Many AWS customers have adopted a DevOps model for faster and more reliable software delivery. Applying software engineering best practices such as revision control and continuous delivery to your infrastructure is essential for adopting DevOps. In this session, find out how AWS CloudFormation and associated AWS tools allow you to leverage a DevOps model by treating infrastructure as code and applying software engineering best practices to your AWS infrastructure.

1. ©2015, Amazon Web Services, Inc. or its affiliates. All rights reserved
Infrastructure as Code
with AWS CloudFormation
Chris Whitaker, Senior Software Development Manager, AWS

2. You are on board …
Continuous delivery
• services and
applications
DevOps
• culture, automation,
measurement,
sharing
Cloud
• infrastructure-as-
code
Business needs to experiment, innovate, reduce risk

3. AWS CloudFormation

4. AWS CloudFormation
• Create templates of the infrastructure and
applications you want to run on AWS
• Have the CloudFormation service
automatically provision the required AWS
resources and their relationships from the
templates
• Easily version control, replicate or update
the infrastructure and applications using
the templates
• Integrates with other development, CI/CD,
and management tools

5. Basic workflow
design
create
infrastructure
templates
write
application
code
create stacks
iterate

6. depends on
Design: Building a food ordering service
food catalog
website
ordering website
customer DB
service
inventory service
recommendations
service
analytics service
fulfillment
service
payment
service

7. Create template for the food catalog website
security group
Auto Scaling group
EC2
instance
Elastic Load
Balancing
customer DB service
inventory service
recommendations
service
Software pkgs,
config, & data
CloudWatch
alarms
ElastiCache

8. Create template: Resources
security group
Auto Scaling group
EC2
instance
Elastic Load
Balancing
Software pkgs,
config, & data
CloudWatch
alarms
"Resources" : {
"SecurityGroup" : {},
"WebServerGroup" : {
"Type" : "AWS::AutoScaling::AutoScalingGroup",
"Properties" : {
"MinSize" : "1",
"MaxSize" : "3",
"LoadBalancerNames" : [ { "Ref" :
"LoadBalancer" } ],
...
}
},
"LoadBalancer" : {},
"CacheCluster" : {},
"Alarm" : {}
},
CloudFormation Template
ElastiCache

9. Create template: Parameters
Auto Scaling group
EC2
instance
recommendations
Serviceinventory service
customer DB
service
info to customize
stack at creation
examples:
instance type, app
pkg version
"Parameters" : {
"CustomerDBServiceEndPoint" : {
"Description" : "URL of the Customer DB Service",
"Type" : "String"
},
"CustomerDBServiceKey" : {
"Description" : "API key for the Customer DB
Service",
"Type" : "String",
"NoEcho" : "true"
},
"InstanceType" : {
"Description" : "WebServer EC2 instance type",
"Type" : "String",
"Default" : "m3.medium",
"AllowedValues" :
["m3.medium","m3.large","m3.xlarge"],
"ConstraintDescription" : "Must be a valid
instance type"
CloudFormation Template

10. Create template: Outputs
Elastic Load
Balancing
"Resources" : {
"LoadBalancer" : {},
...
},
"Outputs" : {
"WebsiteDNSName" : {
"Description" : "The DNS name of the website",
"Value" : {
"Fn::GetAtt" : [ "LoadBalancer", "DNSName" ]
}
}
}
CloudFormation Template

11. Create template: Deploy and configure software
Auto Scaling group
EC2
instance
Software pkgs,
config, & data
"AWS::CloudFormation::Init": {
"webapp-config": {
"packages" : {}, "sources" : {}, "files" : {},
"groups" : {}, "users" : {},
"commands" : {}, "services" : {}
},
"chef-config" : {}
}
CloudFormation Template
 declarative
 debug-able
 updatable
 highly secure
 BIOT™ (Bring In
Other Tools)

