Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CloudFormation Stack Tracking #146

Open
wants to merge 11 commits into
base: master
Choose a base branch
from
1 change: 1 addition & 0 deletions @types/index.d.ts
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
/// <reference path="project-name-generator/index.d.ts" />
/// <reference path="yargs-unparser/index.d.ts" />
4 changes: 4 additions & 0 deletions @types/yargs-unparser/index.d.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
declare module 'yargs-unparser' {
function unparse(o: object, c: { command?: string, alias?: object, default?: object }): string[];
export = unparse
}
120 changes: 120 additions & 0 deletions docs/stack-tracking.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,120 @@
# iidy CloudFormation Stack Tracking

## Problem

- Remembering all the parameters for creating or updating a CloudFormation stack
can be difficult
- Communicating and ensuring that a CloudFormation stack has been fully rolled
out after a change can be difficult
- Finding a way to push this into a CI workflow would resolve this issue
- I essentially want [Atlantis](https://www.runatlantis.io/) but for
CloudFormation
- With many AWS regions and accounts, it is difficult to know whether all
instances of a stack have been updated
- StackSets kind of suck

## Solution

Track the iidy arguments for existing CloudFormation stacks:

```
$ iidy create-stack --track stack-args.yaml --profile ... --region ... --environment ...
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Any thoughts about alternatives to --track? --record, ...

```

This will create the stack and will create a tracking file in the same directory
directory as the args file (under `.iidy/`). That particular stack can be
recalled using an interactive prompt:

```
$ iidy update-existing
[ ] iidy update-stack stack-args.yaml --profile ... --region ... --environment ...
[ ] iidy update-stack stack-args.yaml --profile ... --region ...
[ ] iidy update-stack stack-args.other.yaml --profile ... --region ... --environment ...

[ ] Update all
```

which will allow the developer to select the arguments for an existing stack.

The stack tracking files will be committed to version control to share between
developers and so that they are available in CI.

### Different Workflows

Update existing stacks only for a given stack args file:

```
iidy update-existing stack-args.yaml
```

Auto-update (without an interactive prompt) all tracked stacks in the current directory:

```
iidy update-existing -y ...
```

or only for a given environment:

```
iidy update-existing -y --environment production
```

or region

```
iidy update-existing -y --region us-east-1
```

or use changesets to apply the changes (may be useful for safely applying changes in CI):

```
iidy update-existing -y --changeset
```

Checking status of existing CloudFormation stacks:

```
iidy status

stack-name-1
<Stack metadata>
<CloudFormation template diff>
<StackSet changes>

stack-name-2
<Stack metadata>
<CloudFormation template diff>
<StackSet changes>
```

## Tracking File Format

Filename:

```
.iidy/stacks.yaml
```

Contents:

```
existingStacks:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add the stack arns into the output here for readability, debugging, and sanity checking during the updates.

- stackArgs: stack-args.yaml
args:
- --environment production
- --region us-east-1
- --profile sandbox
env:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would we inspect for env vars that are imported / used?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes – we could just look at $imports for any env:... values

APP_VERSION: ... # for example
AWS_PROFILE: ... # if this environment variable was set when `iidy create-stack --track` was run
```

Questions:

- Perhaps AWS profiles should be resolved down to the IAM role they use? In that
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would be useful.

case, what about MFA?
- AWS CLI profiles are not always configured with the same name or in the same
way
- Requiring that developers keep a standard set of profiles would be the
easiest solution to this problem
- How do you override parameters, such as an application version?
Loading