Mastering AWS CloudFormation

Plan, develop, and deploy your cloud infrastructure effectively using AWS CloudFormation

Karen Tovmasyan

• Publisher: Packt Publishing
• Year: 2020
• ISBN:
  9781789135312
• Topic: Computer Science
• Subtopic: Software Development
• Index: Computer Science

Build scalable and production-ready infrastructure in Amazon Web Services with CloudFormation

Key Features

• Leverage AWS CloudFormation templates to manage your entire infrastructure
• Get up and running with writing your infrastructure as code and automating your environment
• Simplify infrastructure management and increase productivity with AWS CloudFormation

Book Description

DevOps and the cloud revolution have forced software engineers and operations teams to rethink how to manage infrastructures. With this AWS book, you'll understand how you can use Infrastructure as Code (IaC) to simplify IT operations and manage the modern cloud infrastructure effectively with AWS CloudFormation.This comprehensive guide will help you explore AWS CloudFormation from template structures through to developing complex and reusable infrastructure stacks. You'll then delve into validating templates, deploying stacks, and handling deployment failures. The book will also show you how to leverage AWS CodeBuild and CodePipeline to automate resource delivery and apply continuous integration and continuous delivery (CI/CD) practices to the stack. As you advance, you'll learn how to generate templates on the fly using macros and create resources outside AWS with custom resources. Finally, you'll improve the way you manage the modern cloud in AWS by extending CloudFormation using AWS serverless application model (SAM) and AWS cloud development kit (CDK).By the end of this book, you'll have mastered all the major AWS CloudFormation concepts and be able to simplify infrastructure management.

What you will learn

• Understand modern approaches to IaC
• Develop universal and reusable CloudFormation templates
• Discover ways to apply continuous delivery with CloudFormation
• Implement IaC best practices for the AWS Cloud
• Provision massive applications across multiple regions and accounts
• Automate template generation and software provisioning for AWS
• Extend CloudFormation with custom resources and template macros

Who this book is for

If you are a developer who wants to learn how to write templates, a DevOps engineer interested in deployment and orchestration, or a solutions architect looking to understand the benefits of managing infrastructure with ease, this book is for you. Prior understanding of the AWS Cloud is necessary.

]]>

Section 1: CloudFormation Internals

In our first section, we will do a small refresher on CloudFormation. Later, we will dive deep into its core component – a template – and learn how to write universal, redundant, and reusable templates.

This section comprises the following chapters:

• Chapter 1, CloudFormation Refresher
• Chapter 2, Advanced Template Development

Chapter 1

CloudFormation Refresher

Cloud computing introduced a brand-new way of managing the infrastructure.

As the demand for the AWS cloud grew, the usual routine and operational tasks became troublesome. The AWS cloud allowed any type of business to rapidly grow and solve all the business needs regarding compute power; however, the need to maintain a certain stack of resources was hard.

DevOps culture brought a set of methodologies and ways of working, and one of those is called infrastructure as code. This process is about treating your infrastructure—network, virtual machines, storages, databases, and so on—as a computer program.

AWS CloudFormation was developed to solve this kind of problem.

You will already have some working knowledge of CloudFormation, but before we dive deep into learning advanced template development and how to provision at scale, use CloudFormation with CI/CD pipelines, and extend its features, let's quickly refresh our memory and look again at what CloudFormation is and how we use it.

In this chapter, we will learn the following:

• The internals of AWS CloudFormation
• Creating and updating a CloudFormation stack
• Managing permissions for CloudFormation
• Detecting unmanaged changes in our stack

Technical requirements

The code used in this chapter can be found in the book's GitHub repository at https://github.com/PacktPublishing/Mastering-AWS-CloudFormation/tree/master/Chapter1.

Check out the following video to see the Code in Action:

https://bit.ly/2WbU5Lh

Understanding the internals of AWS CloudFormation

AWS services consist of three parts:

• API
• Backend
• Storage

We interact with AWS by making calls to its API services. If we want to create an EC2 instance, then we need to perform a call, ec2:RunInstances.

When we develop our template and create a stack, we invoke the cloudformation:CreateStack API method. AWS CloudFormation will receive the command along with the template, validate it, and start creating resources, making API calls to various AWS services, depending on what we have declared for it.

If the creation of any resource fails, then CloudFormation will roll back the changes and delete the resources that were created before the failure. But if there are no mistakes during the creation process, we will see our resources provisioned across the account.

If we want to make changes to our stack, then all we need to do is update the template file and invoke the cloudformation:UpdateStack API method. CloudFormation will then update only those resources that have been changed. If the update process fails, then CloudFormation will roll the changes back and return the stack to the previous, healthy, state.

Now that we have this covered, let's start creating our stack.

Creating your first stack

I'm sure you've done this before.

We begin by developing our template first. This is going to be a simple S3 bucket. I'm going to use YAML template formatting, but you may use JSON formatting if you wish:

MyBucket.yaml

AWSTemplateFormatVersion: "2010-09-09"

Description: This is my first bucket

Resources:

MyBucket:

Type: AWS::S3::Bucket

Now we just need to create the stack with awscli:

$ aws cloudformation create-stack \

--stack-name mybucket\

--template-body file://MyBucket.yaml

After a while, we will see our bucket created if we go to the AWS console or run aws s3 ls.

Now let's add some public access to our bucket:

MyBucket.yaml

AWSTemplateFormatVersion: "2010-09-09"

Description: This is my first bucket

Resources:

MyBucket:

Type: AWS::S3::Bucket

Properties:

AccessControl: PublicRead

Let's run the update operation:

$ aws cloudformation update-stack \

--stack-name mybucket \

--template-body file://MyBucket.yaml

To clean up your workspace, simply delete your stack using the following command:

$ aws cloudformation delete-stack --stack-name mybucket

Let's now look at the CloudFormation IAM permissions.

Understanding CloudFormation IAM permissions

We already know that CloudFormation performs API calls when we create or update the stack. Now the question is, does CloudFormation have the same powers as a root user?

When you work with production-grade AWS accounts, you need to control access to your environment for both humans (yourself and your coworkers) and machines (build systems, AWS resources, and so on). That is why controlling access for CloudFormation is important.

By default, when the user runs stack creation, they invoke the API method cloudformation:CreateStack. CloudFormation will use that user's access to invoke other API ...