Skip to main content
This guide demonstrates how to create a simple AWS CloudFormation stack that deploys an EC2 instance and a security group using a YAML template. The example is kept minimal so you can quickly understand CloudFormation building blocks and get a working EC2 instance up and running. CloudFormation supports both YAML and JSON templates; this lesson uses YAML.

​
What you’ll create

  • A stack.yaml CloudFormation template.
  • Template Parameters to capture user input (key pair and EC2 name).
  • Template Resources for an EC2 instance and a Security Group.
  • Template Outputs to reveal useful runtime values such as the instance public IP.

​
Quick overview of template structure

CloudFormation templates declare resources under the top-level Resources key. Each resource has:
  • A logical name (your chosen identifier).
  • A Type (the AWS resource type, e.g., AWS::EC2::Instance).
  • Properties that configure the resource.
Reference the CloudFormation resource and property documentation to find the correct Type and supported Properties: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html Example snippet showing logical name and type:

​
Pick the AMI and key pair

Choose an AMI (ImageId) in the EC2 Launch Instance console or from the AWS Marketplace. Also supply or pick an existing key pair name from your account — this is used for SSH access to the instance.
Screenshot of the AWS EC2 "Launch an instance" console, showing fields for Name and tags, selection of an Amazon Machine Image (AMI), and a Summary panel with instance type (t2.micro) and a "Launch instance" button.

​
Security groups and VPC considerations

  • Create a security group resource in the same template and add ingress rules (for example, allow SSH on port 22).
  • For EC2 instances launched inside a VPC, reference the security group using SecurityGroupIds on the instance.
  • If your account requires specifying a VPC when creating security groups, include the VpcId property on the security group resource.

​
Minimal, complete CloudFormation template

This example:
  • Accepts a key-pair name and an EC2 name as parameters.
  • Creates a security group that allows SSH ingress.
  • Creates an EC2 instance that uses the security group and key pair.
  • Exposes the instance public IP in Outputs.
Replace the ImageId with a valid AMI for your region.
Specifying Type: AWS::EC2::KeyPair::KeyName for the KeyName parameter causes the CloudFormation console to show a drop-down listing existing key pairs in the selected region — making it easier and less error-prone than entering an arbitrary string.

​
Deploying the template using the AWS Console

  1. Open the CloudFormation service in the AWS Management Console.
  2. Create stack → Upload a template file → select stack.yaml.
  3. Enter a Stack name, provide the Ec2Name, and select the KeyName from the drop-down. Proceed through the wizard.
  4. Review and create the stack.
After creation, the console shows events and resource statuses. Inspect created resources and view outputs (for example, the instance public IP returned by the template).
A screenshot of the AWS CloudFormation User Guide showing the "Return values" section for AWS::EC2::Instance, including Ref and Fn::GetAtt attributes (PublicDnsName, PublicIp, etc.) and a left navigation pane listing EC2 resource topics. The page header and search bar are visible at the top.

​
Monitor stack events and resources

Watch stack events during creation to see lifecycle events for each resource. After completion, use the Resources tab to open or examine the individual AWS resources created by the stack (EC2 instance, security group, etc.).
A screenshot of the AWS CloudFormation console showing stacks on the left and the Events tab for a stack called "my-deployment" on the right. The events list shows resource statuses like CREATE_COMPLETE and CREATE_IN_PROGRESS.

​
Cleaning up: deleting the stack

To remove all created resources, delete the CloudFormation stack. CloudFormation attempts to delete resources it created. If deletion fails (for example, because a resource was modified outside CloudFormation or has deletion protection), resolve those issues and retry.
A screenshot of the AWS CloudFormation Stacks console listing four stacks with statuses (mostly CREATE_COMPLETE, one DELETE_FAILED). The "my-deployment" stack is selected at the top of the list.

​
Quick reference table

​
Additional tips and next steps

  • Use SecurityGroupIds when referencing security groups by logical ID from the same template.
  • If you need to place the instance in a specific VPC/subnet, add SubnetId and use VpcId on the security group resource.
  • Extend the template by adding UserData, IAM instance profiles, block device mappings, or autoscaling resources as your architecture needs grow.

​
Summary

  • Use Parameters to capture user input (key pairs, instance names).
  • Declare Resources with logical names and correct Type values (consult the CloudFormation docs).
  • Use SecurityGroupIds when referencing security groups defined in the same template.
  • Use Outputs to return useful runtime values such as the instance public IP.
This simple CloudFormation example helps you get started quickly. Expand it as needed to match production requirements (VPC configuration, IAM roles, advanced networking, multiple instances, etc.).

Watch Video