CloudFormation: Infrastructure Automation Ledger Scorecard
AWS CloudFormation with the CDK: strong planning, safety and AWS depth, no target outside AWS, and a managed MCP server since May 2026.
Where CloudFormation put its effort, 2016 to 2026
Each square is one capability area in one year. The brighter it is, the more the area gained in the Infrastructure Automation Ledger that year; 1, 2 and 3 mark that year's biggest pushes.
| ’16 | ’17 | ’18 | ’19 | ’20 | ’21 | ’22 | ’23 | ’24 | ’25 | ’26 | |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Provisioning breadth | 1 | ||||||||||
| Configuration management depth | |||||||||||
| State, planning and safety | 1 | 1 | 1 | 2 | |||||||
| Language and authoring | 1 | 2 | 3 | ||||||||
| Orchestration and self-service | 1 | 2 | |||||||||
| Scale and control plane | 2 | ||||||||||
| Security and compliance | 3 | 2 | |||||||||
| Bare metal and day-2 operations | 1 | ||||||||||
| Ecosystem and integrations | 3 | ||||||||||
| AI assistance | 1 | 2 |
Biggest pushes overall: AI assistance (+3), State, planning and safety (+2.5), Language and authoring (+2). Already strong in 2015: Scale and control plane, Security and compliance, Ecosystem and integrations.
Top focus each year: 2017 Orchestration and self-service; 2018 State, planning and safety; 2019 Language and authoring; 2021 Provisioning breadth; 2022 State, planning and safety; 2024 State, planning and safety; 2025 AI assistance; 2026 Bare metal and day-2 operations. 3 of 11 years show no gain in any area.
Part of the Infrastructure Automation Ledger (edition 2026-10-16). How the scores work: methodology.
Snapshot
- Type: product (closed AWS service; the AWS CDK is an Apache-2.0 library that emits CloudFormation templates)
- Owner: Amazon Web Services, Inc. (United States), a subsidiary of Amazon.com, Inc.; built in house
- Licence: CloudFormation is a managed service with no charge for resources in the AWS namespace; third-party resource types and hooks are billed per handler operation, with 1,000 free operations a month. AWS CDK: Apache-2.0
- Latest release: AWS CDK 2.273.0 (2026-10-08); the service itself is unversioned, last dated change contract tests v2 (2026-09-02)
- Support lifecycle: Managed service with no customer-facing versions; CDK v2 is the current library line, shipped every one to two weeks
- Next milestone: Infrastructure Composer console closes on 2026-12-07; Amazon Q Developer IDE plugins reach end of support on 2027-04-30; no dated roadmap for the service
- Targets: AWS only, plus third-party SaaS types through the public registry. No resource type or module was found for Proxmox VE, Nutanix, XCP-ng, KubeVirt, vSphere or Hyper-V, and the CDK for Terraform route was archived on 2025-12-10
- Tier: Single-cloud reference
- Archetype: Dependable builder
- Evidence grade: B. What's New posts, the pricing page, the GitHub release feeds and the MCP server documentation were read from primary sources. The 2011 to 2024 timeline rests on a third-party chronology, and partner and certification terms were not read.
Scope of the scores: Single-cloud reference point. CloudFormation provisions only AWS, so the provisioning breadth and bare metal domains score low by design and the hardware and cloud coupling criterion scores high. It is included as the comparison point for a managed, state-in-the-service IaC product; it is no hybrid contender.
Scorecard
| Dimension | Score | Direction |
|---|---|---|
| Capability today | 62.3 / 100 | higher is better |
| Momentum since end of 2022 | +9.4 points (2015 to 2022: +15.3) | higher is better |
| Credibility | 17.5 / 25 | higher is better |
| Commercial risk | 4.0 / 25 | lower is better |
| Technical lock-in | 17.0 / 25 | lower is better |
| Integrator fit | 16.5 / 20 | higher is better |
| AI leverage | 8.0 / 20 | higher is better |
| Ledger Index | 62.0 / 100 | balanced weights; see the methodology |
Capability by domain, 2015 to today
Scores 0 to 5 against fixed anchors; total is weighted to 100.
