Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Get Started Free →

Cloudformation Best Practices · sickn33 | DecimalAI

Cloudformation Best Practices

NewSkillScoreMaintained

cloudformation-best-practices

CloudFormation template optimization, nested stacks, drift detection, and production-ready patterns. Use when writing or reviewing CF templates.

DevOpsby sickn33

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/cloudformation-best-practices/SKILL.md

decimalai skills pull cloudformation-best-practices --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/cloudformation-best-practices/SKILL.md https://app.decimal.ai/s/cloudformation-best-practices/SKILL.md

Raw file: /s/cloudformation-best-practices/SKILL.md ↗ · machine-readable summary at /s/cloudformation-best-practices.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 57d ago

No — -33% lift+21% tokens0% turns9% of whole cases pass with skill (2/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-02	✗→✓	▲ Improved	—	—
case-12	✓→✓	＝ Same ✓	—	—
case-15	✗→✗	＝ Same ✗	—	—
case-10	✗→✗	＝ Same ✗	—	—
case-05	✗→✗	＝ Same ✗	—	—

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

sickn33 / antigravity-awesome-skills

skills/cloudformation-best-practices/SKILL.md

View on GitHub ↗

License MITImported 8/2/2026Version v1

Skill contents

SKILL.md

You are an expert in AWS CloudFormation specializing in template optimization, stack architecture, and production-grade infrastructure deployment.

Use this skill when

Writing or reviewing CloudFormation templates (YAML/JSON)
Optimizing existing templates for maintainability and cost
Designing nested or cross-stack architectures
Troubleshooting stack creation/update failures and drift

Do not use this skill when

The user prefers CDK or Terraform over raw CloudFormation
The task is application code, not infrastructure

Instructions

Use YAML over JSON for readability.
Parameterize environment-specific values; use Mappings for static lookups.
Apply DeletionPolicy: Retain on stateful resources (RDS, S3, DynamoDB).
Use Conditions to support multi-environment templates.
Validate templates with aws cloudformation validate-template before deployment.
Prefer !Sub over !Join for string interpolation.

Examples

Example 1: Parameterized VPC Template

yaml
AWSTemplateFormatVersion: "2010-09-09"
Description: Production VPC with public and private subnets

Parameters:
  Environment:
    Type: String
    AllowedValues: [dev, staging, prod]
  VpcCidr:
    Type: String
    Default: "10.0.0.0/16"

Conditions:
  IsProd: !Equals [!Ref Environment, prod]

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCidr
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-vpc"

Outputs:
  VpcId:
    Value: !Ref VPC
    Export:
      Name: !Sub "${Environment}-VpcId"

Best Practices

✅ Do: Use Outputs with Export for cross-stack references
✅ Do: Add DeletionPolicy and UpdateReplacePolicy on stateful resources
✅ Do: Use cfn-lint and cfn-nag in CI pipelines
❌ Don't: Hardcode ARNs or account IDs — use !Sub with pseudo parameters
❌ Don't: Put all resources in a single monolithic template

Troubleshooting

Problem: Stack stuck in UPDATE_ROLLBACK_FAILED Solution: Use continue-update-rollback with --resources-to-skip for the failing resource, then fix the root cause.

Limitations

Use this skill only when the task clearly matches the scope described above.
Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.

Illustrative Want to see what cloudformation-best-practices would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 17:48 UTC · 22 cases

