CLOUDFORMATION Flashcards
Ref! vs GetAtt Function
Ref! references: To access Physical or Logical resource. eg, InstanceID.
while
GetAtt: To access attributes(certain elements )within a logical or physical resource. eg, Public IP, DNS name. Inner details
fn::Join vs Split
To concatenate two or more attributs. eg fn::join: [https://,instaceID,DNSname].
Split opposite of join.
Fn:GetAZ and Fn::Select
Fn::GetAZ is used for returns AZ List from a region.
Fn::Select[index] is used to pick/accept an object from the AZ list
eg,
**Deleted subnets from vpc invalidates an AZ from being returned. **
Fn::BAse64 vs Fn::Sub!
Fn::BAse64 accepts normal text and passes the converted Base64 encoded text.
Fn::Sub! allows replacement of variables
AWS::Region
AWS::Region will always resolve to the Particular Region the stack is being uploaded to
!FindInMap function
in the Below Map Block,
Mappings:
RegionMap:
us-east-1:
HVM64: “ami-Off8a91507f77f867”
HMG2: “ami-0a584ac55a7631c0c”
us-west-1:
HVM64: “ami-Obdb828fd58c52235”
HMG2: “ami-066ee5fd4a9ef77f1”
eu-west-1:
HVM64: “ami-047bb4163c506cd98”
HVMG2: “ami-31c2f645”
with the following function call:
!FindInMap [ “RegionMap”, !Ref ‘AWS::Region’,HVM64”]
- The “RegionMap” will return = call the Map Block
- The !Ref ‘AWS::Region will return = Current Region
- *'’HVM64’’ *will return the Value of the Key/Pair containing HVM64.
Fn::Mappings
Is used to draw a Lookup Table that can be referenced or called with the !FindInMap to return a value from the Lookup table
Fn:Outputs
in the below Block
Outputs:
WordpressURL:
Description: “Instance Web URL”
Value: !Join [ ‘’, [ ‘https: //’, !GetAtt. Instance.DNSName ]
The Above block will output the concatenated Value of https:// + the instance DNS Name
Note
Note that the GetAtt returns an attribute from a resource(Instance)
Note also that insamuch as the Outputs block is optional, the Description line is very important
Portable vs NonPortable
Non Portable: HardCoded resources that can not be replicated across AWS or another region.
eg a stack containing a hard coded S3 Bucket name, a template containing an AMI(which is region specific
Parameter Best Practices
- use as few as Possible Parameters
- Provide Default Values for Parameters
what would this do in a buckets resource block?‘AWS::S3::Bucket’
Cloudformation will create a bucket with a unique name for you
DependsOn
Without this specification, Cloudformation deploys resources in its most convenient order, which might simply be random.
With the DependsOn attribute, you can specify that the creation of a specific resource follows another. When you add a DependsOn attribute to a resource, that resource is created only after the creation of the resource specified in theDependsOn attribute.
the DependsOn atribute is used for resource creations that will malfunction if the order of creation is not explicitly defined. Eg, Userdata must not run until EC2 instance is fully up and running, deleting vpc before Elastic IP
This helps to implement orderliness in resource deployment to ensure dependencies are run exactly when they should.
Cfn-Signal
A tool Added to resource block as utility to an instance during bootstrapping. It supplies utility signals to the required service
Creation Policy
Creation Policy is a tool that adds signal requirements for a resource to be either deployed or rolled back. It integrates with Cfn-signal which is the supplier of the signal data to be used. It Basically handles the wait schedule before the next deployment, eg in an ASG; it can require 3 signals within 15mins before next instance is deployed. It depends on Cfn-signal for the alarm.
Wait condition
Is a dataflow resource that works like Creation Policy but as a resource on it’s own. This works with other services that are not EC2 instances. It waits for signals from various sources within a specified time-out.
Wait condition can receive data (JSON) from a process and forward it to appropriate process that are requesting. Other processes can request the Wait condition’s output via !GetAtt waitcondition.data. It’s output is a Pre-signed URL which is useable by any other application even a non- AWS application.
