INFRASTRUCTURE AS CODE (CLOUDFORMATION)

CloudFormation Physical & Logical Resources (7:30)

Alt text Physical Resource / Logical Resource - Template - Stack

Alt text CloudFormation - Architecture

Alt text CloudFormation - Stack Create/Update/Delete

[DEMO] Simple Non Portable Template - PART1 (10:28)

[DEMO] Simple Non Portable Template - PART2 (11:28)

CloudFormation Template and Pseudo Parameters (6:53)

Alt text Template/Pseudo Parameters - Overview

Alt text Template Parameters - Input for Cfn Template

Alt text Pseudo Parameters - Provided by AWS based on the Stack environment

mindmap
  Parameters used in Cfn Template
    Template **Parameter**
    _Pseudo_ Parameter
    _Public_ Parameter<br/>from AWS Systems Manager Parameter Store

what are the difference between _cfn - **pseudo parameters**_ and _aws systems manager - **public parameters**_

Cfn - Pseudo Parameters: Parameters predefined by AWS CloudFormation

e.g.
- AWS::AccountId
- AWS::Region
- AWS::StackId
- AWS::StackName
See Pseudo parameters reference - AWS CloudFormation
AWS Systems Manager Parameter Store - public parameters: Common artifacts published by some AWS services:

e.g.
- EC2: Information about AMIs:
  - ami-amazon-linux-latest
  - ami-windows-latest
- ECS: /aws/service/ecs/optimized-ami/amazon-linux-2/recommended
- EKS: /aws/service/eks/optimized-ami/1.14/amazon-linux-2/recommended
- AWS:
  - Services
  - Regions
  - Availability Zone
  - …
See
- Discovering public parameters in Parameter Store - AWS Systems Manager
- Reference existing resources and Systems Manager parameters with CloudFormation-supplied parameter types - AWS CloudFormation

CloudFormation Intrinsic Functions (14:28)

Alt text Cfn - Intrinsic Functions

Alt text Cfn Intrinsic Functions: Ref & Fn::GetAtt

Alt text Cfn Intrinsic Functions: Fn:GetAZs & Fn:Select

Alt text Cfn Intrinsic Functions: Fn:Join & Fn:Split

Alt text Cfn Intrinsic Functions: Fn:Base64 & Fn:Sub

Alt text Cfn Intrinsic Functions: Fn:Cidr

note

Function	YAML Syntax (Short form)	Example usage	Return
`Ref`	`!Ref logicalName`	`!Ref MyInstance`	`i-123456789`¹
`Fn::GetAtt`	`!GetAtt logicalNameOfResource.attributeName`	`!GetAtt MyInstance.PublicIp`	`ec2-1.2.3.4.compute-1.amazonaws.com`²
`Fn::GetAZs`	`!GetAZs region`	`!GetAZs ''`	`[ "us-east-1a", "us-east-1b", "us-east-1c" ]`³
`Fn::Select`	`!Select [ index, listOfObjects ]`	`!Select [ "0", [ "apples", "grapes", "oranges" ] ]`	`"apples"`⁴
		`!Select [ "0", !GetAZs '' ]`	`"us-east-1a"`
`Fn::Join`	`!Join [ delimiter, [ comma-delimited list of values ] ]`	`!Join [ ":", [ a, b, c ] ]`	`"a:b:c"`
`Fn::Split`	`!Split [ delimiter, source string ]`	`!Split [ ":" , "a:b:c" ]`	`[ a, b, c ]`
`Fn::Base64`	`!Base64 valueToEncode`	`!Base64 AWS CloudFormation`	`QVdTIENsb3VkRm9ybWF0aW9u`⁵
`Fn::Sub`	`!Sub String`	`!Sub "SSH security group for ${AWS::StackName}"`	`"SSH security group for STACK_NAME"`
`Fn::Cidr`	`!Cidr [ ipBlock, count, cidrBits ]`	`!Cidr [ "10.16.0.0/16", 16, 12 ]`	16 CIDRs with a subnet mask `/20`

note

Function		YAML Syntax
`Ref`	Short form	`!Ref logicalName`
	Full form	`Ref: logicalName`⁶

`Fn::GetAtt`	Short form	`!GetAtt logicalNameOfResource.attributeName`
	Full form	`Fn::GetAtt: [ logicalNameOfResource, attributeName ]`

`Fn::GetAZs`	Short form	`!GetAZs region`
	Full form	`Fn::GetAZs: region`

`Fn::Select`	Short form	`!Select [ index, listOfObjects ]`
	Full form	`Fn::Select: [ index, listOfObjects ]`

`Fn::Join`	Short form	`!Join [ delimiter, [ comma-delimited list of values ] ]`
	Full form	`Fn::Join: [ delimiter, [ comma-delimited list of values ] ]`

`Fn::Split`	Short form	`!Split [ delimiter, source string ]`
	Full form	`Fn::Split: [ delimiter, source string ]`

`Fn::Base64`	Short form	`!Base64 valueToEncode`
	Full form	`Fn::Base64: valueToEncode`
		`Fn::Base64:` `!Sub string`

`Fn::Sub`	Short form	`!Sub String`
	Full form	`Fn::Sub: String`

`Fn::Cidr`	Short form	`!Cidr [ ipBlock, count, cidrBits ]`
	Full form	`Fn::Cidr:` `- ipBlock` `- count` `- cidrBits`

how to remember full form and short form?

