1

We currently have a web UI configured infrastructure that I want to move to cloud formation as it is growing in complexity. We use ECS with multiple docker containers, RDS, load balancers, SNS etc.

What I would like is suggestion on where to draw the line (or where to find the information) between what should be in cloud formation and what is not. Particularly around

  • IAM rules for the likes of developer permissions excluding the ones required to deploy stacks from cloud formation
  • RDS databases- do you run the risk of destroying production databases and having them re-deployed without the data
  • Elastic ip addresses attached to a network load balancer

Thanks in advance

Improve this question
  • 1
    You can protect resources such as RDS / S3 against accidental deletion. I think all IAM policy should be in CF, as it's much easier to update than with CLI. Elastic IPs yes. I would have IAM policy set so only administrators can do things like delete elastic IPs / RDS databases / etc, and most users of the platform are given a role without these permissions. – Tim Aug 13 '19 at 22:24
2

Couple of (arbitrary) rules that I usually follow:

  1. Split your templates to smaller chunks and deploy things that are likely to change often (ECS tasks) separately from things that almost never change (VPC, subnets) or seldom change (RDS).

  2. Use CloudFormation Export/ImportValue to pass variables between stacks. That helps reduce the amount of parameters needed for each template.

  3. Keep Security Groups and IAM Roles close to the resources that need them. Some people tend to create all SGs in one template and then use them for resources in another template. Don't, ALB SG should be defined in ALB CFN template.

  4. Update CFN stacks through CI/CD to deploy whatever new resource changes.

    E.g. when you build a new version of the ECS container the CI/CD will push it to ECR and then will call CloudFormation to update the stack to point to the new ECR image id. This will help keep the drift in your templates to minimum.

    Similarly with Lambdas - you can use CloudFormation package/deploy to deploy new versions from CI/CD.

  5. You can also use Ansible to deploy CloudFormation templates, it is quite intelligent in the sense that it doesn't attempt to update stacks where the template or parameters didn't change from the last run.

Essentially everything should be done through CloudFormation. In fact in some accounts we don't permit any manual changes through the console and only allow deploying things through CloudFormation. One possible way to do that is using a CFN Service Role.

Hope that helps :)

Improve this answer
  • Thanks - that helps – Steve Aug 13 '19 at 23:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.