CLoudformation Stack
All resources within a Cloudformation stack share a single Lifecycle. Ie CRUD are all done at same time.
Cloudformation Stack Quota
Limit of 500 Resources per stack
CF Stack resources lifecycle
All resources within a stack shares the same Lifecycle
CF Resource sharing
CF stacks are Isolated. You can use the !Ref function to access other resources within the same stack, however you cannot access resources outside the stack.
Multi-Stack Architecture
- Nested Stacks
- Cross-Stack Referencing
Nested Stacks
You can only reference the output of a nested stack. You can not reference a logical resource of another stack
Nested Stcks referencing
You can only reference the output of another stack. You cannot reference logical resources from a nested stack
Handling dependencies in nested stacks
Dependencies are controlled with judicious use of Depends on, Wait conditions, or Cfn-signals tools and functions
Nested Stacks
Breaking down solutions into modular templates
CF rootstack
Any normal stack that controls/references other stacks.
Nested Stacks vs Cross-stack Reference
Nested Stack reuses the code of another stack. It creates fresh resources using the other nested stack as template.
Reference Stack references the Physical Resource of another stack, it builds on the Nested stack.
Nested Stacks use case
- To break Cloudformation stack quota constraints( 5 Nested Stacks can produce 2,500 Resources).
- If modular resources are needed
- 1 Template for several projects
- Speed and consistency of creating resources
- Maintaining Life-Cycle Link
- Testing
building a reference stack
Resource has to be exported in other to be available for referencing from other stacks. This is done using the output block.
Export name must be unique.
Fn::ImportValue
This is used to call on the outputName from another stack. Not the !Ref function.
The other stack Exports OutputName from its Exports Block for any Application or user to use
Deletion Policy
Defines how CFN should respond to a delete in a Logical resource.
It works only on Deletion Operation and not update or replacement operations.
Options
1. Delete
2. Retain
3. Snapshot: This option ensures a snapshot is taken before deletion of the resource’s volume (compatible resources; EBS, RDS, Dynamodb, Redshift
Elasticache.
Remember to clean up when necessary.
CFN Delete Operation behavoir
There are three ways a physical resource can be removed or replaced. Delete and replace operation can be in the following forms:
1. Stack Delete
2. Edit a logical resource in the template, it will wipe and recreate a fresh version of that Resource
3. Delete a logical Resource in a template
EC2 instance is not supported in delete policy, but EBS is
Cfn-Init (Cloudformation Init)
Cloudformation Native Configuration Management tool that works like Ec2 user data.
Configuration instructions are stored along with the resource it applies to.
Cloudformation Init vs EC2 user data
Cloudformation Init is declarative, it just states What it wants while user data is procedural, ie, it tells the instance how to run the configuration.
Cloudformation Init declares the state
It can be cross-platformed.
Cloudformation Init is Idempotent; It does not override an existing state
CFN Init Helper-Script Lifecycle
CFN Init Helper Script runs only once like userdata
Cfn diagnostics
EC2 Logs for diagnostics, most especial user data installations
/var/log
in this directory are log files
use
~ sudo cat var/log/FileName
Key files
- /cloud-init-output - General bootstrap logs.
- /cfn-init-cmd.log -Cloudformation deployment log
- /cfn-init.log - Cloudformation deployment log
**~sudo tail -f cfn-hup.log **monitors cfn init logs realtime
Cfn init during runtime
the use of cfn hup.
cfn-hup helper script is basically a daemon that detects changes in resource metadata and runs user-specified actions when a change is detected.
cfn hup checks for change in metadata of the instance and then rerun a given script if change is detected.
CFN Change Set
An object which intermediately represents the difference between the old and new templates.
CFN Events data
A JSON document sent by Cloudformation to resources such as Lambda and other non AWS resources, this document contains instructions on mainly the desired properties that is expected from the receiving resource. Then CFN receives back an OK message and registers the event as part of its Logical resource. Same is done during deletion, eg s3 buckets that wont allow deletion when not empty. This whole scenario is under Cloudformation Custom Resources
CFN Events Integration
A huge part of CFN events is possible thanks to LAmbda.