Full form : Fn::FunctionName:
Short form: ! FunctionName

See Intrinsic function reference - AWS CloudFormation

CloudFormation Mappings (4:30)

Alt text Cfn Mappings (Template): Mappings section

mappings and key level

The Mappings section can have multiple mappings.

Each mapping is a key of the Mappings section.
Each mapping can have 2 level of keys.

Alt text Cfn Mappings: Fn::FindInMap

findinmap syntax

Function		YAML Syntax
`Fn::FindInMap`	Short form	`!FindInMap [ MapName, TopLevelKey, SecondLevelKey ]`
	Long form	`Fn::FindInMap: [ MapName, TopLevelKey, SecondLevelKey ]`

CloudFormation Outputs (3:37)

Alt text Cfn Outputs (Template): Views in CLI/Console - Used by parent-stack, cross-stack

Alt text Cfn Outputs: Example

[DEMO] Template v2 - Portable (13:34)

CloudFormation Conditions (7:24)

Alt text Cfn Conditions (Template): Only create resources if conditions meet

how cfn condition work?

You

create a condition in the Conditions section
associate that condition to logical resources
- to control if they are created or not

why use cfn condition?

With Cfn Condition, you can reuse a template that can create resources in different contexts.

e.g. a test environment versus a production environment

Alt text Cfn Conditions: Example

CloudFormation DependsOn (7:14)

Alt text Cfn DependsOn (Resource): Explicitly define resources dependency order

Alt text Cfn DependsOn: Example

CloudFormation Wait Conditions, CreationPolicy & cfn-signal (11:52)

Alt text Cfn Provisioning - How do Cfn know that a resource successfully created/update?

note

By default, Cfn don’t wait for the resources to be configured/bootstrap and be ready to used.

👉 The stack creation/updating will be finished before all of its resources are ready to used.

Alt text Cfn Wait Conditions (Template): Tell Cfn to pause the creation of a stack and wait for a signal before it continues to create the stack

Alt text Cfn Creation Policy (Resource): Tell Cfn to wait on resource configuration actions before stack creation proceeds.

when to use wait conditions & create policy?

You

Create Policy for EC2 and ASG or simple use cases (most situations)
Wait Conditions in advance use cases.

Alt text cfn-signal: Signals CloudFormation to indicate whether Amazon EC2 instances have been successfully created/updated

CloudFormation Nested Stacks (13:55)

Alt text Single Stack - The Problem

Alt text Cfn Nested Stack: Stacks created as part of other stacks 👈️ Allow reusing template (code)

`nested stack`, `root stack`, `parent stack`?

Nested Stack: Stacks created as part of other stacks.
Root Stack: The top-level stack to which all the nested stacks ultimately belong.
Parent Stack: Each nested stack has an immediate parent stack.

Alt text Cfn Nested Stacks - When?

how are lifecycle of nested stacks?

The root stacks and all of its nested stacks share the same lifecycle.

CloudFormation Cross-Stack References (10:05)

Alt text Cfn Stacks are isolated and self-contained

Alt text Cfn Outputs Export: Make a stack visible to other stacks (Cross-Stack References)

Alt text Cfn Cross-Stack References - Fn::ImportValue: Import another stack’s Outputs Export

CloudFormation Deletion Policy (5:24)

Alt text Cfn DeletionPolicy - What happen to physical resource when its logical resource deleted?

Alt text Cfn DeletionPolicy - Delete (Default) / Retain / Snapshot (If supported)

CloudFormation Stack Sets (9:12)

Alt text Cfn StackSets - Concepts

Alt text Cfn StackSets - Architecture

Alt text Cfn StackSets - Key Points

CloudFormation Stack Roles (6:47)

Alt text Cfn Stack Roles - Overview

the identity creating the stack doesn't need permissions for resources.

It only needs permissions for:

creating the stack
PassRole to give Cfn the role with permissions for creating resources.

Alt text Cfn Stack Roles - Example

CloudFormation Init (cfn-init) (8:48)

Alt text cfn-init: Overview

aws::cloudformation::init vs cfn-init?

AWS::CloudFormation::Init: a part of the logical resource for EC2 (Metadata key)
cfn-init: a helper script in the Properties’s UserData, will run by the EC2 instance

Alt text cfn-init: config keys - configsets