Thursday, August 14, 2014

19 Best Practices for Creating Amazon CloudFormation Templates

Amazon CloudFormation templates are widely used in the AWS cloud for environment creation by the IT and application teams.  We have been helping enterprises with Amazon CFT based automation for years and following are some of the best practices to follow while creating Amazon CFT Templates. This article compiles the CFT practices /pointers used by us for provisioning complex large scale environments on AWS, not all of them will be applicable for all use cases.
Practice #1: Version your CloudFormation templates
CloudFormation template should be commenced with a template format version and description such that it could be artifact-able with version control tools like Git, SVN, CVS, etc.,
Example:
"AWSTemplateFormatVersion": "2010-09-09",
    "Description": "AWS CloudFormation Template for CustomerXYZ Version 5.0",
Practice #2: Use input parameters
Input parameters section should be developed in scope with getting values from the end users of the CFT for environments, SSH Key Pairs, EC2 instance types, RDS instance types, ElastiCache node types, etc., and this makes the entire CloudFormation template configurable and maintainable.
Example:
"WebTierKeyName": {
            "Description": "Name of an existing EC2 KeyPair to enable SSH access to the WebTier",
            "Type": "String",
            "MinLength": "1",
            "MaxLength": "64",
            "Default": "testkey",
            "AllowedPattern": "[-_ a-zA-Z0-9]*",
            "ConstraintDescription": "can contain only alphanumeric characters, spaces, dashes and underscores."
Practice #3: AMI ID should be a parameter in inputs section
AMI ID should be asked as an input parameter from the end users for launching EC2 instances. It is highly recommended not to hard code it inside your template and make it configurable dynamically.
Example:
"NatAMIID": {
            "Type": "String",
            "Default": "ami-XXXXXXXX",
            "Description": "The AMIID of NAT Instance"
        },
Practice #4: Mention the AMI mappings
AMI Mappings should be included in the CloudFormation template to validate the respective AMI(s) in the region(s) specified else it will take default AMI for the region (which is not advisable).
Example:
"Mappings": {
        "RegionMap": {
            "us-east-1": {
                "AMI": "ami-XXXXXXXX"
            },
"us-west-2": {
                "AMI": "ami-XXXXXXXX"
            },
Practice #5: Use WaitConditionHandle, WaitCondition, DependsOn wherever applicable
When creating a large multi-tiered infrastructure using CFT on AWS, there are times when the order of the resource launch is important. For Example WaitCondition that waits for the desired number of instances in a web server group.
Using the AWS::CloudFormation::WaitCondition and AWS::CloudFormation::WaitConditionHandle resources, a wait condition can be placed with in a template to make AWS CloudFormation pause the creation of the stack and wait for a signal before it continues to create the stack.
We can specify that the creation of a specific resource to follow another using the “DependsOn” attribute. On adding a DependsOn attribute to a resource, it is created only after the creation of the resource specified in the DependsOn attribute.
Example:
"WebServerGroup" : {
   "Type" : "AWS::AutoScaling::AutoScalingGroup",
   "Properties" : {
      "AvailabilityZones" : { "Fn::GetAZs" : "" },
      "LaunchConfigurationName" : { "Ref" : "LaunchConfig" },
      "MinSize" : "1",
      "MaxSize" : "5",
      "DesiredCapacity" : { "Ref" : "WebServerCapacity" },
      "LoadBalancerNames" : [ { "Ref" : "ElasticLoadBalancer" } ]
   }
},
"WaitHandle" : {
   "Type" : "AWS::CloudFormation::WaitConditionHandle"
},
"WaitCondition" : {
   "Type" : "AWS::CloudFormation::WaitCondition",
   "DependsOn" : "WebServerGroup",
   "Properties" : {
      "Handle"  : { "Ref" : "WaitHandle" },
      "Timeout" : "300",
      "Count"   : { "Ref" : "WebServerCapacity" }
   }
}       
For example, an Amazon EC2 instance with a public IP address is dependent on the VPC-gateway attachment if the VPC and Internet Gateway resources are also declared in the same template. The following snippet shows a sample gateway attachment and an Amazon EC2 instance that depends on that gateway attachment:
"GatewayToInternet" : {
  "Type" : "AWS::EC2::VPCGatewayAttachment",
  "Properties" : {
    "VpcId" : { "Ref" : "VPC" },
    "InternetGatewayId" : { "Ref" : "InternetGateway" }
  }
},
"EC2Host" : {
  "Type" : "AWS::EC2::Instance",
  "DependsOn" : "GatewayToInternet",
    "Properties" : {
      "InstanceType" : { "Ref" : "EC2InstanceType" },
      "KeyName"  : { "Ref" : "KeyName" },
      "ImageId"  : { "Fn::FindInMap" : [ "AWSRegionArch2AMI", { "Ref" : "AWS::Region" },
        { "Fn::FindInMap" : [ "AWSInstanceType2Arch", { "Ref" : "EC2InstanceType" }, "Arch" ] } ] },
      "NetworkInterfaces" : [{
        "GroupSet"                 : [{ "Ref" : "EC2SecurityGroup" }],
        "AssociatePublicIpAddress" : "true",
        "DeviceIndex"              : "0",
        "DeleteOnTermination"      : "true",
        "SubnetId"                 : { "Ref" : "PublicSubnet" }
      }]
    }
}
Practice #6: Tag the resources properly
Tags should be used for the creation of AWS resources. Tags can be environment, purpose, application specification etc., In addition to the stack name tags that AWS CloudFormation provides, custom tags can be added to the resources that support tagging. This helps in easy grouping of the assets associated with the environment.
Example:
"Tags": [
                    {
                        "Key": "Environment",
                        "Value": {
                            "Ref": "Environment"
                        }
                    },
                    {
                        "Key": "Purpose",
                        "Value": "CustomerXYZ VPC"
Practice #7: Understand your Resources
When a CloudFormation template is deleted all AWS resources assigned with the template will be automatically deleted by AWS. For example a VPC template will have all the related resources like Route tables, Subnets, Network ACLs, etc., will be deleted.
In real scenario, S3 buckets logs, EBS snapshots etc are associated with an infrastructure but they will not terminated when the CFT is deleted, hence have to be automated for deletion using scripts.
Practice #8: Create your Security groups using CFT
Security Groups can be governed and controlled using CloudFormation template for various tiers like Web, App, DB, etc.,
"GatewayTierSg": {
            "Type": "AWS::EC2::SecurityGroup",
            "Properties": {
                "GroupDescription": "Gateway Security Group",
                "VpcId": {
                    "Ref": "Vpc"
                },
                "SecurityGroupIngress": [
                    {
                        "IpProtocol": "6",
                        "FromPort": "22",
                        "ToPort": "22",
                        "CidrIp": "0.0.0.0/0"
                    }
                ],
                "SecurityGroupEgress": [
                    {
                        "IpProtocol": "-1",
                        "CidrIp": "10.0.0.0/16"
                    }
                ]
            }
        },
Practice #9: Include the Output Section.
Output section should be declared with AWS specific end points to trace back. The template Outputs section enables in returning one or more values to the user in response to the AWS CloudFormation describe-stacks command. Example your endpoints are shown on the Output section.
Example:
"RDSDatabaseEndpointDetail": {
            "Description": "RDSDatabaseEndpointDetails",
            "Value": {
                "Fn::GetAtt": [
                    "RdsTierService",
                    "Endpoint.Address"
                ]
            }
        },
        "ElastiCacheEndpointDetail": {
            "Description": "ElastiCacheEndpointDetails",
            "Value": {
                "Fn::GetAtt": [
                    "ElatiCacheTierService",
                    "ConfigurationEndpoint.Address"
                ]
            }
        },
        "WebTierElbExternalEndpointDetail": {
            "Description": "WebTierElb External Endpoint Access Details",
            "Value": {
                "Fn::GetAtt": [
                    "WebTierElbExternal",
                    "DNSName"
                ]
            }

