-
Notifications
You must be signed in to change notification settings - Fork 7
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CloudFormation Stack Tracking #146
base: master
Are you sure you want to change the base?
Changes from all commits
9fdd92a
7bd9631
34a5d93
543843e
d18a213
2387a57
6587d77
4022d0d
a3e61b8
fdd7892
6f58da9
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1 +1,2 @@ | ||
/// <reference path="project-name-generator/index.d.ts" /> | ||
/// <reference path="yargs-unparser/index.d.ts" /> |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,4 @@ | ||
declare module 'yargs-unparser' { | ||
function unparse(o: object, c: { command?: string, alias?: object, default?: object }): string[]; | ||
export = unparse | ||
} |
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,120 @@ | ||
# iidy CloudFormation Stack Tracking | ||
|
||
## Problem | ||
|
||
- Remembering all the parameters for creating or updating a CloudFormation stack | ||
can be difficult | ||
- Communicating and ensuring that a CloudFormation stack has been fully rolled | ||
out after a change can be difficult | ||
- Finding a way to push this into a CI workflow would resolve this issue | ||
- I essentially want [Atlantis](https://www.runatlantis.io/) but for | ||
CloudFormation | ||
- With many AWS regions and accounts, it is difficult to know whether all | ||
instances of a stack have been updated | ||
- StackSets kind of suck | ||
|
||
## Solution | ||
|
||
Track the iidy arguments for existing CloudFormation stacks: | ||
|
||
``` | ||
$ iidy create-stack --track stack-args.yaml --profile ... --region ... --environment ... | ||
``` | ||
|
||
This will create the stack and will create a tracking file in the same directory | ||
directory as the args file (under `.iidy/`). That particular stack can be | ||
recalled using an interactive prompt: | ||
|
||
``` | ||
$ iidy update-existing | ||
[ ] iidy update-stack stack-args.yaml --profile ... --region ... --environment ... | ||
[ ] iidy update-stack stack-args.yaml --profile ... --region ... | ||
[ ] iidy update-stack stack-args.other.yaml --profile ... --region ... --environment ... | ||
|
||
[ ] Update all | ||
``` | ||
|
||
which will allow the developer to select the arguments for an existing stack. | ||
|
||
The stack tracking files will be committed to version control to share between | ||
developers and so that they are available in CI. | ||
|
||
### Different Workflows | ||
|
||
Update existing stacks only for a given stack args file: | ||
|
||
``` | ||
iidy update-existing stack-args.yaml | ||
``` | ||
|
||
Auto-update (without an interactive prompt) all tracked stacks in the current directory: | ||
|
||
``` | ||
iidy update-existing -y ... | ||
``` | ||
|
||
or only for a given environment: | ||
|
||
``` | ||
iidy update-existing -y --environment production | ||
``` | ||
|
||
or region | ||
|
||
``` | ||
iidy update-existing -y --region us-east-1 | ||
``` | ||
|
||
or use changesets to apply the changes (may be useful for safely applying changes in CI): | ||
|
||
``` | ||
iidy update-existing -y --changeset | ||
``` | ||
|
||
Checking status of existing CloudFormation stacks: | ||
|
||
``` | ||
iidy status | ||
|
||
stack-name-1 | ||
<Stack metadata> | ||
<CloudFormation template diff> | ||
<StackSet changes> | ||
|
||
stack-name-2 | ||
<Stack metadata> | ||
<CloudFormation template diff> | ||
<StackSet changes> | ||
``` | ||
|
||
## Tracking File Format | ||
|
||
Filename: | ||
|
||
``` | ||
.iidy/stacks.yaml | ||
``` | ||
|
||
Contents: | ||
|
||
``` | ||
existingStacks: | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Let's add the stack arns into the output here for readability, debugging, and sanity checking during the updates. |
||
- stackArgs: stack-args.yaml | ||
args: | ||
- --environment production | ||
- --region us-east-1 | ||
- --profile sandbox | ||
env: | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Would we inspect for env vars that are imported / used? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Yes – we could just look at |
||
APP_VERSION: ... # for example | ||
AWS_PROFILE: ... # if this environment variable was set when `iidy create-stack --track` was run | ||
``` | ||
|
||
Questions: | ||
|
||
- Perhaps AWS profiles should be resolved down to the IAM role they use? In that | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. That would be useful. |
||
case, what about MFA? | ||
- AWS CLI profiles are not always configured with the same name or in the same | ||
way | ||
- Requiring that developers keep a standard set of profiles would be the | ||
easiest solution to this problem | ||
- How do you override parameters, such as an application version? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Any thoughts about alternatives to
--track
?--record
, ...