AWS CloudFormation allows users to model and provision AWS resources in an orderly and predictable manner. It provides templates written in JSON or YAML format that describe the collection of resources needed for applications. The template contains the Resources section which defines the specific AWS resources to be created. It can also include Parameters, Mappings, and Outputs. When a template is launched in AWS, it creates a stack - the collection of AWS resources deployed as a unit.

1. Mahesh TR
CloudFormation

2. Mahesh TR
AWS CloudFormation is a service that helps you model and set up your Amazon Web Services resources
so you can spend less time managing those resources, and more time focusing on your applications.
CloudFormation can:
✓ Simplify infrastructure management.
✓ Quickly replicate your infrastructure.
✓ Easily control and track changes to your infrastructure.
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html
CloudFormation

3. Mahesh TR
How it works ?

4. Mahesh TR
Organize by Layers and Environments
Frontend Services
Backend services
Common monitoring, Subnets and
SG
VPC, IGW, RT, NAT, VPN
IAM user, groups or roles
DEV Account QA Account Prod Account

5. Mahesh TR
CloudFormation
AWS CloudFormation gives developers and systems administrators an easy way to create and manage a
collection of related AWS resources, provision and update them in an orderly and predictable fashion
✓ Template
✓ is an architectural diagram
✓ a JSON or YAML-format, text-based file that describes all the AWS resources you need to deploy
to run your application
✓ Stack
✓ is the end result of that diagram, which is actually provisioned
✓ is the set of AWS resources that are created and managed as a single unit when CloudFormation
instantiates a template.

6. Mahesh TR
✓CloudFormation template can be used to set up the resources consistently and repeatedly over
and over across multiple regions
✓Resources can be updated, deleted and modified in a controlled and predictable way, in effect
applying version control to the infrastructure as done for software code
✓CloudFormation supports Chef & Puppet Integration, meaning that you can deploy and configure
right down the application layer
✓By default, automatic rollback on error feature is enabled, which will cause all the AWS resources
thatCloudFormation created successfully for a stack up to the point where an error occurred to be
deleted. However, charges would be applied for the resources the time they are up and running

7. Mahesh TR
Template Basics
✓ A CloudFormation template is a JSON-formatted (JavaScript Object Notation) text file that
describes your AWS infrastructure.
 Templates can include several major sections:
– AWSTemplateFormatVersion
– Description
– Parameters
– Mappings
– Conditions
– Resources
– Metadata and Userdata
– Outputs
✓ The Resources section is the only section that is actually required.
✓ The first character in the CloudFormation template must be an open brace ({), and the last character
must be a closed brace (}).

8. Mahesh TR
Template Basics
{
"AWSTempletFormatVersion" : "2010-09-09",
"Description" : “Test Demo Server"
"Parameters" : {......}
"Mappings" : {......}
"Resources" : {......}
"Outputs" : {......}
}
"Resources" : {
"Logical ID" : {
"Type" : "Resource type",
"Properties" : {
Set of properties
}
}
}
http://jsoneditoronline.org/

9. Mahesh TR
Resource Syntax
Resource type is defined as
AWS::AWS-PRODUCT-NAME::DATA-TYPE-NAME
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html
Example
✓AWS::S3::Bucket
✓AWS::EC2::Instance
✓AWS::EC2::Route
✓AWS::EC2::Subnet
✓AWS::EC2::VPC
✓AWS::EMR::Cluster
✓AWS::Lambda::Function
✓AWS::RDS::DBInstance
✓AWS::SNS::Topic
"Resources" : {
"Logical ID" : {
"Type" : "Resource type",
"Properties" : {
Set of properties
}
}
}
"Resources" : {
" S3bucketNew" : {
"Type" : "AWS::S3::Bucket"
}
}

10. Mahesh TR
Resource Syntax
{
"Resources" : {
" S3bucketNew" : {
"Type" : "AWS::S3::Bucket“
"Properties" : {
"AccessControl" : "PublicRead"
}
}
}
}
{
"Resources" : {
" S3bucketNew" : {
"Type" : "resource type“
"Properties" : {
"AccessControl" : “String”
}
}
}
}

