Welcome back. Let's take a look at a couple of vendor-specific tools: AWS CloudFormation and Azure Resource Manager. I'm going to call them CFn and ARM.

They're both Infrastructure as Code tools, so they have templates, an engine, and stacks, and make our cloud deployments repeatable, auditable, and scalable. But they work in slightly different ways.

CFn uses YAML or JSON templates to define resources. You throw your template at the engine, and it figures out the order of operations. It's naturally tightly integrated with AWS services.

ARM also uses JSON templates. It's more verbose than CFn. Bicep is a DSL, a domain-specific language for ARM that is less verbose and easier to read in my opinion.

CFn is made for AWS. It supports nested and chained stacks for modularization, macros for frequently used operations, and Service Catalog for governance and compliance. To see what will change when we update a stack, we can create a Change Set, check what will change, and then apply it if we're happy with the changes.

ARM is built for Azure. It also supports modularization. We compare ARM templates with Azure Blueprints for governance and compliance, and there's a "what-if" mode to see what will change before we change it.

One big difference: CFn has drift detection, ARM doesn't. That means CFn can tell you when someone's gone rogue and changed something manually.

From a governance perspective, we can use CloudFormation Guard to enforce rules, like my current favorite bugbear, making sure EBS volumes are deleted on EC2 termination. And we can use Azure policy to deny deployments that don't meet our standards.

If we're deep in one cloud we should stick with the native tool. It will give us the biggest bang for our bucks. But if we're multi-cloud, we should consider something like Terraform. Infrastructure as Code is the foundation of good governance, cost control, and automation. Put simply, I don't care what IaC tool you use, but I strongly urge you to use one.

Key takeaways: CloudFormation and ARM are declarative IaC tools for AWS and Azure respectively. CloudFormation supports drift detection and tight AWS integration. ARM integrates deeply with Azure's RBAC and policy engine. Use native tools for cloud-specific automation and governance. Use Terraform for abstraction.

AWS CloudFormation and Azure Resource Manager

About