This session will walk through practical examples and live demonstrations using AWS CloudFormation, AWS OpsWorks, orchestration engines and source control systems to automate your infrastructure deployment and maintenance.

1. Automating your Infrastructure Deployment
with CloudFormation and OpsWorks
Richard Busby, Solutions Architect
Amazon Web Services

2. Business
101 Technical
201 Technical
301 Technical
401 Technical
Session Grading

3. Why treat your infrastructure as code?
• Repeatable deployments
• Versioned Infrastructure as code
• Use-case specific deployments
• Management at scale
• Application automation

4. A simple Wordpress deployment with
CloudFormation
Users
Web Server RDS Database
MySQL
security group
security group

5. Automating instance configuration:
using cfn-init
"Resources" : {
"WebServer": {
"Type": "AWS::EC2::Instance",
"Metadata" : {
"AWS::CloudFormation::Init" : {
"config" : {
"packages" : {
"httpd" : ["2.4.12"]
}
"commands" : {
"WriteDemoToFile" : {
"command" : "echo "Demo" > test.txt"
}
}
},
"UserData" : {
"/opt/aws/bin/cfn-init -s<stackID>
-r<ResourceID> --region <Region>"
}
• Packages
• Groups
• Users
• Sources
• Files
• Commands
• Services

6. Automating instance configuration:
using cfn-init
"Resources" : {
"WebServer": {
"Type": "AWS::EC2::Instance",
"Metadata" : {
"AWS::CloudFormation::Init" : {
"config" : {
"packages" : {
"httpd" : ["2.4.12"]
}
"commands" : {
"WriteDemoToFile" : {
"command" : "echo "Demo" > test.txt"
}
}
},
"UserData" : {
"/opt/aws/bin/cfn-init -s<stackID>
-r<ResourceID> --region <Region>"
}
• Packages
• Groups
• Users
• Sources
• Files
• Commands
• Services

7. Automating instance configuration:
using cfn-init
"Resources" : {
"WebServer": {
"Type": "AWS::EC2::Instance",
"Metadata" : {
"AWS::CloudFormation::Init" : {
"config" : {
"packages" : {
"httpd" : ["2.4.12"]
}
"commands" : {
"WriteDemoToFile" : {
"command" : "echo "Demo" > test.txt"
}
}
},
"UserData" : {
"/opt/aws/bin/cfn-init -s<stackID>
-r<ResourceID> --region <Region>"
}
• Packages
• Groups
• Users
• Sources
• Files
• Commands
• Services

8. How cfn-init works
instance
stack
#> cfn-init
-–stack <stackname>
--resource <resourcename>
"AWS::CloudFormation::Init" :
{
"config" : {
"packages" : {
"httpd" : ["2.4.12"]
}
"commands" : {
"WriteDemoToFile" : {
"command" : "echo
"Demo" > test.txt"
}
}
}
}
Get metadata,
perform actions
AWS
CloudFormation

9. Signaling instance configuration:
creationPolicy
"Resources" : {
"WebServer": {
"Type": "AWS::EC2::Instance",
"CreationPolicy": {
"ResourceSignal": {
"Count": "1",
"Timeout": "PT15M"
}
}
},
"Metadata" : {
"UserData" : {
"/opt/aws/bin/cfn-signal –-stack <stackID>
--resource <ResourceID> --success"
}
}
• Property of an EC2 instance
or Auto Scaling Group
• Inform CloudFormation when
configuration is complete

10. Signaling instance configuration:
creationPolicy
"Resources" : {
"WebServer": {
"Type": "AWS::EC2::Instance",
"CreationPolicy": {
"ResourceSignal": {
"Count": "1",
"Timeout": "PT15M"
}
}
},
"Metadata" : {
"UserData" : {
"/opt/aws/bin/cfn-signal –-stack <stackID>
--resource <ResourceID> --success"
}
}
• Property of an EC2 instance
or Auto Scaling Group
• Inform CloudFormation when
configuration is complete

11. How creationPolicy works
#> cfn-signal --success
--stack <stackname>
--resource <resourcename>
Send completion signal
"AWS::CloudFormation::Init" :
{
"config" : {
"packages" : {
"httpd" : ["2.4.12"]
}
"commands" : {
"WriteDemoToFile" : {
"command" : "echo
"Demo" > test.txt"
}
}
}
}
instance
stack
AWS
CloudFormation

12. Completing instance configuration:
WaitCondition
"Resources" : {
"WaitCondition" : {
"Type" : "AWS::CloudFormation::WaitCondition",
"DependsOn" : "WebServer",
"Properties" : {
"Handle" : {"Ref" : "WaitHandle"},
"Timeout" : "600"
}
},
"WebServer": {
"Type": "AWS::EC2::Instance",
"Metadata" : {
"UserData" : {
"/opt/aws/bin/cfn-signal –success <waitconditionhandle>"
}
}
• A separate resource

