33

We had same problem, below command I use for getting internal IP of ELB "LAMP-Prod" aws ec2 describe-network-interfaces --filters "Name=description,Values=ELB LAMP-Prod" |grep -wE 'Description|PrivateIpAddress' Or using JQ and without the need to specify an ELB name aws ec2 describe-network-interfaces --filters Name=requester-id,Values='amazon-elb' | jq -...


25

Nah you can't, there's nothing to refer to anyway (e.g. logical ID). Just create your own main table ;-). This is probably one of the reason it can't be used: One way to protect your VPC is to leave the main route table in its original default state (with only the local route), and explicitly associate each new subnet you create with one of the custom ...


23

I believe your problem here is confusion around that cloud-init is not the same as cfn-init. cloud-init is the tool that started as part of the Ubuntu AWS AMIs that allow the interpretation of the EC2 user-data component of the instance meta-data. Amazon Linux adopted this tool as well and built it into their AMI. cfn-init is part of a different toolset ...


22

i would change the structure to: "PrivateIpAddress": { "Fn::If": [ "RequestedPrivateIP", { "Ref": "PrivateIP" }, {"Ref" : "AWS::NoValue" } ] } the AWS::NoValue is there to give you the else option for your if statement. http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html


18

Referencing the default security group is possible using: { "Fn::GetAtt" : ["VPC", "DefaultSecurityGroup"] } Where "VPC" is your VPC resource name. With AWS::EC2::SecurityGroupIngress and AWS::EC2::SecurityGroupEgress, you can augment the permissions of this default security group. I think this is what you want: "VPCDefaultSecurityGroupIngress": { "...


18

Turns out I didn't try TTL and DependsOn. Works with both of those.


15

One approach is to add an input parameter to the CloudFormation template to indicate that an existing bucket should be used. Use Condition clauses in the template to create the bucket only if the parameter indicates it is needed.


13

The AMI was deleted by another user at the same time I did my edits. The message "AMI cannot be described" actually means "AMI could not be found". Hope this helps someone.


12

You need to call cfn-init (http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-init.html) inside the UserData property of the instance: { "Resources": { "Tomcat": { "Type": "AWS::EC2::Instance", "Metadata": { "AWS::CloudFormation::Init": { "config": { ...


12

I don't have an answer, but did want to point out that you can save yourself a lot of pain by using Fn::Sub in place of Fn::Join { "Fn::Sub": "${ELBHostName"}-1.${EnvironmentVersioned}.${HostedZone}"} Replaces "Fn::Join": [ ".", [ { "Fn::Join": [ "", [ { "Ref": "ELBHostName" }, "-1" ] ] }, { "Ref": "EnvironmentVersioned" }, { "...


11

src: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html The AWS::IAM::Role types now have a ManagedPolicyArns field where you can set this. You just need to grab the ARN (easy to grab from IAM console) and place it in that field. In the example below I created a role that provides read-only ECR access so my image can ...


11

Using the Split function works: JSON "Mappings": { "AWSEnv2PublicSubnets": { "DEV": { "subList": "subnet-1111,subnet-2222,subnet-3333" } } } then: "Subnets" : { "Fn::Split" : [ ",", { "Fn::FindInMap": [ "AWSEnv2PublicSubnets", { "Ref": "Env" }, "subList" ] } ] } YAML Mappings: ...


10

For instance store-backed EC2 instances, one trick is to add a comment to the user data script containing a version number, date, or similar, then change that whenever you want the instance recreated: { "Resources" : { "MyEC2Instance" : { "Type" : "AWS::EC2::Instance", "Properties" : { // ... other ...


10

The problem is that the CloudFormation template creates a RouteTable with the default route 0.0.0.0/0 correctly pointing to the IGW, however you don't associate the RouteTable with your subnets. What you need to do is add these two Route Table Associations to the template: "Subnet1RT":{ "Type" : "AWS::EC2::SubnetRouteTableAssociation", ...


9

If you want to get the private ip address of an elb, check network interfaces under network and security in you ec2 dashboard.


