This document provides an overview and best practices for using AWS CloudFormation. It discusses what CloudFormation is, why it is useful for implementing infrastructure as code, and the key components of CloudFormation templates like parameters, mappings, resources and outputs. It also covers best practices for planning templates, creating templates, and managing CloudFormation stacks.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS CloudFormation Best Practices

2. Who is Jeff Levine?
• Enterprise Solution Architect based in So. Cal.
• With AWS since January 2016
• Work with customers in
• Healthcare
• Finance
• Technology

3. Agenda
• What is AWS CloudFormation?
• Why AWS CloudFormation?
• Template structure (high but not deep)
• Best Practices

4. What is AWS CloudFormation?
• AWS CloudFormation gives developers and systems
administrators an easy way to use templates to create
and manage a collection of related AWS resources,
provisioning and updating them in an orderly and
predictable fashion.
• CloudFormation templates can be written in YAML or
JSON.

5. Why AWS CloudFormation?
• AWS CloudFormation enables you to implement
Infrastructure as Code.
• Similar to how we compile source code to get object
code, we use AWS CloudFormation to process
infrastructure templates and produce infrastructure.
• Templates can be version-controlled like source code.
• Can be incorporated into CI/CD pipelines.
• Everything is software!

6. CloudFormation Anatomy

7. Template Anatomy
---
AWSTemplateFormatVersion: "version date"
Description:
String
Metadata:
template metadata
Parameters:
set of parameters
Mappings:
set of mappings
Conditions:
set of conditions
Transform:
set of transforms
Resources:
set of resources
Outputs:
set of outputs

8. CloudFormation Parameters

9. Parameters
• Allow you to solicit values from user at runtime
• Options
• Arbitrary string values
• Data type (string, number, lists)
• Pattern matching
• Minimum and maximum lengths
• Echo suppression
• AWS Specific Parameters
• Subnets, VPCs, KeyPairs, AZs, etc.

10. Parameters - Examples
Parameters:
DBPort:
Default: 3306
Description: “Database TCP Port”
Type: Number
MinValue: 1150
MaxValue: 65535
myKeyPair:
Description: “Amazon EC2 Key Pair”
Type: "AWS::EC2::KeyPair::KeyName"

11. CloudFormation Mappings

12. Mappings – Create Key / Value Lookup Sets
ImageId:
!FindInMap [
RegionMap,
!Ref 'AWS::Region',
AmazonLinux]
Mappings:
RegionMap:
ap-northeast-1: # Tokyo
AmazonLinux: ami-bbf2f9dc
ap-northeast-2: # Seoul
AmazonLinux: ami-9bab74f5
ap-southeast-1: # Singapore
AmazonLinux: ami-58d65b3b
…

13. CloudFormation Resources

14. Resources – Create AWS Resources
Examples of resources:
• Subnets
• VPCs
• EC2 Instances
• Route tables
• Static routes
• ….
CloudFormation automatically
provisions and deprovisions
resources in the correct
order…most of the time.
(Sometimes a “DependsOn”
key is needed.)

15. Resources – Example
Resources:
MyVPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: 10.200.0.0/16
EnableDnsSupport: 'true'
EnableDnsHostnames: 'true'

16. You may need more resources than you think!
What resources do you need to create a VPC with an internet-facing
web server?
• Vpc
• Subnet
• InternetGateway
• VpcGatewayAttachment
• RouteTable
• Route
• InstanceRole
• InstanceProfile
• Security Group
• EC2 Instance

17. CloudFormation Stack Resources
Consider the following scenario:
Suppose you want to create several web environments each of which
Apache server that has a very complex, but identical configuration.
You could create a CloudFormation template for each environment
that includes all of the lines needed to create the Apache server.
Or….

18. CloudFormation Nested Stack Resources
You can use nested stacks!
Resources:
ApacheServer:
Type: "AWS::CloudFormation::Stack"
TemplateURL: "https://s3.amazonaws.com/Apache..."
TimeoutInMinutes: 10

19. CloudFormation Nested Stack Resources
• Nested stacks create an parent/child stack relationship.
• Each time the parent template is invoked, a child stack is also
created.
• A child stack only has one parent.
• Allows you to re-use templates.
• You can create a library of templates that are used across your
enterprise.

20. CloudFormation Outputs

21. Outputs
Allow you to:
• Declare values that can be displayed on the console or
be retrieved through “describe stack” API calls.
• Optionally export a value that can be imported by other
CloudFormation Stacks as cross-stack references.

22. Cross-Stack References
Stack 1 exports the value:
Outputs:
TSSG:
Value: !Ref TroubleShootingSG
Export:
Name: AccountSG
Stack 2 imports the value:
EC2Instance:
Type: AWS::EC2::Instance
Properties:
SecurityGroups:
- !ImportValue AccountSG
Cross-stack references
allow for one resource to
be shared across
multiple stacks.

23. CloudFormation Best Practices
Planning and Organizing

24. Organize Your Stacks by Lifecycle and Ownership
• Many people start out with one stack.
• As your stack grows in scale and broadens in scope, managing a single
stack can be cumbersome and time consuming.
• Grouping resources with common lifecycles and ownership lets owners
can make changes to their set of resources by using their own process
and schedule without affecting other resources.
• Practice lends itself to service-oriented architectures.

25. Use Nested Stacks to Replicate Resources in Environments
• After you have your stacks and resources set up, you can reuse your
templates to replicate your infrastructure in multiple environments. For
example, you may use a child template to create an Amazon Linux
instance and then call that multiple times within a parent
CloudFormation template that creates a VPC.
• Use the parameters, mappings, and conditions sections so that you can
customize your stacks when you create them. For example, for your
development environments, you can specify a lower-cost instance type
compared to your production environment.