13. Completing instance configuration:
WaitCondition
WaitCondition
Resource
"Count": "2"
Instance A
stackAWS
CloudFormation
Instance B
#> cfn-signal
–-success <URL>
Send
Completion signal
#> cfn-signal
–-success <URL>

14. Create Templates from your environment with
CloudFormer

15. The love story so far...
• Repeatable deployments

16. Versioning your infrastructure
Users
Web Server RDS Database
MySQL
security group security groupRoute 53

17. • Modify existing template
• Or create a new one
– Ensure all resources are
present
• Infrastructure as Code:
– Store in version control
– Store with your code
– Git, Subversion, etc
Update your template, apply it to the stack
"Resources" : {
"BrandNewDNSrecord" : {
"Type" : "AWS::Route53::RecordSet",
"Properties" : {
"Comment" : "Demo for Summit 2015",
"HostedZoneId" : "ABC123BUZZY",
"Name" : "summit.buzzy.geek.nz.",
"TTL" : "60",
"Type" : "A"
}
}
}

18. Controlling stack updates: Resource updates

19. Controlling stack updates: Resource updates

20. • Prevent updates to
resources within the stack
• Explicitly override during
updates
– A temporary change of
policy
Controlling stack updates: stack policies
{
"Statement" : [
{
"Effect" : "Deny",
"Action" : "Update:*",
"Principal": "*",
"Resource" : "*"
}
]
}

21. Updating a stack where resource properties
require replacement

22. Controlling stack updates: DeletionPolicy
"Resources" : {
"myS3Bucket" : {
"Type" : "AWS::S3::Bucket",
"DeletionPolicy" : "Retain"
}
}

23. Demo 1

24. The love story so far...
• Repeatable deployments
• Versioned Infrastructure
as code

25. Deploying different environments
• Multiple similar environments
– Production
– Test, Development
– Multiple AWS regions
• Avoid becoming a template factory
– Fewer, more adaptable templates

26. Example: Production or Dev?
stack
Auto Scalingstack
Elastic Load
Balancing
template
Web Server
security group
RDS Database
MySQL
security group security group
Instances
RDS Database
MySQL
security group

27. • A parameter to specify
the kind of stack
Parameters and Conditions
"Parameters" : {
"EnvironmentType" : {
"Description" : "Production or Development environment",
"AllowedValues" : [ "Prod", "Dev" ],
"ConstraintDescription" : "Must be Prod or Dev"
}
"Conditions" : {
"UseProdCondition" : {
"Fn::Equals" : [{"Ref" : "EnvironmentType"}, "Prod"]
},
"UseDevCondition" : {
"Fn::Equals" : [{"Ref" : "EnvironmentType"}, "Dev"]
}
"Resources": {
"WebServer": {
"Type": "AWS::EC2::Instance",
"Condition": "useDevCondition",
},

28. • A parameter to specify
the kind of stack
• Conditions that will be
evaluated
Parameters and Conditions
"Parameters" : {
"EnvironmentType" : {
"Description" : "Production or Development environment",
"AllowedValues" : [ "Prod", "Dev" ],
"ConstraintDescription" : "Must be Prod or Dev"
}
"Conditions" : {
"UseProdCondition" : {
"Fn::Equals" : [{"Ref" : "EnvironmentType"}, "Prod"]
},
"UseDevCondition" : {
"Fn::Equals" : [{"Ref" : "EnvironmentType"}, "Dev"]
}
"Resources": {
"WebServer": {
"Type": "AWS::EC2::Instance",
"Condition": "UseDevCondition",
},

29. • A parameter to specify
the kind of stack
• Conditions that will be
evaluated
• Determines whether a
resource or property
should be created
Parameters and Conditions
"Parameters" : {
"EnvironmentType" : {
"Description" : "Production or Development environment",
"AllowedValues" : [ "Prod", "Dev" ],
"ConstraintDescription" : "Must be Prod or Dev"
}
"Conditions" : {
"UseProdCondition" : {
"Fn::Equals" : [{"Ref" : "EnvironmentType"}, "Prod"]
},
"UseDevCondition" : {
"Fn::Equals" : [{"Ref" : "EnvironmentType"}, "Dev"]
}
"Resources": {
"WebServer": {
"Type": "AWS::EC2::Instance",
"Condition": "UseDevCondition",
},

30. Example: Production or Dev?
stack
Auto Scalingstack
Elastic Load
Balancing
template
Web Server
security group
RDS Database
MySQL
security group security group
Instances
Parameter:
Prod or Dev
RDS Database
MySQL
security group

31. • Logic about how a
resource will be created
Mappings
"Parameters" : {
"EnvironmentType" : {
"Description" : "Production or Development environment",
"AllowedValues" : [ "Prod", "Dev" ],
"ConstraintDescription" : "Must be Prod or Dev"
},
"Mappings" : {
"SourceAMI" : {
"Prod" : { "ap-southeast-1" : "ami-d34db33f", "us-east-1" : "ami-12345678" },
"Dev" : { "ap-southeast-1" : "ami-d5f8fc0d", "us-east-1" : "ami-b6c63d8f" }
}
}
"Resources": {
"WebServer": {
"ImageID" : { "Fn::FindInMap" : [ "SourceAMI", { "Ref" : "EnvironmentType" },
{ "Ref" : "AWS::Region" ] }