        },


Practice #10: Automate Application Installation using cloud-init

With the help of cloud-init the installation of various packages can be done during the boot itself just by passing the appropriate commands. In the cloud-init the scripts also can be passed through the automation of various operations can be done.

"Resources" : {
    "Ec2Instance" : {
      "Type" : "AWS::EC2::Instance",
      "Properties" : {
        "KeyName" : { "Ref" : "KeyName" },
        "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ],
        "ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "AMI" ]},
        "UserData" : { "Fn::Base64" : { "Fn::Join" : ["",[
            "#!/bin/bash -ex","\n",
            "yum -y install gcc-c++ make","\n",
            "yum -y install mysql-devel sqlite-devel","\n",
            "yum -y install ruby-rdoc rubygems ruby-mysql ruby-devel","\n",
            "gem install --no-ri --no-rdoc rails","\n",
            "gem install --no-ri --no-rdoc mysql","\n",
            "gem install --no-ri --no-rdoc sqlite3","\n",
            "rails new myapp","\n",
            "cd myapp","\n",
            "rails server -d","\n",
            "curl -X PUT -H 'Content-Type:' --data-binary '{\"Status\" : \"SUCCESS\",",
                                                           "\"Reason\" : \"The application myapp is ready\",",
                                                           "\"UniqueId\" : \"myapp\",",
                                                           "\"Data\" : \"Done\"}' ",
                  "\"", {"Ref" : "WaitForInstanceWaitHandle"},"\"\n" ]]}}
      }

Practice #11: Use helper scripts to start/stop services etc

AWS CloudFormation provides a set of Python helper scripts that you can use to install software and start services on an Amazon EC2 instance that you create as part of your stack. You can call the helper scripts directly from your template. The scripts work in conjunction with resource metadata that you define in the same template. The helper scripts run on the Amazon EC2 instance as part of the stack creation process.

