is a token. CDK serializes a reference into the template, so string output during synthesis may show placeholders.

Escape hatch

cfn_bucket = bucket.node.default_child
cfn_bucket.add_property_override(
    "Metadata.Owner", "platform"
)

Use only when the L2 construct does not yet expose a new property. Test the override and remove it later.

Design the construct API

Strong, typed reference

data = DataStack(app, "Data", env=env)

api = ApiStack(
    app,
    "Api",
    data_bucket=data.bucket,
    env=env,
)

# CDK creates the required export/import relationship.

def __init__(..., data_bucket: s3.IBucket, **kwargs):
    super().__init__(..., **kwargs)
    fn = lambda_.Function(...)
    data_bucket.grant_read(fn)

Choose coupling deliberately

import aws_cdk as cdk
from aws_cdk.assertions import Match, Template
from src.data_stack import DataStack


def test_bucket_is_encrypted_and_versioned():
    app = cdk.App()
    stack = DataStack(app, "TestData")
    template = Template.from_stack(stack)

    template.has_resource_properties(
        "AWS::S3::Bucket",
        {
            "VersioningConfiguration": {
                "Status": "Enabled"
            },
            "PublicAccessBlockConfiguration":
                Match.object_like({
                    "BlockPublicAcls": True,
                    "BlockPublicPolicy": True,
                }),
        },
    )
    template.resource_count_is("AWS::S3::Bucket", 1)

IaC test pyramid

from aws_cdk import Aspects
from cdk_nag import AwsSolutionsChecks

Aspects.of(app).add(AwsSolutionsChecks())

Pseudo parameters

AWS::AccountId
AWS::Region
AWS::Partition
AWS::StackId
AWS::StackName
AWS::URLSuffix
AWS::NoValue
AWS::NotificationARNs

AWS::Partition instead of a hard-coded aws when templates must work across partitions.

Conditional property

Conditions:
  IsProd: !Equals [!Ref Environment, prod]

Resources:
  Function:
    Type: AWS::Lambda::Function
    Properties:
      ReservedConcurrentExecutions: !If
        - IsProd
        - 50
        - !Ref AWS::NoValue

AWS::NoValue removes the property completely instead of setting an empty value.

Direct development workflow

cfn-lint template.yaml

aws cloudformation validate-template \
  --template-body file://template.yaml

aws cloudformation deploy \
  --template-file template.yaml \
  --stack-name lab-data \
  --parameter-overrides Environment=dev \
  --capabilities CAPABILITY_NAMED_IAM \
  --no-fail-on-empty-changeset

In PowerShell, use a backtick for line continuation or enter the command on one line. The example uses backslashes to save space.

Explicit change set

aws cloudformation create-change-set \
  --stack-name lab-data \
  --change-set-name review-001 \
  --change-set-type UPDATE \
  --template-body file://template.yaml \
  --capabilities CAPABILITY_NAMED_IAM

aws cloudformation describe-change-set \
  --stack-name lab-data \
  --change-set-name review-001

aws cloudformation execute-change-set \
  --stack-name lab-data \
  --change-set-name review-001

For a new stack, use --change-set-type CREATE .

CDK: grants instead of hand-written policies

secret = secretsmanager.Secret.from_secret_name_v2(
    self, "DbSecret", "prod/app/database"
)

fn = lambda_.Function(...)
bucket.grant_read(fn)
queue.grant_send_messages(fn)
secret.grant_read(fn)

Grants create targeted identity or resource policies. The secret is not read during synthesis.

CloudFormation: dynamic reference

MasterUserPassword:
  '{{resolve:secretsmanager:prod/app/database:
    SecretString:password}}'

The value remains outside the template. No output, logging or plaintext parameter.

CDK for each target environment

targets = {
    "dev": cdk.Environment(
        account="111111111111",
        region="eu-central-1",
    ),
    "prod": cdk.Environment(
        account="222222222222",
        region="eu-central-1",
    ),
}

for stage, env in targets.items():
    AppStage(
        app,
        f"App-{stage}",
        env=env,
        stage_name=stage,
    )

Account IDs are configuration, not secrets. Still keep roles and regions central and verifiable.

Boundaries and mechanisms

Required tags

Project       = aws-iac-lab
Environment   = dev | stage | prod
Owner         = platform-team
CostCenter    = learning
ManagedBy     = cdk
DataClass     = internal
Criticality   = low | medium | high

Define tag policies centrally. Tagging matters for cost and ownership, but does not replace an IAM or account boundary.

Operational readiness

• Dashboards and alarms exist.
• Log retention and data classification are defined.
• A backup has been restored successfully.
• Service quotas match the load.
• The error budget and SLO are known.
• The runbook covers diagnosis and escalation.
• A cost alarm and budget are active.
• Ownership and the on-call path are clear.
• Drift checks run periodically.

Transform: AWS::Serverless-2016-10-31
Resources:
  ApiFunction:
    Type: AWS::Serverless::Function
    Properties:
      Runtime: python3.13
      Handler: app.handler
      CodeUri: src/
      Timeout: 10
      Events:
        Api:
          Type: Api
          Properties:
            Path: /health
            Method: get

aws sts get-caller-identity

aws cloudformation describe-events \
  --stack-name LabData \
  --filters FailedEvents=true

aws cloudformation describe-stack-resources \
  --stack-name LabData

aws cloudtrail lookup-events \
  --lookup-attributes \
  AttributeKey=EventName,AttributeValue=CreateBucket

aws cloudformation create-change-set \
  --stack-name NAME \
  --change-set-name review-001 \
  --change-set-type UPDATE \
  --template-body file://template.yaml \
  --capabilities CAPABILITY_NAMED_IAM

aws cloudformation describe-change-set \
  --stack-name NAME \
  --change-set-name review-001

aws cloudformation execute-change-set \
  --stack-name NAME \
  --change-set-name review-001

aws cloudformation describe-events \
  --stack-name NAME \
  --filters FailedEvents=true

aws cloudformation cancel-update-stack \
  --stack-name NAME

aws cloudformation continue-update-rollback \
  --stack-name NAME