mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
.
This commit is contained in:
@@ -0,0 +1,93 @@
|
||||
---
|
||||
name: cloudformation
|
||||
description: Deploy AWS resources with CloudFormation templates. Create stacks, use nested stacks, and implement drift detection. Use when deploying AWS-native IaC.
|
||||
license: MIT
|
||||
metadata:
|
||||
author: devops-skills
|
||||
version: "1.0"
|
||||
---
|
||||
|
||||
# CloudFormation
|
||||
|
||||
Deploy AWS infrastructure with native CloudFormation templates.
|
||||
|
||||
## Template Structure
|
||||
|
||||
```yaml
|
||||
AWSTemplateFormatVersion: '2010-09-09'
|
||||
Description: Web application stack
|
||||
|
||||
Parameters:
|
||||
Environment:
|
||||
Type: String
|
||||
AllowedValues: [dev, staging, prod]
|
||||
|
||||
Resources:
|
||||
WebServer:
|
||||
Type: AWS::EC2::Instance
|
||||
Properties:
|
||||
ImageId: !Ref AMI
|
||||
InstanceType: t3.micro
|
||||
Tags:
|
||||
- Key: Name
|
||||
Value: !Sub '${Environment}-web'
|
||||
|
||||
Outputs:
|
||||
InstanceId:
|
||||
Value: !Ref WebServer
|
||||
Export:
|
||||
Name: !Sub '${Environment}-WebServerId'
|
||||
```
|
||||
|
||||
## Stack Operations
|
||||
|
||||
```bash
|
||||
# Create stack
|
||||
aws cloudformation create-stack \
|
||||
--stack-name myapp \
|
||||
--template-body file://template.yaml \
|
||||
--parameters ParameterKey=Environment,ParameterValue=prod
|
||||
|
||||
# Update stack
|
||||
aws cloudformation update-stack \
|
||||
--stack-name myapp \
|
||||
--template-body file://template.yaml
|
||||
|
||||
# Delete stack
|
||||
aws cloudformation delete-stack --stack-name myapp
|
||||
|
||||
# Detect drift
|
||||
aws cloudformation detect-stack-drift --stack-name myapp
|
||||
```
|
||||
|
||||
## Intrinsic Functions
|
||||
|
||||
```yaml
|
||||
# Reference
|
||||
!Ref MyResource
|
||||
|
||||
# Get attribute
|
||||
!GetAtt MyResource.Arn
|
||||
|
||||
# Substitute
|
||||
!Sub 'arn:aws:s3:::${BucketName}/*'
|
||||
|
||||
# Conditional
|
||||
!If [CreateProdResources, 't3.large', 't3.micro']
|
||||
|
||||
# Join
|
||||
!Join ['-', [!Ref Environment, 'app', 'bucket']]
|
||||
```
|
||||
|
||||
## Best Practices
|
||||
|
||||
- Use change sets before updates
|
||||
- Implement stack policies
|
||||
- Use nested stacks for modularity
|
||||
- Enable termination protection
|
||||
- Use cfn-lint for validation
|
||||
|
||||
## Related Skills
|
||||
|
||||
- [terraform-aws](../terraform-aws/) - Alternative IaC
|
||||
- [aws-iam](../aws-iam/) - IAM resources
|
||||
@@ -0,0 +1,123 @@
|
||||
# CloudFormation Syntax Reference
|
||||
|
||||
## Template Structure
|
||||
|
||||
```yaml
|
||||
AWSTemplateFormatVersion: '2010-09-09'
|
||||
Description: My CloudFormation Template
|
||||
|
||||
Parameters:
|
||||
Environment:
|
||||
Type: String
|
||||
AllowedValues: [dev, staging, prod]
|
||||
|
||||
Mappings:
|
||||
RegionMap:
|
||||
us-east-1:
|
||||
AMI: ami-12345678
|
||||
|
||||
Conditions:
|
||||
IsProd: !Equals [!Ref Environment, prod]
|
||||
|
||||
Resources:
|
||||
MyBucket:
|
||||
Type: AWS::S3::Bucket
|
||||
Properties:
|
||||
BucketName: !Sub '${AWS::StackName}-bucket'
|
||||
|
||||
Outputs:
|
||||
BucketName:
|
||||
Value: !Ref MyBucket
|
||||
Export:
|
||||
Name: !Sub '${AWS::StackName}-bucket'
|
||||
```
|
||||
|
||||
## Intrinsic Functions
|
||||
|
||||
```yaml
|
||||
# Reference
|
||||
!Ref MyResource
|
||||
|
||||
# GetAtt
|
||||
!GetAtt MyResource.Arn
|
||||
|
||||
# Sub (string substitution)
|
||||
!Sub '${AWS::StackName}-resource'
|
||||
!Sub
|
||||
- 'arn:aws:s3:::${Bucket}/*'
|
||||
- Bucket: !Ref MyBucket
|
||||
|
||||
# Join
|
||||
!Join ['-', [!Ref Environment, app]]
|
||||
|
||||
# Select
|
||||
!Select [0, !GetAZs '']
|
||||
|
||||
# Split
|
||||
!Split [',', 'a,b,c']
|
||||
|
||||
# If
|
||||
!If [IsProd, 3, 1]
|
||||
|
||||
# ImportValue
|
||||
!ImportValue ExportedValue
|
||||
```
|
||||
|
||||
## Common Patterns
|
||||
|
||||
### Cross-Stack References
|
||||
```yaml
|
||||
# Stack A - Export
|
||||
Outputs:
|
||||
VpcId:
|
||||
Value: !Ref VPC
|
||||
Export:
|
||||
Name: SharedVPC
|
||||
|
||||
# Stack B - Import
|
||||
Resources:
|
||||
Subnet:
|
||||
Type: AWS::EC2::Subnet
|
||||
Properties:
|
||||
VpcId: !ImportValue SharedVPC
|
||||
```
|
||||
|
||||
### Nested Stacks
|
||||
```yaml
|
||||
Resources:
|
||||
VPCStack:
|
||||
Type: AWS::CloudFormation::Stack
|
||||
Properties:
|
||||
TemplateURL: https://s3.amazonaws.com/bucket/vpc.yaml
|
||||
Parameters:
|
||||
Environment: !Ref Environment
|
||||
```
|
||||
|
||||
### DependsOn
|
||||
```yaml
|
||||
Resources:
|
||||
MyInstance:
|
||||
Type: AWS::EC2::Instance
|
||||
DependsOn: MySecurityGroup
|
||||
```
|
||||
|
||||
## CLI Commands
|
||||
|
||||
```bash
|
||||
# Create stack
|
||||
aws cloudformation create-stack \
|
||||
--stack-name mystack \
|
||||
--template-body file://template.yaml \
|
||||
--parameters ParameterKey=Environment,ParameterValue=prod
|
||||
|
||||
# Update stack
|
||||
aws cloudformation update-stack \
|
||||
--stack-name mystack \
|
||||
--template-body file://template.yaml
|
||||
|
||||
# Delete stack
|
||||
aws cloudformation delete-stack --stack-name mystack
|
||||
|
||||
# Validate template
|
||||
aws cloudformation validate-template --template-body file://template.yaml
|
||||
```
|
||||
Reference in New Issue
Block a user