11. Mahesh TR{
"AWSTempletFormatVersion" : "2010-09-09",
"Description" : "Test Demo Server"
"Resources" : {
"HelloBucket" : { ... },
"EC2Instance" : { ... },
"ElasticIP" : { ... },
"InstanceSecurityGroup" : { ... }
}
}
{ …..
"Resources" : {
"HelloBucket" : {
"Type" : "AWS::S3::Bucket“
"Properties" : {
"AccessControl" : "PublicRead"
}
}
}
}
"Resources" : {
"MyEC2Instance" : {
"Type" : "AWS::EC2::Instance",
"Properties" : {
"ImageId" : "ami-2f726546"
}
}
}
Bucket
Instance

12. Mahesh TR
Resource Syntax
Example
✓AWS::S3::Bucket
✓AWS::EC2::Instance
✓AWS::EC2::Route
✓AWS::EC2::Subnet
✓AWS::EC2::VPC
✓AWS::EMR::Cluster
✓AWS::Lambda::Function
✓AWS::RDS::DBInstance
✓AWS::SNS::Topic
"Resources" : {
"Logical ID" : {
"Type" : "Resource type",
"Properties" : {
Set of properties
}
}
}
"Resources" : {
"MyEC2Instance" : {
"Type" : "AWS::EC2::Instance",
"Properties" : {
"ImageId" : "ami-2f726546"
}
}
}
Resource type is defined as
AWS::AWS-PRODUCT-NAME::DATA-TYPE-NAME
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html

13. Mahesh TR
{
....
"Resources" : {
"EC2Instance" : {
"Type": "AWS::EC2::Instance",
"Properties" : { ... }
}
}
}
{ …….
“Resources”
"EC2Instance" : {
"Type": "AWS::EC2::Instance",
"Properties" : {
“ImageID”: “ami-bff43rcd”,
“InstanceType” : “t2.nano”,
"SecurityGroups": “sg-546hgul”
}
}
}

14. Mahesh TR

15. Mahesh TR
{ …….
“Resources”
"EC2Instance" : {
"Type": "AWS::EC2::Instance",
"Properties" : {
“ImageID”: “ami-bff43rcd”,
"SecurityGroup": “sg-546hgul”,
“InstanceType” : “t2.nano”
}
}
}
{
"Resources": {
"Ec2Instance": {
"Type": "AWS::EC2::Instance",
"Properties": {
“ImageID”: “ami-bff43rcd”,
“SecurityGroups": [{"Ref": "InstanceSecurityGroup"}],
“InstanceType” : “t2.nano”
}
},
"InstanceSecurityGroup": {
"Type": "AWS::EC2::SecurityGroup",
"Properties": {
"GroupDescription": "Enable SSH access via port 22",
"SecurityGroupIngress": [
{
"IpProtocol": "tcp",
"FromPort": "22",
"ToPort": "22",
"CidrIp": "0.0.0.0/0"
}
]
}
}
}
{
"AWSTempletFormatVersion" : "2010-09-09",
"Description" : "Test Demo Server"
"Resources" : {
"EC2Instance" : { ... },
“InstanceSecurityGroup" : { ... }
}
}
1
2

16. Mahesh TR"Resources" : {
"Logical ID" : {
"Type" : "Resource type",
"Properties" : {
Set of properties
}
}
}
✓ AWS::S3::Bucket
✓ AWS::EC2::Instance
✓ AWS::EC2::Route
✓ AWS::EC2::Subnet
✓ AWS::EC2::VPC
✓ AWS::EMR::Cluster
✓ AWS::Lambda::Function
✓ AWS::RDS::DBInstance
✓ AWS::SNS::Topic
{ …….
“Resources”
"EC2Instance" : {
"Type": "AWS::EC2::Instance",
"Properties" : {
“ImageID”: “ami-bff43rcd”,
"SecurityGroup": “sg-546hgul”,
“InstanceType” : “t2.nano”
}
}
}
Type
Property
"Resources": {
"Ec2Instance": {
"Type": "AWS::EC2::Instance",
"Properties": {
“SecurityGroups": [{"Ref": "InstanceSecurityGroup"}],
}
},
"InstanceSecurityGroup": {……..
}
}
Refer resource to resource