26. Use Cross-Stack Resources to Export Shared Resources
• When you organize your AWS resources based on lifecycle and
ownership, you might want to build a stack that uses resources that are
in another stack.
• Use cross-stack references to export resources from a stack so that
other stacks can use them. Stacks can use the exported resources by
calling them using the Fn::ImportValue function.

27. Use IAM to Restrict CloudFormation’s Privileges
• CloudFormation normally works with the IAM permissions of the user
who invokes it.
• You can create a service role for CloudFormation if you want it to run
with a more limited set of capabilities.

28. Verify Resource Limits
• Resources often have limits associated with them.
• Limits are there to protect you!
• CloudFormation will by default rollback an entire stack if it is unable to
create a resource.
• Use Trusted Advisor to monitor common limits.
• Request limit increases from AWS Support as appropriate.

29. CloudFormation Best Practices
Creating Templates

30. Do Not Embed Credentials in Templates
• Do not embed sensitive information in your AWS CloudFormation
templates.
• Use input parameters to pass in information whenever you create or
update a stack.
• Use the NoEcho property to obfuscate the parameter value.

31. Use AWS-Specific Parameter Types
• If your template requires inputs for existing AWS-specific values, such as
existing Amazon Virtual Private Cloud IDs or an Amazon EC2 key pair
name, use AWS-specific parameter types.
• If you use the AWS CloudFormation console, AWS CloudFormation
shows a drop-down list of valid values, so you don't have to look up or
memorize the correct VPC IDs or key pair names.

32. Use Parameter Constraints
• With constraints, you can describe allowed input values so that AWS
CloudFormation catches any invalid values before creating a stack.
• For example, you can set constraints on a database user name value so
that it must be a minimum length of eight character and contain only
alpha-numeric characters.

33. Use AWS::CloudFormation:Init to Configure EC2 Instances
• When you launch stacks, you can install and configure software
applications on Amazon EC2 instances by using the cfn-init helper script
and the AWS::CloudFormation::Init resource.
• By using AWS::CloudFormation::Init, you can describe the
configurations that you want rather than having someone manual
procedural steps.

34. Use the Latest Helper Scripts
• The helper scripts are updated periodically.
• Include the following command in the UserData property of your
template before you call the helper scripts to ensure that your launched
instances get the latest helper scripts (Amazon Linux version):
yum install -y aws-cfn-bootstrap

35. Validate Templates Before Using Them
• Before you use a template to create or update a stack, you can use
AWS CloudFormation to validate it. Validating a template can help you
catch syntax and some semantic errors, such as circular dependencies,
before AWS CloudFormation creates any resources.
• The AWS CloudFormation console, the console automatically validates
the template after you specify input parameters.
• For the AWS CLI or AWS CloudFormation API, use the aws
cloudformation validate-template command or ValidateTemplate action.

36. CloudFormation Best Practices
Managing Stacks

37. Manage All Stack Resources Through CloudFormation
• After you launch a stack, use the AWS CloudFormation console, API, or
AWS CLI to update resources in your stack.
• Do not make changes to stack resources outside of AWS
CloudFormation. Doing so can create a mismatch between your stack's
template and the current state of your stack resources, which can cause
errors if you update or delete the stack.
• Follow principle of Immutable Architectures when possible.
• Avoid configuration drift.

38. Create Change Sets Before Performing Updates
• Change sets allow you to see how proposed changes to a stack might
impact your running resources before you implement them. AWS
CloudFormation doesn't make any changes to your stack until you
execute the change set, allowing you to decide whether to proceed with
your proposed changes or create another change set.
• For example, if you change the name of an Amazon RDS database
instance, AWS CloudFormation will create a new database and delete
the old one. If you generate a change set, you will see that your change
will replace your database.

39. Use Stack Policies
• When you create a stack, all update actions are allowed on all
resources. By default, anyone with stack update permissions can update
all of the resources in the stack.
• A stack policy is a JSON document that defines the update actions that
can be performed on designated resources.
• Use a stack policy only as a fail-safe mechanism to prevent accidental
updates to specific stack resources. To control access to AWS resources
or actions, use IAM.

40. Use CloudTrail to Log CloudFormation Calls
• AWS CloudTrail tracks anyone making AWS CloudFormation API calls in
your AWS account. API calls are logged whenever anyone uses the
AWS CloudFormation API, the AWS CloudFormation console, a back-
end console, or AWS CloudFormation AWS CLI commands.
• You can then audit who made what AWS CloudFormation call in your
account.

41. Perform Code Review of CloudFormation Templates
• Your stack templates describe the configuration of your AWS resources,
such as their property values. To review changes and to keep an
accurate history of your resources, use code reviews and revision
controls.
• Treat your CloudFormation templates as source code!
• Infrastructure as Code!

42. Regularly Update EC2 Images Post Creation
• On all your Amazon EC2 Linux instances and Amazon EC2 Linux
instances created with AWS CloudFormation, regularly run the
command:
yum update
• This ensures that you get the latest fixes and security updates.

43. Helpful Resources
AWS CloudFormation Documentation
https://aws.amazon.com/documentation/cloudformation/
AWS CloudFormation Sample Templates
https://aws.amazon.com/cloudformation/aws-cloudformation-templates/

44. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Demo!

45. Demo – Nested Stacks and Cross-Stack References
CFDemoVPC.yaml
Exported:
VpcId
AzName
SubnetId
SecurityGroup Id
CFDemoEC2.yaml
AmazonLinux01
(nested)
CFDemoEC2.yaml
AmazonLinux02
(nested)
CFDemoMain.yaml
Import

46. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!