3.4.3 Update Existing IaC Templates

# Create change set (preview)
aws cloudformation create-change-set \
  --stack-name my-stack \
  --template-body file://template.yaml \
  --change-set-name update-v2

# Review changes
aws cloudformation describe-change-set \
  --change-set-name update-v2 --stack-name my-stack

# Execute
aws cloudformation execute-change-set \
  --change-set-name update-v2 --stack-name my-stack

{
  "Statement": [{
    "Effect": "Deny",
    "Action": "Update:Replace",
    "Principal": "*",
    "Resource": "LogicalResourceId/ProductionDB"
  }]
}

sam build
sam deploy  # Automatically creates change set

cdk diff    # Preview changes
cdk deploy  # Apply changes

Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/bucket/vpc.yaml