17. Mahesh TR
X AWSTemplateFormatVersion
X Description
– Parameters
– Mappings
X Resources --- Bucket and Instance creation
– Outputs

18. Mahesh TR

19. Mahesh TR
Parameter Syntax
"Parameters" : {
"ParameterLogicalID" : {
"Type" : "DataType",
"Parameter" : "value"
}
}
"Parameters" : {
"InstanceType" : {
"Type" : "String",
"Default" : "t2.micro",
"Description" : "Type of EC2 instance to launch"
}
}
Example

20. Mahesh TR
Parameter Syntax
"Parameters" : {
"InstanceType" : {
"Type" : "String",
"Default" : "t2.micro",
"Description" : "Type of EC2 instance to
launch"
}
}
"Parameters" : {
"InstanceType" : {
"Type" : "String",
"Default" : "t2.micro",
"AllowedValues" : ["t2.micro", "m1.small",
"m1.large"],
"Description" : "Type of EC2 instance to launch"
}
}

21. Mahesh TR
Parameter Syntax
"Parameters" : {
"InstanceType" : {
"Type" : "String",
"Default" : "t2.micro",
"AllowedValues" : ["t2.micro", "m1.small",
"m1.large"],
"Description" : "Type of EC2 instance to
launch"
}
}
"Parameters" : {
"KeyPairName": {
"Description" : "Name of an existing Amazon EC2 key pair",
"Type": "String",
},
"InstanceType": {
"Description" : "Amazon EC2 instance type",
"Type": "String",
}
}

22. Mahesh TR
Refer input parameter to Resources
"Parameters" : {
"KeyPairName": {
"Description" : "Name of an existing Amazon EC2 key pair",
"Type": "String",
},
"InstanceType": {
"Description" : "Amazon EC2 instance type",
"Type": "String",
}
}
"Resources" : {
"EC2Instance" : {
"Type" : "AWS::EC2::Instance",
"Properties" : {
"InstanceType" : { "Ref" : "InstanceType" },
"ImageId" : { "Ref" : "AMIImageId" },
"KeyName" : { "Ref" : "KeyName" }
}
}
}

23. Mahesh TR

24. Mahesh TR

25. Mahesh TR

26. Mahesh TR
X AWSTemplateFormatVersion
X Description
X Parameters – keypair, instance type, etc ..
– Mappings
X Resources -- Bucket and Instance creation
– Outputs

27. Mahesh TR

28. Mahesh TR
Output Syntax
"Outputs" : {
"Logical ID" : {
"Description" : "Information about the value",
"Value" : "Value to return",
}
}
"Outputs" : {
"InstanceID" : {
"Description": "The Instance ID",
"Value" : { "Ref" : "EC2Instance" }
}
}
Example

29. Mahesh TR

30. Mahesh TR
X AWSTemplateFormatVersion
X Description
X Parameters-- keypair, instance type, etc ..
– Mappings
X Resources -- Bucket and Instance creation
X Outputs -- InstanceID, PublicDNS and Public IP etc…

31. Mahesh TR

32. Mahesh TR
Mapping Syntax
"Mappings" : {
"Mapping01" : {
"Key01" : { "Name" : "Value01"},
"Key02" : { "Name" : "Value02"},
"Key03" : { "Name" : "Value03"}
}
}
Example
"Mappings" : {
"RegionMap" : {
"us-east-1" : { "32" : "ami-6411e20d"},
"us-west-1" : { "32" : "ami-c9c7978c"},
"eu-west-1" : { "32" : "ami-37c2f643"},
"ap-southeast-1" : { "32" : "ami-66f28c34"},
"ap-northeast-1" : { "32" : "ami-9c03a89d"}
}
}
Basic Mapping

