[dragonwriter]

> Cloudformation is the best tool for aws infra-as-a-code.

Talk about damning with faint praise.

> It rolls back,

Sometimes.

> no leftovers on delete,

Well, on successful delete, maybe. DELETE_FAILED with partial stack deletion is a thing (and a thing CF could fairly trivially avoid in some common cases by simply querying resources for deletion protection.)

> full control of resource properties

Except the AWS resources it doesn't support, and properties of supported resources it doesn't support, because CF always lags the underlying services and their APIs.