CloudFormation Templates and Stacks

What it is

AWS CloudFormation lets you describe infrastructure in a text template, written in JSON or YAML, and then creates the resources for you. The set of resources built from one template is called a stack.

This is infrastructure as code (IaC). It makes environments repeatable, reviewable in version control, and easy to delete, because removing the stack removes its resources.

How it works

Template sections

Only the Resources section is required. The others make the template reusable and clear.

A short example:

Parameters:
  InstanceType:
    Type: String
    Default: t3.micro
Resources:
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: "{{resolve:ssm:/golden/web/ami}}"
Outputs:
  WebId:
    Value: !Ref WebServer

Intrinsic functions

Intrinsic functions compute values inside the template.

• Ref returns a parameter value or the ID of a resource.
• Fn::GetAtt returns an attribute, such as a bucket ARN (Amazon Resource Name).
• Fn::Sub fills variables into a string.
• Fn::FindInMap reads a mapping, and Fn::If reads a condition.
• Fn::ImportValue reads an output exported by another stack.

Pseudo parameters such as AWS::Region, AWS::AccountId and AWS::StackName are filled in by CloudFormation. A parameter of the SSM type, or a dynamic reference like the one in the example, reads a value from Systems Manager Parameter Store.

Ordering and dependencies

CloudFormation works out the order from references. When there is no reference, you can add DependsOn to force one resource to wait for another.

Splitting large designs

• Nested stacks make a stack a resource inside a parent stack, which helps with reuse of common parts.
• Cross stack references export an output in one stack and import it in another. A stack cannot be deleted while another stack imports its export.

Waiting for software

CloudFormation reports an EC2 resource as created once the instance is launched, not when the software on it is ready. To wait for a real signal, use a CreationPolicy on the resource, and have the instance run cfn-signal at the end of its setup. The helper script cfn-init reads the metadata of the resource to install packages and write files.

If the signal does not arrive before the timeout, the resource fails and the stack rolls back.

Deploying from the CLI

# AWS CLI
aws cloudformation validate-template --template-body file://web.yaml
aws cloudformation deploy --template-file web.yaml \
  --stack-name web-stack \
  --parameter-overrides InstanceType=t3.small \
  --capabilities CAPABILITY_IAM

The deploy command creates the stack or updates it through a change set. A template that creates IAM resources needs an acknowledgement through --capabilities, such as CAPABILITY_IAM, or CAPABILITY_NAMED_IAM when the IAM resources have custom names.