33. Mahesh TR
Mapping Syntax
"Mappings" : {
"RegionMap" : {
"us-east-1" : { "32" : "ami-6411e20d"},
"us-west-1" : { "32" : "ami-c9c7978c"},
"eu-west-1" : { "32" : "ami-37c2f643"},
"ap-southeast-1" : { "32" : "ami-66f28c34"},
"ap-northeast-1" : { "32" : "ami-9c03a89d"}
}
}
"RegionMap" : {
"us-east-1" : { "32" : "ami-6411e20d", "64" : "ami-7a11e213" },
"us-west-1" : { "32" : "ami-c9c7978c", "64" : "ami-cfc7978a" },
"eu-west-1" : { "32" : "ami-37c2f643", "64" : "ami-31c2f645" },
"ap-southeast-1" : { "32" : "ami-66f28c34", "64" : "ami-60f28c32" },
"ap-northeast-1" : { "32" : "ami-9c03a89d", "64" : "ami-a003a8a1" }
}
Mapping with Multiple Values
Basic Mapping

34. Mahesh TR{
"AWSTemplateFormatVersion" : "2010-09-09",
"Mappings" : {
"RegionMap" : {
"us-east-1" : { "32" : "ami-6411e20d", "64" : "ami-7a11e213" },
"us-west-1" : { "32" : "ami-c9c7978c", "64" : "ami-cfc7978a" },
"eu-west-1" : { "32" : "ami-37c2f643", "64" : "ami-31c2f645" }
}
},
"Resources" : {
"myEC2Instance" : {
"Type" : "AWS::EC2::Instance",
"Properties" : {
"ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "32"]},
"InstanceType" : "m1.small"
}
}
}
}
Return a Value from a Mapping
{ "Fn::FindInMap" : [ "MapName", "TopLevelKey", "SecondLevelKey"] }

35. Mahesh TR{
"Parameters" : {
"EnvironmentType": {
"Description": "The environment type",
"Type": "String",
"Default": "test",
"AllowedValues": ["prod", "test"],
"ConstraintDescription": "must be a prod or test"
}
},
"Mappings" : {
"RegionAndInstanceTypeToAMIID" : {
"us-east-1": {
"test": "ami-8ff710e2", "prod": "ami-f5f41398"},
"us-west-2" : {
"test" : "ami-eff1028f", "prod" : "ami-d0f506b0"},
...other regions and AMI IDs...
}
},
"Resources" : {
...other resources...
}

36. Mahesh TR
X AWSTemplateFormatVersion
X Description
X Parameters-- keypair, instance type, etc ..
X Mappings – selecting AMIs is multiple reagion
X Resources -- Bucket and Instance creation
Metadata and Userdata
X Outputs -- InstanceID, PublicDNS and Public IP etc…

37. Mahesh TR
UserData/Metadata
How to use Metadata ?
• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide
/aws-resource-init.html#aws-resource-init-configsets
Example
• https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide
/deploying.applications.html

38. Mahesh TR
Public Subnet
192.168.1.20/32
SG NACL
webserversSG
webserver
Port Source
22 12.32.54.85/32
80 0.0.0.0/0
CIDR : 192.168.1.0/24
CIDR : 192.168.0.0/16 12.32.54.85/32
2280
Destination Target
192.168.0.0/16 Local
0.0.0.0/0 IGW
Private Subnet CIDR : 192.168.2.0/24
SGNACL
AppserversSG
Port Source
22 192.168.1.20/32
Destination Target
192.168.0.0/16 Local
0.0.0.0/0 NAT ID
Appservers
Route Table 1
Route Table 2
192.168.1.40/32
SG
NatSG
Natserver
Port Source
All Traffic 192.168.2.30/32
192.168.2.30/32

39. Mahesh TR
DEV Account QA Account

40. Mahesh TR