12. Create template: Language features

13. Create stack

14. Operate stack

15. Use a wide range of AWS services
 Auto Scaling
 Amazon CloudFront
 AWS CloudTrail
 Amazon CloudWatch
 AWS Data Pipeline (new)
 Amazon DynamoDB
 Amazon EC2
 Amazon EC2 Container Service (new)
 Amazon ElastiCache
 AWS Elastic Beanstalk
 Elastic Load Balancing
 Managed policies in IAM (new)
 Amazon Kinesis
 AWS Lambda (new)
 AWS OpsWorks
 Amazon RDS
 Amazon Redshift
 Amazon Route 53
 Amazon S3
 Amazon SimpleDB
 Amazon SNS
 Amazon SQS
 Amazon VPC
and more …

16. Basic workflow
design
create
infrastructure
templates
write
application
code
create stacks
iterate

17. Infrastructure-as-code workflow
code
version
control
code
review
integrate
“It’s all software”

18. “It’s all software” – Organize like it’s software
front-end
services
• consumer website, seller
website, mobile back end
back-end
services
• search, payments, reviews,
recommendations
shared
services
• CRM DBs, common monitoring
/alarms, subnets, security groups
base
Network
• VPCs, Internet gateways, VPNs,
NATs
identity • IAM users, groups, roles

19. “It’s all software” – Build and operate like it’s
software
application software
source code
package
loader/interpreter
desired application state
in memory
infrastructure
software
JSON templates / JSON
template generators
JSON templates
AWS CloudFormation
desired infrastructure in
the cloud

20. Iterate on infrastructure

21. Update stack
in-place blue-green
faster
cost-efficient
simpler state and
data migration
working stack
not touched

22. Extending AWS CloudFormation

23. Extend with custom resources
security group
Auto Scaling group
EC2
instance
Elastic Load
Balancing
Software pkgs,
config, & data
CloudWatch
alarms
Web Analytics
Service
AWS
CloudFormation
provision
AWS resources
"Resources" : {
"WebAnalyticsTrackingID" : {
"Type" : "Custom::WebAnalyticsService::TrackingID",
"Properties" : {
"ServiceToken" : "arn:aws:sns:...",
"Target" : {"Fn::GetAtt" : ["LoadBalancer", "DNSName"]},
"Plan" : "Gold"
}
},
...
“Success” + Metadata
“Create, update, roll back, or delete”
+ metadata
ElastiCache

24. Lambda-powered custom resources
security group
Auto Scaling group
EC2
instance
Elastic Load
Balancing
Software pkgs,
config, & data
CloudWatch
alarms
your AWS CloudFormation stack
// Implement custom logic here
look up an AMI ID
your AWS Lambda functions
look up a VPC ID and a subnet ID
reverse an IP address
Lambda-powered
custom resources
ElastiCache

25. Application deployment as code

26. Infrastructure
provisioning
EC2
SQS, SNS, Kinesis, etc.
databases
VPC
IAM
Application
deployment
download packages,
install software,
configure apps,
bootstrap apps, update
software, restart apps,
etc.
CloudFormation
• templatize
• replicate
• automate

27. Application deployment as code
inside a CloudFormation template
Amazon Machine Images
CloudFormation::Init
Chef, Puppet,
CodeDeploy
OpsWorks
Chef

28. Metadata
AWS::CloudFormation::Init
AWS::CloudFormation::Init
 Declarative
 Reusable
 Grouping & Ordering
 Debug-able
 Updatable
 Highly Secure
 BIOT™ (Bring In Other Tools)
ow.ly/DiNCm

29. AWS::CloudFormation::Init
"AWS::CloudFormation::Init": {
"webapp-config": {
"packages" : {}, "sources" : {}, "files" : {},
"groups" : {}, "users" : {},
"commands" : {}, "services" : {}
Declarative

30. AWS::CloudFormation::Init
Debuggable

31. AWS::CloudFormation::Init
Supports updates
"packages" : {},
"sources" : {},
"files" : {},
"groups" : {},
"users" : {},
"commands" : {},
"services" : {}

32. AWS::CloudFormation::Init
"install_chef" : {},
"install_wordpress" : {
"commands" : {
"01_get_cookbook" : {}, ...,
"05_configure_node_run_list" : {
"command" : "knife node run_list add -z `knife
node list -z` recipe[wordpress]",
"cwd" : "/var/chef/chef-repo",
"env" : { "HOME" : "/var/chef" }
Flexibility to bring in other tools such as AWS CodeDeploy and Chef
ow.ly/DiNkz