| Domain (weight) | 2015 | 2019 | 2022 | Today |
|---|---|---|---|---|
| Provisioning breadth (15) | 2 | 2 | 2.5 | 2.5 |
| Configuration management depth (12) | 1 | 1 | 1 | 1 |
| State, planning and safety (12) | 2 | 3 | 3.5 | 4.5 |
| Language and authoring (10) | 2 | 3 | 3.5 | 4 |
| Orchestration and self-service (10) | 2 | 3 | 3 | 3.5 |
| Scale and control plane (8) | 3 | 4 | 4 | 4 |
| Security and compliance (10) | 3 | 3.5 | 4 | 4 |
| Bare metal and day-2 operations (8) | 0.5 | 0.5 | 0.5 | 1 |
| Ecosystem and integrations (8) | 3 | 3.5 | 4 | 4 |
| AI assistance (7) | 0 | 0 | 0 | 3 |
| Total / 100 | 37.6 | 47.4 | 52.9 | 62.3 |
Year by year: 2015: 37.6 · 2016: 37.6 · 2017: 39.4 · 2018: 41.8 · 2019: 47.4 · 2020: 47.4 · 2021: 50.7 · 2022: 52.9 · 2023: 52.9 · 2024: 54.1 · 2025: 60.8 · 2026: 62.3
What moved the score
| Year | Domain | Change | Points | Trigger |
|---|---|---|---|---|
| 2017 | Orchestration and self-service | 2 → 2.5 | +1.0 | StackSets: one template to many accounts and Regions |
| 2017 | Scale and control plane | 3 → 3.5 | +0.8 | StackSets across accounts and Regions |
| 2018 | State, planning and safety | 2 → 3 | +2.4 | Drift detection GA (2018-11-13); change sets as the plan |
| 2019 | Ecosystem and integrations | 3 → 3.5 | +0.8 | Registry and CLI for third-party resource types |
| 2019 | Language and authoring | 2 → 3 | +2.0 | CDK v1 GA: TypeScript and Python |
| 2019 | Orchestration and self-service | 2.5 → 3 | +1.0 | Service-managed StackSets through AWS Organizations |
| 2019 | Scale and control plane | 3.5 → 4 | +0.8 | Automatic deployment to new accounts across an organization |
| 2019 | Security and compliance | 3 → 3.5 | +1.0 | Service-managed permissions through AWS Organizations |
| 2021 | Ecosystem and integrations | 3.5 → 4 | +0.8 | Public registry; Cloud Control API |
| 2021 | Language and authoring | 3 → 3.5 | +1.0 | CDK v2 GA: one library, five languages |
| 2021 | Provisioning breadth | 2 → 2.5 | +1.5 | Public registry opens: third-party resource types (MongoDB, Datadog, Splunk) |
| 2022 | Security and compliance | 3.5 → 4 | +1.0 | Hooks GA: policy gate before create, update or delete |
| 2022 | State, planning and safety | 3 → 3.5 | +1.2 | Hooks GA: checks before create, update or delete |
| 2024 | State, planning and safety | 3.5 → 4 | +1.2 | IaC generator: templates and CDK apps from existing resources |
| 2025 | AI assistance | 0 → 2.5 | +3.5 | AWS IaC MCP server (2025-11-28): local, read-only |
| 2025 | Language and authoring | 3.5 → 4 | +1.0 | CloudFormation Language Server for IDEs (2025-11-19) |
| 2025 | Orchestration and self-service | 3 → 3.5 | +1.0 | StackSets auto-deployment ordering with dependencies |
| 2025 | State, planning and safety | 4 → 4.5 | +1.2 | Stack refactoring (2025-02); drift-aware change sets (2025-11) |
| 2026 | AI assistance | 2.5 → 3 | +0.7 | AWS MCP Server GA (2026-05-06) with IAM guardrails and CloudTrail logging |
| 2026 | Bare metal and day-2 operations | 0.5 → 1 | +0.8 | EC2 Auto Scaling Instance Refresh as an update policy (2026-07-29) |
Direction, 2023 to 2026
Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).