9

Yes, you can use the UserData attribute of your AWS::EC2::Instance object. http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-instance.html#cfn-ec2-instance-userdata This attribute takes as input the base64-encoded version of your shell script. You can, however, provide the script inline with the help of a Cloudformation ...


8

Existing SecurityGroups can be updated using SecurityGroupIngress For example: "SecurityGroupRedisIngress": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties" : { "GroupId": "sg-123456789", "IpProtocol": "tcp", "FromPort": "6379", "ToPort": "6379", "CidrIp": "1.2.3.4/0" } }


8

CloudFormation only creates or modifies AWS resources during deployment, update, or deletion of a stack. It does not continually 'check and enforce' individual stack resources' configuration states - drift can definitely occur. As an example, if I deploy a CF Stack and then later manually modify an Inbound Rule on one of its Security Groups, this ...


8

If you want to continue using default VPC you deleted you will have to contact AWS support to create it again. AWS resources from the template you are using depnd on it. Otherwise you have to customize it a bit so it can be used with your non-default VPCs. There are suggested changes: 0) Pass your VPC ID and your subnet IDs as CloudFormation parameters: ...


7

Is there a way to associate a key pair while creating a stack on CloudFormation? Sure, it indeed works by associating an existing key pair of yours during the process; the AWS CloudFormation Sample Templates feature respective fragments, e.g. the Simple EC2 instance example contains the fragment you are looking for: "Parameters" : { "KeyName" : { ...


7

This is a list of all the resource types supported by CloudFormation; a key pair isn't listed: http://docs.amazonwebservices.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html


7

Unfortunately my experiments are to agree with your conclusion Graeme. I have struggled with this for some time but not found a way of computing a String via Fn::Join and keeping it for later in the template. Can I share with you a typical example? As at 2014-09-18, the most sophisticated way of storing a string value for re-use in the Resources section ...


7

CloudFormation uses tags with the "aws:" prefix to keep track of what resources are associated with what entries in which stacks -- that's the "live" state it uses to compare with a template before deciding what to add/delete/update. As a user, you can't add, edit, or delete such tags. So if your existing resources don't have these tags, or don't have the ...


7

JQ parsing version, just FYI. aws ec2 describe-network-interfaces --filters "Name=description,Values=ELB your-elb-name" --output json | jq ".NetworkInterfaces[].PrivateIpAddresses[].PrivateIpAddress"


7

I believe you are mistaken in using CloudFormation to modify your AWS infrastructure. CloudFormation's goal is to create AWS infrastructure in a templated fashion. It has been extended to allow for some management of the resources it creates, but managing existing infrastructure is not it's goal. From the welcome page: AWS CloudFormation enables you to ...


7

Using ECR, EC2 and docker, you are still required to do a docker login. In the user data run aws ecr get-login --no-include-email > login.sh bash login.sh then you should be able to run docker pull ecr_registry/repo:tag https://docs.aws.amazon.com/AmazonECR/latest/userguide/ECR_AWSCLI.html


6

I do this now to add new nodes to my puppet master. For example, I grab the private IP of the puppet master instance in the UserData section of my new node: "echo ", { "Fn::GetAtt" : [ "MasterOfPuppets", "PrivateIp" ] }, " ", { "Fn::GetAtt" : [ "MasterOfPuppets", "PrivateDnsName" ] } ," puppet >> /etc/hosts\n","\n", See page 119 of the ...


6

I just figured it out! The parameter --resource of cfn-init script have to be set with the Launch Configuration name and not the AutoScale Group name. Wish that could help someone :)


6

I just ran into this issue, my problem was that I did not check the checkbox "I acknowledge that this template might cause AWS CloudFormation to create IAM resources." on the last screen before updating my stack.


6

You just need to change this line: "SecurityGroups" : [ {"Ref" : "WebServerSecurityGroup"} ], to this: "SecurityGroupIds" : [ {"Ref" : "WebServerSecurityGroup"} ], Per the Cloudformation documentation on the topic, the SecurityGroups attribute is only valid for EC2 security groups. You're using VPC, so you need to use SecurityGroupIds.


Only top voted, non community-wiki answers of a minimum length are eligible