mrvitej.in

Archive · AWS

CloudFormation: Change Sets, Drift and StackSets

Preview changes before applying them, detect manual edits and roll out to many accounts.

1 min read

  • AWS CloudFormation
  • StackSets
  • Drift detection

Change sets show what an update will do before you do it, including replacement of resources.

aws cloudformation deploy --template-file template.yaml --stack-name prod-network \
  --no-execute-changeset
aws cloudformation describe-change-set --stack-name prod-network --change-set-name <name>

Look for Replacement: True: replacing a database or load balancer causes downtime and data loss. Protect critical resources:

Database:
  Type: AWS::RDS::DBInstance
  DeletionPolicy: Snapshot
  UpdateReplacePolicy: Snapshot

Drift detection finds resources changed outside CloudFormation (someone edited a security group in the console):

aws cloudformation detect-stack-drift --stack-name prod-network
aws cloudformation describe-stack-resource-drifts --stack-name prod-network \
  --stack-resource-drift-status-filters MODIFIED DELETED

StackSets deploy one template to many accounts and regions, for example a baseline of CloudTrail and IAM roles across an AWS Organization with service-managed permissions.

Break big templates into nested stacks or separate stacks per layer (network, data, application), since a single stack has a limit of 500 resources.