| Date | Item | Theme | Driver |
|---|---|---|---|
| 2023-03 | StackSets service-managed deployments can target the management account | Orchestration | C |
| 2023-11 | Git sync announced at re:Invent 2023 (GA date not found) | Ecosystem | V |
| 2024-02 | IaC generator: templates and CDK apps from existing resources | State and planning | C |
| 2024-10 | Application Composer renamed Infrastructure Composer | Packaging | P |
| 2024-12 | Hooks gain change set and stack targets; managed Guard and Lambda hooks | Security | C |
| 2025-02 | Stack refactoring: move resources between stacks | State and planning | C |
| 2025-09 | cdk refactor command (preview) | Language | C |
| 2025-11 | Drift-aware change sets: three-way compare against live state | State and planning | C |
| 2025-11 | CloudFormation Language Server for IDEs | Language | C |
| 2025-11 | StackSets auto-deployment ordering with dependencies | Orchestration | C |
| 2025-11 | AWS IaC MCP server for CDK and CloudFormation | AI | V |
| 2026-03 | CDK Mixins GA | Language | C |
| 2026-04 | Amazon Q Developer IDE plugins end of support set for 2027-04-30; Kiro named successor | AI | P |
| 2026-05 | AWS MCP Server GA (managed, two Regions) | AI | V |
| 2026-06 | Pre-deployment validation extended to Create Stack and Update Stack | State and planning | C |
| 2026-06 | Express mode for CloudFormation and CDK; rollback off by default | Scale | V |
| 2026-07 | EC2 Auto Scaling Instance Refresh as an update policy | Bare metal | C |
| 2026-09 | Contract tests v2 for resource types | Language | C |
| 2026-10 | Infrastructure Composer: sign-ups blocked 2026-10-29, console shuts down 2026-12-07 | Packaging | P |
- Centre of gravity: State and planning (4), Language (4), AI (3)
- Blind spots (no items): Provisioning breadth, Configuration management, Licensing
- Driver mix: Vision 21%, Customer need 63%, Market window 0%, Upstream 0%, Portfolio 16%
- Idea-to-need index: 0.25 (0 = demand-pulled, 1 = thesis-pushed)
Credibility: 17.5 / 25
| Criterion | Score | Basis |
|---|---|---|
| Cadence | 4 | CDK library every one to two weeks (ten releases from 2026-08-10 to 2026-10-08); service changes monthly; no published rhythm |
| Roadmap transparency | 3 | Dated What's New posts and blogs; no dated service roadmap read |
| Say-do | 3.5 | Most features reach GA at announcement; cdk refactor in preview for 13 months; Git sync GA date not found |
| Velocity | 4 | Several substantive items per quarter in 2025-11 and 2026-06 |
| Lifecycle stability | 3 | Engine stable since 2011; authoring tools renamed and retired (Infrastructure Composer, Q Developer IDE plugins, CDK for Terraform) |
Commercial risk: 4.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Price and licence volatility | 0.5 | No charge for AWS-namespace resources in every source read; per-operation fee for third-party types and hooks; no price change found |
| Purchase constraints | 1 | Nothing to buy, but an AWS account is required and there is no standalone product |
| Channel and access | 0.5 | Open to any AWS customer; CDK and the CloudFormation CLI are open source on GitHub and npm |
| Owner stability | 0.5 | Built in house by Amazon Web Services; no ownership change |
| Cost of staying supported | 1.5 | No upgrade fees; surrounding tools retired on notice (Infrastructure Composer console 2026-12-07, Q Developer IDE plugins 2027-04-30) |
Technical lock-in: 17.0 / 25 (lower is better)
| Criterion | Score | Basis |
|---|---|---|
| Formats | 3.5 | AWS-specific template schema and CDK constructs; state lives inside the service |
| Export path | 3 | IaC generator imports into templates; no exporter to another tool; CDK for Terraform archived 2025-12-10 |
| Stack coupling | 4 | AWS resources only; registry extensions run and bill inside AWS |
| Hardware / cloud coupling | 4.5 | Managed service only; no self-hosted or air-gapped mode; pre-deployment validation excludes China Regions |
| Skills and tooling coupling | 2 | Large AWS skills pool; CDK in five general-purpose languages; Guard and cfn-lint are AWS specific |
Integrator fit: 16.5 / 20
| Criterion | Score | Basis |
|---|---|---|
| Partner programme openness | 3.5 | AWS Partner Network exists; its terms were not read for this edition |
| Multi-tenancy and self-service | 4 | StackSets with AWS Organizations, Service Catalog and Control Tower managed hooks; the account is the tenant, there is no customer portal |
| API and infrastructure-as-code | 5 | Every action is an API; Cloud Control API gives uniform create, read, update, delete and list; CDK Toolkit Library embeds the deploy engine |
| Skills and certification | 4 | AWS certifications and a very large skills pool; specific tracks not checked |
AI leverage: 8.0 / 20
How the product uses AI, scored per year like capability. Only GA counts.
| Criterion | 2019 | 2022 | Today | Latest step |
|---|---|---|---|---|
| AI code and plan generation | 0 | 0 | 2 | 2025: IaC MCP server gives assistants documentation search, cfn-lint and Guard checks; Q Developer IDE generation retires 2027-04-30; no plan explanation |
| AI platform stack | 0 | 0 | 0 | 2015: None |
| AI-assisted operations | 0 | 0 | 1.5 | 2025: IaC MCP server troubleshoots failed deployments from CloudTrail events; Q Developer console chat is AWS-wide rather than CloudFormation specific |
| Agent openness | 1.5 | 2 | 4.5 | 2026: AWS MCP Server GA with IAM guardrails, CloudWatch metrics and CloudTrail logging; two Regions; express mode aimed at agents |
Year by year: 2015: 1.5 · 2016: 1.5 · 2017: 1.5 · 2018: 1.5 · 2019: 1.5 · 2020: 1.5 · 2021: 2 · 2022: 2 · 2023: 2 · 2024: 2 · 2025: 6.5 · 2026: 8
AI say-do, 2023 to 2026: 4 AI items announced; 3 GA, 0 still preview, 1 pending, 0 dropped. The pending item is the retirement of the Amazon Q Developer IDE plugins on 2027-04-30, with Kiro named as successor and no published statement on CloudFormation generation.