Lift

-33%

33% vs 67%

Agent turns

0%

1.0 vs 1.0

Tokens

+21%

2,104.82 vs 1,739.77

fail → pass · 1pass → pass · 1fail → fail · 20

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-15 In a multi-region CloudFormation template, I need to map region names (e.g., us-east-1, us-west-2) to specific AMI IDs. What CloudFormation template section should be used for these static key-value lookups?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-10 I need to construct an S3 bucket policy string inside a CloudFormation template that combines an AWS account ID pseudo-parameter and a bucket name parameter. Which function syntax should I use for string interpolation?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-05 Write a Node.js AWS Lambda handler function that reads a JSON object from an S3 event, parses the payload, and inserts an item into a DynamoDB table using the AWS SDK v3.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 I need to reference the current AWS account ID inside an IAM policy statement within a CloudFormation template. Show how to construct the ARN dynamically without hardcoding the 12-digit account number.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 I need a CloudFormation template to deploy an Amazon RDS PostgreSQL instance that supports deployment across dev, staging, and production environments. Please construct a complete template that appropriately handles environment-specific configurations and ensures persistent database safety during stack teardown.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 Generate a CloudFormation template in YAML that provisions an AWS::EC2::VPC with CIDR 10.0.0.0/16 and an Environment parameter (dev/staging/prod). Include exported outputs for cross-stack references.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Before deploying a CloudFormation template via automated scripts, what AWS CLI command should be executed to verify syntax and structural validity of the template file?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 Write a CloudFormation snippet defining an AWS::S3::Bucket resource named 'AppLogsBucket'. The bucket must be protected from accidental data loss if the CloudFormation stack is deleted.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 Should I put all infrastructure resources (VPC, ECS cluster, RDS database, S3 buckets, and IAM roles) for an enterprise application into a single CloudFormation template file?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-18 I want to create a CloudFormation template that provisions a multi-AZ RDS deployment only when deployed to production, but a single-AZ deployment in dev. How should this conditional logic be structured in the template?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 Can you review my CloudFormation resource naming approach where I combine static prefixes and references using `Fn::Join`? Please refactor the snippet to follow proper AWS formatting standards for string interpolation and explain the recommended syntax.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Which specific types of stateful AWS storage resources require explicit deletion policies in CloudFormation to avoid accidental data loss during stack deletion?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-11 I have a networking CloudFormation stack that creates an EC2 VPC. I need other stacks to reference this VPC ID. Show how to expose the VPC ID in the template's Outputs section so external stacks can consume it.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 I prefer using AWS CDK in TypeScript rather than raw CloudFormation templates. Please write a TypeScript CDK construct that provisions a VPC with public and private subnets.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 How should I dynamically reference the deployment region inside a CloudFormation resource property without hardcoding 'us-east-1'?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-04 Our team uses Terraform HCL for infrastructure management across environments. Please write a Terraform module for an S3 bucket with versioning enabled and server-side encryption.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 I am starting a new AWS infrastructure project and need to write CloudFormation templates from scratch. Should I author the templates in JSON or YAML format for better maintainability and readability?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 Write a CloudFormation resource definition for an AWS::DynamoDB::Table named 'UserSessionTable' with pay-per-request billing. Ensure the table data is preserved if someone deletes the stack.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-12 What automated linting and security scanning tools should be added to a CI/CD pipeline to analyze CloudFormation templates before deployment?	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 A deployment of an AWS CloudFormation stack failed during an update and is now stuck in the UPDATE_ROLLBACK_FAILED status. What command and flags should I run in the AWS CLI to bypass the failing resource and complete the rollback?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 When modifying stateful resources like database instances in CloudFormation, what policy attribute prevents the resource from being permanently deleted if an update triggers a resource replacement?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 I am creating an Environment parameter in CloudFormation that should only accept 'dev', 'staging', or 'prod'. Which parameter property enforces this restriction in the template?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of -33 percentage points is the difference between those two pass rates over the 22 comparable cases. 4 cases got worse with the skill loaded, and they are included in that figure.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 66.7%
Pass rate with the skill: 33.3%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 4
Skill version measured: v1
Run completed: 7/28/2026, 17:48 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signalsno signals yet

BenchmarkRun a verified benchmark with positive lift

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns0% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

No signals yet — run a benchmark or collect evaluated traces to earn a score.

Verified on gemini-3.6-flash · re-tested 56 days ago

Other measured skills in the registry, with their headline benchmark lift.