AWS cloud formation what should be excluded

Question

We currently have a web UI configured infrastructure that I want to move to cloud formation as it is growing in complexity. We use ECS with multiple docker containers, RDS, load balancers, SNS etc.

What I would like is suggestion on where to draw the line (or where to find the information) between what should be in cloud formation and what is not. Particularly around

• IAM rules for the likes of developer permissions excluding the ones required to deploy stacks from cloud formation
• RDS databases- do you run the risk of destroying production databases and having them re-deployed without the data
• Elastic ip addresses attached to a network load balancer

Thanks in advance

Answer 1

Couple of (arbitrary) rules that I usually follow:

1. Split your templates to smaller chunks and deploy things that are likely to change often (ECS tasks) separately from things that almost never change (VPC, subnets) or seldom change (RDS).

2. Use CloudFormation Export/ImportValue to pass variables between stacks. That helps reduce the amount of parameters needed for each template.

3. Keep Security Groups and IAM Roles close to the resources that need them. Some people tend to create all SGs in one template and then use them for resources in another template. Don't, ALB SG should be defined in ALB CFN template.

4. Update CFN stacks through CI/CD to deploy whatever new resource changes.

   E.g. when you build a new version of the ECS container the CI/CD will push it to ECR and then will call CloudFormation to update the stack to point to the new ECR image id. This will help keep the drift in your templates to minimum.

   Similarly with Lambdas - you can use CloudFormation package/deploy to deploy new versions from CI/CD.

5. You can also use Ansible to deploy CloudFormation templates, it is quite intelligent in the sense that it doesn't attempt to update stacks where the template or parameters didn't change from the last run.

Essentially everything should be done through CloudFormation. In fact in some accounts we don't permit any manual changes through the console and only allow deploying things through CloudFormation. One possible way to do that is using a CFN Service Role.

Hope that helps :)