AWS has two agent routes around CloudFormation: a managed AWS MCP Server with IAM guardrails and CloudTrail logging, GA since 2026-05-06 in two Regions, and a local open-source IaC MCP server that searches documentation, lints templates and checks Guard rules but cannot create a stack. Code generation sits in Amazon Q Developer, whose IDE plugins reach end of support on 2027-04-30 with Kiro named as the successor and no published statement on CloudFormation generation. There is no plan explanation feature and no AI in CloudFormation's own operations.
Reading
CloudFormation sits in this Ledger as the single-cloud reference, and its scores read that way: planning, safety and security are near the top of the field inside AWS, while provisioning breadth and bare metal stay low because nothing outside AWS can be described in a template. Credibility is steady: features arrive at GA without pre-announcement and the engine has kept its shape since 2011, though the authoring tools around it churn (Infrastructure Composer, the Q Developer plugins, CDK for Terraform). Lock-in is the highest in the group by design, since state, formats and the control plane all live in one cloud and the only import path points inward. A buyer planning on the CDK should check the status of cdk refactor, still a preview 13 months after launch, before committing to large restructures.
Open questions and items to re-score
- cdk refactor: no GA item found by 2026-10-15; re-score the language domain when it leaves preview.
- Git sync: announced at re:Invent 2023, GA date not found; the orchestration score does not count it.
- Kiro: no official page states how it handles CDK or CloudFormation generation after the Q Developer IDE plugins retire on 2027-04-30.
- Public registry: no third-party type for vSphere, Proxmox VE, Nutanix, Hyper-V, XCP-ng or KubeVirt was found in the documentation; the registry itself was not queried.
- CDK v1 end-of-support date, price history of handler operations, FIPS endpoint and air-gapped statements were not verified.
- The IaC MCP server is described as available; no page labels it GA. The AWS MCP Server announcement does not mention infrastructure as code.
- Timeline dates from 2011 to 2024 come from a third-party chronology and should be checked against AWS pages in the next edition.
- Infrastructure Composer dates (sign-up block 2026-10-29 target, console shutdown 2026-12-07) are due for re-checking after they pass.
Related reading
More from Infrastructure Automation Ledger 2026
- Overview: all platforms side by side
- Infrastructure Automation Ledger Methodology: How Every Score Is Built
- Ansible AAP: Infrastructure Automation Ledger 2026 Scorecard
- Ansible: Infrastructure Automation Ledger 2026 Scorecard
- Atlantis: Infrastructure Automation Ledger 2026 Scorecard
- Bicep: Infrastructure Automation Ledger 2026 Scorecard
- CFEngine: Infrastructure Automation Ledger 2026 Scorecard
- Chef: Infrastructure Automation Ledger 2026 Scorecard
- Cinc: Infrastructure Automation Ledger 2026 Scorecard
- Crossplane: Infrastructure Automation Ledger 2026 Scorecard
- Digger: Infrastructure Automation Ledger 2026 Scorecard
- env zero: Infrastructure Automation Ledger 2026 Scorecard
- Foreman: Infrastructure Automation Ledger 2026 Scorecard
- Harness: Infrastructure Automation Ledger 2026 Scorecard
- Ironic: Infrastructure Automation Ledger 2026 Scorecard
- Juju: Infrastructure Automation Ledger 2026 Scorecard
- MAAS: Infrastructure Automation Ledger 2026 Scorecard
- Metal3: Infrastructure Automation Ledger 2026 Scorecard
- OpenTofu: Infrastructure Automation Ledger 2026 Scorecard
- OpenVox: Infrastructure Automation Ledger 2026 Scorecard
- Pulumi: Infrastructure Automation Ledger 2026 Scorecard
- Puppet: Infrastructure Automation Ledger 2026 Scorecard
- Salt: Infrastructure Automation Ledger 2026 Scorecard
- Satellite: Infrastructure Automation Ledger 2026 Scorecard
- Scalr: Infrastructure Automation Ledger 2026 Scorecard
- Semaphore: Infrastructure Automation Ledger 2026 Scorecard
- Spacelift: Infrastructure Automation Ledger 2026 Scorecard
- Terraform: Infrastructure Automation Ledger 2026 Scorecard
- Terragrunt: Infrastructure Automation Ledger 2026 Scorecard
- Tinkerbell: Infrastructure Automation Ledger 2026 Scorecard