"Resources" : {


"WebServer": {
"Type": "AWS::EC2::Instance",
"Metadata" : {
"Comment1" : "Configure the bootstrap helpers to install the Apache Web Server and PHP",
"Comment2" : "The website content is downloaded from the CloudFormationPHPSample.zip file",

"AWS::CloudFormation::Init" : {
"config" : {
"packages" : {
"yum" : {
"mysql" : [],
"mysql-server" : [],
"mysql-libs" : [],
"httpd" : [],
"php" : [],
"php-mysql" : []
}
},

"sources" : {
"/var/www/html" : "
https://s3.amazonaws.com/cloudformation-examples/CloudFormationPHPSample.zip"
},

"files" : {
"/tmp/setup.mysql" : {
"content" : { "Fn::Join" : ["", [
"CREATE DATABASE ", { "Ref" : "DBName" }, ";\n",
"GRANT ALL ON ", { "Ref" : "DBName" }, ".* TO '", { "Ref" : "DBUsername" }, "'@localhost IDENTIFIED BY '", { "Ref" : "DBPassword" }, "';\n"
]]},
"mode" : "000644",
"owner" : "root",
"group" : "root"
}
},


Practice #12: Make use of parameter section constraints (wherever applicable)

The parameter sections provide lot of constraints like MinValue, Max Value, Allowed values, Max length, etc. By effective usage of the of the parameter section you can validate the input parameters from the user. Example:  We can restrict TCP port value to be between 1 to 65535, we can restrict the webserver port to 80,8888 etc. This feature is particularly useful when you are developing complex cloudformation template for automation.


"Parameters" : {
    "UserAccount": {
      "Default": "guest",
      "NoEcho": "true",
      "Description" : "The guest account user name",
      "Type": "String",
      "MinLength": "1",
      "MaxLength": "16",
      "AllowedPattern" : "[a-zA-Z][a-zA-Z0-9]*"
    }
}

"Parameters" : {
    "WebServerPort": {
      "Default": "80",
      "Description" : "TCP/IP port for the web server",
      "Type": "Number",
      "MinValue": "1",
      "MaxValue": "65535"
    }
}

"Parameters" : {
    "WebServerPort": {
      "Default": "80",
      "Description" : "Port for the web server",
      "Type": "Number",
      "AllowedValues" : ["80", "8888"]
    }
}

Practice #13: Use NoEcho property for sensitive information

When the cloudformation is in progress we can use describe-stacks to check the progress of the stack, in this case we can see the parameters values being returned. If we use the NoEcho Property like below, the sensitive information will not be returned.
 "AdminPassword": {
      "NoEcho": "true",
      "Description" : "The Joomla! admin account password",
      "Type": "String",
      "MinLength": "1",
      "MaxLength": "41",
      "AllowedPattern" : "[a-zA-Z0-9]*",
      "ConstraintDescription" : "must contain only alphanumeric characters."
    }


Practice #14: Use Select Function and reduce the parameters in the template

Fn::Select intrinsic function:Using the above function in the in the Resources section of your template will help you to combine related parameters which can reduce the total number of parameters in your template.
"Parameters" : {
  "DbSubnetBlocks": {
    "Description": "Three CIDR blocks",
    "Type": "CommaDelimitedList",
      "Default": "10.0.58.0/24, 10.0.59.0/24, 10.0.60.0/24"
  }
}
To specify one of the three CIDR blocks, use Fn::Select in the Resources section of the same template, as shown in the following sample snippet:
"Subnet1": {
  "Type": "AWS::EC2::Subnet",
    "Properties": {
      "VpcId": { "Ref": "VPC" },
      "CidrBlock": { "Fn::Select" : [ "0", {"Ref": "DbSubnetBlocks"} ] }
    }
}


Practice #15: Use intrinsic Functions to manage automation
 Fn::FindInMap intrinsic function
The function Fn::FindInMap returns the value corresponding to keys in a two-level map that is declared in the Mappings section.
{
  ...
  "Mappings" : {
    "RegionMap" : {
      "us-east-1" : { "32" : "ami-6451e20d", "64" : "ami-7a11e213" },
      "us-west-1" : { "32" : "ami-d5gc7978c", "64" : "ami-cfc7978a" }
         }
  },