32. • A mapping consists of
two-level key:value pairs
Mappings
"Parameters" : {
"EnvironmentType" : {
"Description" : "Production or Development environment",
"AllowedValues" : [ "Prod", "Dev" ],
"ConstraintDescription" : "Must be Prod or Dev"
},
"Mappings" : {
"SourceAMI" : {
"Prod" : { "ap-southeast-1" : "ami-d34db33f", "us-east-1" : "ami-12345678" },
"Dev" : { "ap-southeast-1" : "ami-d5f8fc0d", "us-east-1" : "ami-b6c63d8f" }
}
}
"Resources": {
"WebServer": {
"ImageID" : { "Fn::FindInMap" : [ "SourceAMI", { "Ref" : "EnvironmentType" },
{ "Ref" : "AWS::Region" ] }

33. Looking up the mapping
"Parameters" : {
"EnvironmentType" : {
"Description" : "Production or Development environment",
"AllowedValues" : [ "Prod", "Dev" ],
"ConstraintDescription" : "Must be Prod or Dev"
},
"Mappings" : {
"SourceAMI" : {
"Prod" : { "ap-southeast-1" : "ami-d34db33f", "us-east-1" : "ami-12345678" },
"Dev" : { "ap-southeast-1" : "ami-d5f8fc0d", "us-east-1" : "ami-b6c63d8f" }
}
}
"Resources": {
"WebServer": {
"ImageID" : { "Fn::FindInMap" : [ "SourceAMI", { "Ref" : "EnvironmentType" },
{ "Ref" : "AWS::Region" ] }
• Referenced by a property

34. Demo 2

35. The love story so far...
• Repeatable deployments
• Versioned Infrastructure as code
• Use-case specific deployments

36. Expanding your use of CloudFormation:
Working with multiple templates
An inevitability as you grow
• Stack limits (60 outputs, 200 resources, 51200 bytes)
• Segregation of duties
• Velocity of change
Layers of stacks
• Identity
• Network
• Shared services
• Back end services
• Front end services

37. Nested stacks
stack
stack
template
Amazon VPC
Auto Scaling
Elastic Load
Balancing
RDS Database
MySQL
security group security group
Instances

38. Chaining stacks together
stack
stack
template ”Outputs" : {
”VPCInfo" : {
”VPCName” : {
”Fn::GetAtt" : { ”VPC:Name”}
}
»VPCid" : {
”Fn::GetAtt" : { ”VPC::ID” }
}
}
Outputs
#> DeployComputeStack.rb
Amazon VPC
Auto Scaling
Elastic Load
Balancing
security group
Instances

39. The love story so far...
• Repeatable deployments
• Versioned Infrastructure as code
• Use-case specific deployments
• Management at scale

54. OpsWorks: Model your application

55. OpsWorks lifecycle events
setup configure deploy undeploy shutdown

56. Chef recipe
+
Metadata
=
Command
execute "mysql-connect" do
command "/usr/bin/mysql
-u#{node[:deploy][:myphpapp][:database][:username]}
-p#{node[:deploy][:myphpapp][:database][:password]}
#{node[:deploy][:myphpapp][:database][:database]}
…
"deploy": {
"myphpapp": {
"database": {
"username": "root",
"password": "abcxyz",
…
"/usr/bin/mysql -uroot –pabcxyz myphpapp …
Configure with Chef recipes

57. App Server
RDS Database
Setup Configure Deploy Execute recipes Shutdown
App Server
Attach recipes to events
Setup Configure Deploy
Change
permissions
Setup Configure
Configure

58. • OpsWorks items as
CloudFormation
resources
• Automate deployment
with CloudFormation
• Automate "Day 2"
management tasks
with OpsWorks
Combining OpsWorks and CloudFormation
"Resources" : {
"WordPressStack" : {
"Type" : "AWS::OpsWorks::Stack",
"Properties" : {
"Name" : "MyWordPressStack",
"ServiceRoleArn" : "arn:aws:iam::0123456789:role/service-
role",
"DefaultSshKeyName" : {"Ref":"KeyName"}
}
},
"myLayer": {
"Type": "AWS::OpsWorks::Layer",
"Properties": {
"StackId": {"Ref": "WordPressStack"},
"Name": "PHP App Server",
"Type": "php-app"
}
}

59. The love story…
• Repeatable deployments
• Versioned Infrastructure as code
• Use-case specific deployments
• Management at scale
• Application automation

60. Next steps
• Get the templates used in this session:
http://s3.buzzy.geek.nz/summit2015
• Experiment!