33. AWS::CloudFormation::Init
"YourInstance": {
"Metadata": {
"AWS::CloudFormation::Authentication": {
"S3AccessCreds": {
"type": "S3",
"roleName": { "Ref" : "InstanceRole"},
"buckets" : ["your-bucket"]
}
},
"AWS::CloudFormation::Init": {}
Supports role-based authentication
Securely download
Choose auth type.
IAM role is
recommended.
ow.ly/DqkrB

34. Use AWS::CloudFormation::Init
"UserData": {
"# Get the latest CloudFormation helper scripts packagen",
"yum update -y aws-cfn-bootstrapn",
"# Trigger CloudFormation::Init configuration n",
"/opt/aws/bin/cfn-init --stack ", {"Ref": "AWS::StackId"},
" --resource WebServerInstance ",
" --region ", {"Ref": "AWS::Region"}, "n",
"# Signal completionn",
"/opt/aws/bin/cfn-signal –e $? --stack ", {"Ref": "AWS::StackId"},
" --resource WebServerInstance ",
" --region ", {"Ref": "AWS::Region"}, "n"

35. Use Amazon CloudWatch Logs for debugging
"install_logs": {
"packages" : { ... "awslogs" ... },
"services" : { ... "awslogs" ... }
"files": {
"/tmp/cwlogs/cfn-logs.conf": {}
file = /var/log/cfn-init.log
log_stream_name = {instance_id}/cfn-init.log
file = /var/log/cfn-hup.log
log_stream_name = {instance_id}/cfn-hup.log
ow.ly/E0zO3

36. Use Amazon CloudWatch Logs for debugging
ow.ly/E0zO3

37. Bake AMIs for faster booting and
for maintaining golden images
dev/test stacks bake AMI staging/prod stacks
tracking

38. Using CloudFormation and OpsWorks
together

39. Infrastructure
provisioning
EC2
SQS, SNS, Kinesis, etc.
databases
VPC
IAM
Application
deployment
download packages,
install software,
configure apps,
bootstrap apps, update
software, restart apps,
etc.
CloudFormation
• templatize
• replicate
• automate
OpsWorks
• built-in application
lifecycle
• interactive
application console
OpsWorks and CloudFormation side by side

40. OpsWorks
• built-in application
lifecycle
• interactive
application console
Infrastructure
provisioning
EC2
SQS, SNS, Kinesis, etc.
databases
VPC
IAM
Application
deployment
download packages,
install software,
configure apps,
bootstrap apps, update
software, restart apps,
etc.
CloudFormation
• templatize
• replicate
• automate
OpsWorks “inside” CloudFormation

41. Infrastructure-as-code in a CI/CD pipeline

42. CloudFormation in a CI/CD pipeline
AWS
CloudFormationIssue Tracker
app developers
DevOps engineers,
infrastructure developers,
systems engineers
dev env code repo
app pkgs,
CloudFormation
templates, etc.
CI server
test
staging
prodcode review
“infrastructure-as-code"
app code
& templates

43. Templatize existing resources

44. CloudFormer: Templatize existing resources
1. Launch a CloudFormer
application stack.
2. Walk through the
CloudFormer UI and select
resources to templatize.
4. Customize.
For example: parameterize
resource properties.
5. Create a new stack.

45. Practitioners of infrastructure-as-code
• Developers/DevOps teams value CloudFormation for its ability to
treat infrastructure as code, allowing them to apply software
engineering principles, such as SOA, revision control, code reviews,
and integration testing to infrastructure.
• IT admins and MSPs value CloudFormation as a platform to enable
standardization, managed consumption, and role-specialization.
• ISVs value CloudFormation for its ability to support scaling out of
multi-tenant SaaS products by quickly replicating or updating stacks.
ISVs also value CloudFormation as a way to package and deploy
their software in their customer accounts on AWS.

46. New York