  "Resources" : {
     "myEC2Instance" : {
        "Type" : "AWS::EC2::Instance",
        "Properties" : {
           "ImageId" : { "Fn::FindInMap" : [ "RegionMap", { "Ref" : "AWS::Region" }, "32"]},
           "InstanceType" : "m3.large"
        }
     }
 }
}
You can use intrinsic functions, such as Fn::If, Fn::Equals, and Fn::Not, to conditionally create stack resources. These conditions are evaluated based on input parameters that you declare when you create or update a stack. After you define all your conditions, you can associate them with resources or resource properties in the Resources and Outputs sections of a template

Practice #16: Properties section

If a resource does not require any properties to be declared, you can omit the Properties section of that resource. This will keep the template code simple and manageable

"Resources" : {
    "WebInstance" : {
        "Type" : "AWS::EC2::Instance",
        "Properties" : {
            "UserData" : {
                "Fn::Base64" : {
                    "Fn::Join" : [ "", [ "Queue=", { "Ref" : "MyQueue" } ] ]
                 } },
              "ImageId" : "ami-20b65349"
        }
    },

    "MyQueue" : {
        "Type" : "AWS::SQS::Queue",
        "Properties" : {
        }
    }
}    


Practice #17: Planning Windows Bootstrapping using Amazon CFT

In order for the Windows bootstrapping to work the CloudFormation the windows instance should be setup with the EC2ConfigService. The AWS CloudFormation helper script cfn-init is used to perform each of these actions, based on information in the AWS::CloudFormation::Init resource.
"SharePointFoundation": {
   "Type" : "AWS::EC2::Instance",
   "Metadata" : {
     "AWS::CloudFormation::Init" : {
       "config" : {

"files" : {
  "c:\\cfn\\cfn-hup.conf" : {
    "content" : { "Fn::Join" : ["", [
      "[main]\n",
      "stack=", { "Ref" : "AWS::StackName" }, "\n",
      "region=", { "Ref" : "AWS::Region" }, "\n"
      ]]}
  },
  "c:\\cfn\\hooks.d\\cfn-auto-reloader.conf" : {
    "content": { "Fn::Join" : ["", [
      "[cfn-auto-reloader-hook]\n",
      "triggers=post.update\n",
      "path=Resources.SharePointFoundation.Metadata.AWS::CloudFormation::Init\n",
      "action=cfn-init.exe -v -s ", { "Ref" : "AWS::StackName" },
                                     " -r SharePointFoundation",
                                     " --region ", { "Ref" : "AWS::Region" }, "\n"
    ]]}
  },
  "C:\\SharePoint\\SharePointFoundation2010.exe" : {
  }
},


Practice #18: Use Nested Stacks 
You can declare only Maximum of 200 resources in your AWS CloudFormation template. For complex environments and automation stacks you will need more than that, it is recommended to separate your template into multiple templates using the nested stacks feature.

{
    "AWSTemplateFormatVersion" : "2010-09-09",
    "Resources" : {
        "myStack" : {
               "Type" : "AWS::CloudFormation::Stack",
               "Properties" : {
                  "TemplateURL" : "https://s3.amazonaws.com/cloudformation-templates-us-east-1/S3_Bucket.template",
              "TimeoutInMinutes" : "60"
               }
        }
    },
    "Outputs": {
       "StackRef": {"Value": { "Ref" : "myStack"}},
       "OutputFromNestedStack" : {
             "Value" : { "Fn::GetAtt" : [ "myStack", "Outputs.BucketName" ] }
       }
    }
}

Practice #19: Integrate Amazon CFT with Amazon CloudTrail
It is recommended that AWS CloudFormation is integrated with the CloudTrail. The actions related to CloudFormation like CreateStack, DeleteStack, and ListStacks actions generate entries in CloudTrail log files.  These logs can be processed for audit compliance purpose later.




2 comments:

Dave English said...

Just to be clear: practices #3 and #4 are mutually exclusive, or have I got it wrong?

Anonymous said...

I think you use #4 to validate the options that might be used in 3#. For example, let's say that you were using the following AMI IDs in "AllowedValues" for #3: ami-XXXXXXX1 & ami-XXXXXXX2. If you also include those options in #4, then the Cloud Formation script should fail if one of those AMIs is not available in a specified region. That's how I read it anyway.

Need Consulting help ?

Name

Email *

Message *

DISCLAIMER
All posts, comments, views expressed in this blog are my own and does not represent the positions or views of my past, present or future employers. The intention of this blog is to share my experience and views. Content is subject to change without any notice. While I would do my best to quote the original author or copyright owners wherever I reference them, if you find any of the content / images violating copyright, please let me know and I will act upon it immediately. Lastly, I encourage you to share the content of this blog in general with other online communities for non-commercial and educational purposes.

Followers