Book Image

Mastering AWS CloudFormation - Second Edition

By : Karen Tovmasyan
Book Image

Mastering AWS CloudFormation - Second Edition

By: Karen Tovmasyan

Overview of this book

The advent of DevOps and the cloud revolution has compelled software engineers and operations teams to rethink how to manage complex infrastructures and build resilient solutions. With this AWS book, you’ll find out how you can use Infrastructure as Code (IaC) to simplify infrastructure operations and manage the modern cloud with AWS CloudFormation. This guide covers AWS CloudFormation comprehensively, from template structures to developing complex and reusable infrastructure stacks. It takes you through template validation, stack deployment, and handling deployment failures. It also demonstrates the use of AWS CodeBuild and CodePipeline for automating resource delivery and implementing continuous integration and continuous delivery (CI/CD) practices. As you advance, you’ll learn how to modularize and unify your template on the fly using macros or by fixating the version using modules. You’ll create resources outside of AWS with custom resources and catalog them with the CloudFormation registry. Finally, you’ll improve the way you manage the modern cloud environment on AWS by extending CloudFormation through the AWS serverless application model (SAM) and the AWS cloud development kit (CDK). By the end of this book, you’ll have mastered key AWS CloudFormation concepts and will be able to extend its capabilities for developing and deploying your own infrastructure.
Table of Contents (19 chapters)
Free Chapter
1
Part 1: CloudFormation Internals
4
Part 2: Provisioning and Deployment at Scale
9
Part 3: Extending CloudFormation

Activating and using public extensions

Let’s reiterate what we did in the previous chapter one more time. We built a Lambda function that receives an API call from CloudFormation and runs SQL queries against our provisioned RDS cluster.

Now, imagine that we want to publish our custom resource handler and let anyone use it. Since Lambda is hosted on our AWS account, the user of the RDS instance would need to make it accessible from the outside world, thus introducing a security risk. If we were to use Aurora Serverless V1, we could enable the Data API, but we would still need to provide access to it using an IAM role, which introduces the following two-sided security risk:

  • We, as the Lambda owner, have to expose our AWS account ID
  • We create an IAM role that grants the user with access to the Data API

Even if we ignore the security risks resulting from the above, there are still other risks such as costs and reliability. We host the Lambda function, which...