AWS CloudFormation Templates

• Variables can be selected individually to avoid having to manually hard code them.
• All resources will need to be declared, whether they are an S3 bucket or an EC2 instance.  Each resource will have multiple properties tied to it, each of which can have subproperties related to it.
• Any output variables that need to be imported to other stacks will also need to be declared in the template.
• Not all variables need to be chosen in order to deploy.  Variables can be declared as needed.
• To avoid issues with regional-dependent variables, mapping will set conditions for selected variables that need to be in specific AWS Regions.
• To make establishing variables easier, AWS does have a complete library of variables and other references to help make compiling templates easier.
• Users can update the properties for resources in existing stacks. These changes can range from simple configuration changes, such as updating the alarm threshold on a CloudWatch alarm, to more complex changes, such as updating the Amazon Machine Image (AMI) running on an Amazon EC2 instance. Many of the AWS resources in a template can be updated, and we continue to add support for more.
• Conditions help to establish certain circumstances under which new AWS resources are procured.  For example, users might want to differentiate using a template for when they are deploying to a production environment or a test environment.
• Building on the declarative language of the template, the Transform section will declare any macros the template will be using.  These macros will then execute in the order they are specified, so be mindful of how they are listed.

Integrating Security Features

Images sourced from Amazon Web Services

Security is going to be another concern.  With AWS’s shared security responsibility policies, it’s down to the developers to specify which inbound or outbound content should be screened.  Along with making full use of AWS’s other security tools, how traffic going in or out will be scrutinized will need to be specified with the other variables.

• Under no circumstances should users have sensitive data in any of the variable categories, such as names.  Worse, embedding credentials into the templates by default.  If necessary, use a dynamic reference instead.
• By its default, CloudFormation will encrypt data at rest, while it’s in transit, and while it is within the environment network.  However, customers are still responsible for setting encryption and storage policies.
• There are options to validate templates before using them to ensure dependencies and syntax errors don’t occur before the template is used to create any AWS resources.

Conclusion

Templates are incredibly useful for setting up new AWS resources and environments with less effort on the developer’s part.  Setting up resources involves extensive variable configuration and setup before it can properly launch.  Better yet, templates can be repeatedly reused or shared within an organization with sufficient leeway in how those templates are utilized.

Related Articles