Cloud & DevOpsBy Abdul Rahman27 May 20262 min read
Infrastructure as Code in 2026: Terraform vs CloudFormation vs CDK
Clicking through a cloud console doesn't scale. A comparison of Terraform, AWS CloudFormation and the AWS CDK, with a working EC2 example and practices for managing state safely.
Infrastructure as Code (IaC) means defining servers, networks, databases and permissions in files that are versioned, reviewed and applied automatically. It's now a baseline expectation for cloud and DevOps roles — and one of the fastest ways to make deployments repeatable.
When I first provisioned an EC2 web server with AWS CloudFormation — instance, Nginx via user data, security group, Elastic IP and outputs from one YAML template — the value was immediately clear: the same template produced the same server every time, and deleting the stack removed every resource cleanly.
Infrastructure changes follow the same review process as application code.
CloudFormation
AWS's native IaC service, written in YAML or JSON.
Strengths: fully managed state, deep AWS integration, drift detection, and no extra tooling. Limitations: AWS-only, verbose templates, and limited abstraction for repeated patterns.
Parameters:
LatestAmiId:
Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
Resources:
WebServer:
Type: AWS::EC2::Instance
Properties:
InstanceType: t3.micro
ImageId: !Ref LatestAmiId
UserData:
Fn::Base64: |
#!/bin/bash
dnf install -y nginx
systemctl enable --now nginx
Reading the AMI from a public SSM parameter keeps the template current without hard-coded image IDs.
Terraform (and OpenTofu)
A declarative language (HCL) with providers for AWS, Azure, GCP, Cloudflare, GitHub, Kubernetes and hundreds more. OpenTofu is the open-source fork maintained by the Linux Foundation.
Strengths: multi-cloud, huge module ecosystem, clear plan output before every change.
Limitations: you manage the state file — its storage, locking and security.
AWS CDK
Define infrastructure in TypeScript, Python, Java or other languages; the CDK synthesises CloudFormation.
Strengths: real programming constructs (loops, functions, types), reusable high-level components, familiar tooling for developers. Limitations: AWS-focused and an extra abstraction layer to debug.
How to Choose
- All-in on AWS, ops-focused team → CloudFormation or CDK.
- Developer-heavy team on AWS → CDK for its abstractions and type safety.
- Multiple clouds or SaaS providers → Terraform/OpenTofu.
The tool matters less than the practice: everything in code, reviewed and applied by a pipeline.
Practices That Matter More Than the Tool
- Remote, locked state (for Terraform) with encryption and restricted access.
- Plan in CI, apply after review — the diff is part of the pull request.
- Separate environments (dev, staging, production) with shared modules and different variables.
- No manual console changes; detect drift and fix it in code.
- Least-privilege IAM in templates, and never open SSH to the world — prefer Systems Manager Session Manager.
- Tag everything for cost allocation and cleanup.
Key Takeaways
- IaC makes infrastructure repeatable, reviewable and disposable.
- CloudFormation and CDK suit AWS-centric teams; Terraform/OpenTofu suits multi-cloud.
- Review plans in pull requests and apply through pipelines.
- Protect state, separate environments and avoid manual changes.
