CloudFormation: infrastructure as code

Sign in and load saat-vpc:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json

1Write and validate the template

Paste this whole block. It saves the template and asks CloudFormation to check it:

@'
AWSTemplateFormatVersion: '2010-09-09'
Description: SaatVedha lesson 34 demo stack
Parameters:
  VpcId:
    Type: AWS::EC2::VPC::Id
  Env:
    Type: String
    AllowedValues: [dev, prod]
    Default: dev
  RetentionDays:
    Type: Number
    Default: 30
Resources:
  LogBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: expire-logs
            Status: Enabled
            ExpirationInDays: !Ref RetentionDays
      Tags:
        - Key: course
          Value: saatvedha-aws
  WebSg:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub saat-cfn-${Env}-web-sg
      GroupDescription: Web tier for the demo stack
      VpcId: !Ref VpcId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: course
          Value: saatvedha-aws
  BucketParam:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub /saat/${Env}/log-bucket
      Type: String
      Value: !Ref LogBucket
Outputs:
  LogBucketName:
    Value: !Ref LogBucket
  WebSgId:
    Value: !GetAtt WebSg.GroupId
'@ | Set-Content saat-cfn-demo.yaml
aws cloudformation validate-template --template-body file://saat-cfn-demo.yaml --query "Parameters[].[ParameterKey,DefaultValue]" --output text

You should see something like this:

VpcId   None
Env     dev
RetentionDays   30

validate-template checks the YAML and structure, not whether every property is right. Property checks happen when you deploy, before anything is created.

2Deploy the stack

Paste this whole block (about two minutes):

aws cloudformation deploy --template-file saat-cfn-demo.yaml --stack-name saat-cfn-demo --parameter-overrides VpcId=$($v.VpcId) Env=dev --tags course=saatvedha-aws lesson=34
aws cloudformation describe-stacks --stack-name saat-cfn-demo --query "Stacks[0].Outputs[].[OutputKey,OutputValue]" --output text
aws ssm get-parameter --name /saat/dev/log-bucket --query Parameter.Value --output text

You should see something like this:

Waiting for changeset to be created..
Waiting for stack create/update to complete
Successfully created/updated stack - saat-cfn-demo
LogBucketName   saat-cfn-demo-logbucket-1a2b3c4d5e6f
WebSgId         sg-0a9b8c7d6e5f43211
saat-cfn-demo-logbucket-1a2b3c4d5e6f

Three resources, created in the right order: the parameter needed the bucket’s name, so CloudFormation made the bucket first. Run the same deploy again and it says there’s nothing to change, which is exactly what you want from infrastructure code.

3Change it through a change set

Add an HTTP rule to the template, raise retention to 60 days, and review before running:

(Get-Content saat-cfn-demo.yaml -Raw) -replace '          CidrIp: 0.0.0.0/0', "          CidrIp: 0.0.0.0/0`n        - IpProtocol: tcp`n          FromPort: 80`n          ToPort: 80`n          CidrIp: 0.0.0.0/0" | Set-Content saat-cfn-demo.yaml
aws cloudformation create-change-set --stack-name saat-cfn-demo --change-set-name raise-retention --template-body file://saat-cfn-demo.yaml --parameters ParameterKey=VpcId,UsePreviousValue=true ParameterKey=Env,UsePreviousValue=true ParameterKey=RetentionDays,ParameterValue=60 | Out-Null
aws cloudformation wait change-set-create-complete --stack-name saat-cfn-demo --change-set-name raise-retention
aws cloudformation describe-change-set --stack-name saat-cfn-demo --change-set-name raise-retention --query "Changes[].ResourceChange.[Action,LogicalResourceId,Replacement]" --output text

You should see this:

Modify  LogBucket       False
Modify  WebSg           False

Two in-place changes, no replacement, and the parameter isn’t listed because its value didn’t change. This is the screen a reviewer approves. Now run it:

aws cloudformation execute-change-set --stack-name saat-cfn-demo --change-set-name raise-retention
aws cloudformation wait stack-update-complete --stack-name saat-cfn-demo
aws cloudformation describe-stacks --stack-name saat-cfn-demo --query "Stacks[0].StackStatus" --output text

You should see this:

UPDATE_COMPLETE

4Protect the stack

Turn on termination protection, as you would for any production stack:

aws cloudformation update-termination-protection --stack-name saat-cfn-demo --enable-termination-protection | Out-Null
aws cloudformation describe-stacks --stack-name saat-cfn-demo --query "Stacks[0].EnableTerminationProtection"

You should see this:

true

Now a careless delete-stack is refused until someone deliberately turns protection off. You can see every event of this stack under CloudFormation in the console.

✅ Checkpoint: saat-cfn-demo is UPDATE_COMPLETE with an HTTPS and an HTTP rule, 60-day retention and termination protection, and you reviewed the change set before running it. Keep the stack for the break lab.