CloudFormation Stack Attack

Search for a command to run...

No comments yet. Be the first to comment.
Why Least Privilege Security Engineering Is Frequently Skipped or Done Loosely In a previous life, I was on a team that reviewed the IAM policies specified by developers when they created new Cloud applications or required additional permissions for ...

Obscuring sensitive information like AWS account IDs in screenshots and videos is tedious and error-prone. Even with video editing tools that simplify the process, I still have to repeatedly add and remove blurring boxes as the view changes. You know...

AWS CloudShell joins the ranks of hostless shells for operating in your cloud environment. Cloud shells are a huge help to training and enablement scenarios because they remove the pain of fussy configuration of a user-owned endpoint - which can have...

This article is the third and final of a series. Part 1 justified that human-performed DevOps checklists are essentially source code, and according to GitOps principles, belong in Git just like any other code required for successfully managing a soft...

There are always those who feel checklists are an unnecessary waste of time because they think they can always remember the basics of the steps involved to complete a task. Many are also not aware of the huge, cross-discipline benefits that can come ...

I’ve been studying for the AWS Certified DevOps Engineer exam and CloudFormation is a big topic.
Understanding the more complex ways to configure interrelated stacks is a must know for this exam.
I like to learn by doing and I started to wonder if I could create a minimalist set of CloudFormation templates that could demonstrate all the ways of inter relating stacks.
This post is the result of that effort.
I find it very helpful to enumerate architecture heuristics of a pattern as it helps with:
keeping track of the architecture that emerged from the ‘design by building’ effort.
my own recollection of the value of a pattern when examining past things I’ve done for a new solution.
others quickly understanding the all the points of value of an offered solution - helping guide whether they want to invest in learning how it works.
facilitating customization or refactoring of the code by distinguishing purpose designed elements versus incidental elements.
I specifically like the model of using Constraints, Requirements, Desirements, Serendipities, Applicability, Limitations and Alternatives as it helps indicate the optimization of the result without stating everything as a “requirement”. This model is also more open to emergent architecture elements that come from the build effort itself.
I started with the previously published CloudFormationRebootRequiredPatchinginASG.yaml, which can be deployed stand alone by populating it’s parameters and deploying it. CloudFormationELB.yaml also works in this way.
Create CloudFormationRebootRequiredPatchinginASG.yaml in CloudFormation Console
CloudFormationELB.yaml can be deployed and the resultant ELB Name can be fed to CloudFormationRebootRequiredPatchinginASG.yaml via the ELBName parameter. This integrates the two stacks and can be done manually or by automation calling the AWS CLI.
Create CloudFormationELB.yaml in CloudFormation Console
The stack name for CloudFormationELB.yaml can be provided as the ParentStackName parameter to CloudFormationRebootRequiredPatchinginASG.yaml and the ASG stack will assume the ELBName is exported as “ParentStackName-ELBName” Naming consistency with the ELBName in parameters, exports and imports helps keep the data passing methods less confusing.
When the ELB stack is only creating one resource, the flexibility of passing a stack name to the ASG stack is not as obvious. But consider if the ELB stack was pre-creating a bunch of AWS resources that were utilitized by the ASG stack - with a single parameter between the stacks many references could be passed.
The parameters are optional (as shown by the stand alone deployment) or they can BOTH be provided. If both are provided, then the ELBName parameter takes precedent over ParentStackName-ELBName. The vision is that if the parent stack was creating a set of resources, you would have the flexibility to override just one of them when appropriate. This parameter structure and the conditions that back it demonstrate how to take a parent stack and also override specific parent stack parameters.
The template CloudFormationUsingNestedStacks.yaml links together CloudFormationELB.yaml and CloudFormationRebootRequiredPatchinginASG.yaml as nested stacks and automatically handles the data passing between them via the ParentStackName parameter of the ASG stack.
Create CloudFormationUsingNestedStacks.yaml in CloudFormation Console
To my eye I have satisfied the majority of the design heuristic - however, if you know of additional, native methods of interlinking cloudformation stacks - I’d love to hear from you!
The repository below is where this code is updated with enhancements and bug fixes.
CloudFormationELB.yaml => [[Create Now]] (https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/create/review?templateURL=https://s3.amazonaws.com/missionimpossiblecode.io/files/CloudFormationELB.yaml)
CloudFormationRebootRequiredPatchinginASG.yaml => **[Create Now]**