AWS CLI で CloudFormation の change set を作って実行するまで

AWS CLI で CloudFormation の change set を作って実行するまで:

チラ裏. AWS CLI で CloudFormation の change set の作成、実行、または削除をする手順。

説明しないこと

• CloudFormation の基本概念
• Stack の作り方
• CloudFormation テンプレートの書き方

バリデーション

CloudFormation テンプレートを書いたあと、まずは validation すると便利。

$ aws cloudformation validate-template --template-body=file://$PWD/cfn.yml 

python モジュールに cfn-lint というものもあるのでそれも使うとまた便利

$ pip install cfn-lint 
$ cfn-lint cnf.yml 

ChangeSet の作成

仮にスタック名、および ChangetSet 名を以下のように定義したものとする

STACK=stack01 
CHANGE_SET=${STACK}-$(date +%Y%m%d%H%M%S) # ex) stack01-20190114152714 

ChangeSet の作成

IAMユーザを作るような CloudFormation テンプレートの場合、--capabilities への指定が必要。

パスワードのような値を CloudFormation テンプレートに書きたくない場合、--parameters で値を渡す。

$ aws cloudformation create-change-set --stack-name ${STACK} --change-set-name=${CHANGE_SET} \ 
  --template-body=file://$PWD/cfn.yml --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \ 
  --parameters ParameterKey=RDSMasterUserPassword,ParameterValue=xxxxx,UsePreviousValue=false 
{ 
    "Id": "arn:aws:cloudformation:ap-northeast-1:xxxxxx:changeSet/stack01-20190114152714/xxx-xxx-xxx-xxx", 
    "StackId": "arn:aws:cloudformation:ap-northeast-1:xxxxx:stack/stack01/xxx-xxx-xxx-xxx" 
} 

ChangeSet の確認

一覧

$ aws cloudformation list-change-sets --stack-name ${STACK} 
{ 
    "Summaries": [ 
        { 
            "StackId": "arn:aws:cloudformation:ap-northeast-1:xxxxx:stack/stack01/xxx-xxx-xxx-xxx", 
            "StackName": "stack01", 
            "ChangeSetId": "arn:aws:cloudformation:ap-northeast-1:xxxxx:changeSet/stack01-20190114152714/xxx-xxx-xxx-xxx", 
            "ChangeSetName": "stack01-20190114152714", 
            "ExecutionStatus": "AVAILABLE", 
            "Status": "CREATE_COMPLETE", 
            "CreationTime": "2019-01-14T06:27:14.447Z" 
        } 
    ] 
} 

変更の確認 (以下は RDS のパスワードが変更された例)

$ aws cloudformation describe-change-set --stack-name ${STACK} --change-set-name ${CHANGE_SET} 
{ 
    "ChangeSetName": "stack01-20190114152714", 
    "ChangeSetId": "arn:aws:cloudformation:ap-northeast-1:xxxxx:changeSet/stack01-20190114152714/xxx-xxx-xxx-xxx", 
    "StackId": "arn:aws:cloudformation:ap-northeast-1:xxxxx:stack/stack01/xxx-xxx-xxx-xx", 
    "StackName": "stack01", 
    "Parameters": [ 
    ], 
    "CreationTime": "2019-01-14T06:27:14.447Z", 
    "ExecutionStatus": "AVAILABLE", 
    "Status": "CREATE_COMPLETE", 
    "NotificationARNs": [], 
    "RollbackConfiguration": { 
        "RollbackTriggers": [] 
    }, 
    "Capabilities": [ 
        "CAPABILITY_IAM", 
        "CAPABILITY_NAMED_IAM" 
    ], 
    "Changes": [ 
        { 
            "Type": "Resource", 
            "ResourceChange": { 
                "Action": "Modify", 
                "LogicalResourceId": "RDSDBCluster", 
                "PhysicalResourceId": "stack01-rdsdbclusterg-icyaselsdyot", 
                "ResourceType": "AWS::RDS::DBCluster", 
                "Replacement": "False", 
                "Scope": [ 
                    "Properties" 
                ], 
                "Details": [ 
                    { 
                        "Target": { 
                            "Attribute": "Properties", 
                            "Name": "MasterUserPassword", 
                            "RequiresRecreation": "Never" 
                        }, 
                        "Evaluation": "Dynamic", 
                        "ChangeSource": "DirectModification" 
                    }, 
                    { 
                        "Target": { 
                            "Attribute": "Properties", 
                            "Name": "MasterUserPassword", 
                            "RequiresRecreation": "Never" 
                        }, 
                        "Evaluation": "Static", 
                        "ChangeSource": "ParameterReference", 
                        "CausingEntity": "RDSMasterUserPassword" 
                    } 
                ] 
            } 
        } 
    ] 
} 

ChangeSet の実行、または削除

実行

$ aws cloudformation execute-change-set --stack-name ${STACK} --change-set-name ${CHANGE_SET} 

または削除

$ aws cloudformation delete-change-set --stack-name ${STACK} --change-set-name ${CHANGE_SET} 

一覧表示で確認

$ aws cloudformation list-change-sets --stack-name ${STACK} 
{ 
    "Summaries": [] 
}