cfn-square
A CLI tool intended to simplify AWS CloudFormation handling. Originally forked from cfn-sphere.
Features
cfn-sphere
- cfn templates in yaml or json
- build for human interaction and automation (run 'cf sync stacks.yml' triggered by a git push if you dare -)
- a source of truth defining CloudFormation stacks with their template and parameters
- cross referencing parameters between stacks (use a stack output as parameter for another stack)
- automatic stack dependency resolution including circular dependency detection
- helper features easing the use of cfn functions like Fn::Join, Ref or Fn::GetAtt
- easy user-data definition for https://github.com/zalando-stups/taupage
- allow stack parameter values updates in command line interface
- encrypt/decrypt values with AWS KMS (https://aws.amazon.com/de/kms/)
cfn-square additional features
- Support for creating and executing CloudFormation change sets
Install
As Python artifact:
pip install cfn-square
Usage
$ cf --help
Usage: cf [OPTIONS] COMMAND [ARGS]...
This tool manages AWS CloudFormation templates and stacks by providing an
application scope and useful tooling.
Options:
--version Show the version and exit.
--help Show this message and exit.
Commands:
convert Convert JSON to YAML or vice versa
create-change-set create change set
decrypt Decrypt a given ciphertext with AWS Key Management Service
delete Delete all stacks in a stack configuration
encrypt Encrypt a given string with AWS Key Management Service
execute-change-set execute change set
render-template Render template as it would be used to create/update a stack
sync Sync AWS resources with definition file
validate-template Validate template with CloudFormation API
Getting Started with the sync command
1. Create Stacks Config
Create a YAML file containing a region and some stacks in a stacks.yml file f.e.:
region: eu-west-1
stacks:
test-vpc:
template-url: vpc.yml
test-stack:
template-url: app.yml
parameters:
vpcID: "|ref|test-vpc.id"
2. Write your CloudFormation templates
Write your templates and configure them in your stacks.yml. Optionally you can define placeholders in your stack config using the [to-be-replaced] notation and supply a 'transforms context' file.
Example
stacks.yml:
region: eu-west-1
stacks:
test-vpc:
template-url: vpc.yml
name: vpc[environment]
test-stack:
template-url: app.yml
parameters:
vpcID: "|ref|test-vpc.id"
Context (development environment):
dev.yml
environment: dev
staging.yml:
environment: staging
production.yml:
environment: production
This way your stacks.yml remains the same for all the environments.
3. Configure the account profile
cfn-square supports assuming AWS roles. The AWS CLI looks for role configurations in the user config file, located at ~/.aws/config. Each profile requires at least these properties to be configured:
[default]
region = eu-west-1
output = json
[profile accountrole]
source_profile = default
mfa_serial = arn:aws:iam::987654321987:mfa/jsmith.kcom.adm
role_arn = arn:aws:iam::123456789123:role/CA_KCOM_ADM
You need the mfa_serial for your admin user, and the role_arn of the admin role for the account. The AWS Practice Confluence page on cross account access explains this in more detail.
-
mfa_serialcan be found attached to your IAM user entry in your admin account. - To find the
role_arnfor the role that you need to assume, identify the environment that you intend to modify on the Admin Roles list on the AWS Sharepoint. Log in to the role with the link associated with the account, and you can find the ARN attached to theCA_KCOM_ADMrole in that account's IAM.
4. Sync it
A single command synchronizes your definition with reality!
cf sync stack.yml -t dev.yml --profile accountrole
Other features
Creating CloudFormation change sets
cfn-square can be used to create a change set based on the delta between an AWS account and your local config:
cf create-change-set stack.yml -t transforms.yml --profile accountrole
This creates a change set for each stack if it differs from your specified local config.
Executing CloudFormation change sets
cfn-square can also be used to execute change sets:
cf execute-change-set changeSetName --profile accountrole
changeSetName should be replaced with the name or ARN of the change set.
Parameterise Stack with CLI parameters
To pass stack parameters without having to modify the templates, simply use the --parameter or -p flag.
cf sync --parameter "test-stack.vpcID=vpc-123" --parameter "test-stack.subnetID=subnet-234" myapp-test.yml
Documentation
cfn-sphere documentation
For original cfn-sphere features read:
https://github.com/cfn-sphere/cfn-sphere/wiki
cfn-square documentation
For cfn-square specific features read:
https://github.com/KCOM-Enterprise/cfn-square/wiki
Config reference
See the wiki to see what you can do in a stack configuration: StackConfig Reference
Template reference
Cfn-Sphere supports native CloudFormation templates written in JSON or YAML, located in local filesystem or s3. There are some improvements like simplified intrinsic functions one can use. See the reference for details: Template Reference
Build
Requirements:
- python >= 3
- virtualenv
- pybuilder
Execute:
git clone git@github.com:KCOM-Enterprise/cfn-square.git
cd cfn-square
virtualenv .venv --python=python3
source .venv/bin/activate
pip install pybuilder
pyb install_dependencies
pyb
Contribution
- Create an issue to discuss the problem and track changes for future releases
- Create a pull request with your changes (as small as possible to ease code reviews)
License
Copyright 2015,2016 Marco Hoyer Copyright 2017 KCOM
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
