The Secret Life of AWS: The Blueprint

#aws#cloudformation#devops#cloud

Stop clicking in the console. How to use AWS CloudFormation (YAML) to automate your infrastructure.

Part 15 of The Secret Life of AWS

Timothy sat at his desk, staring at two monitors. On the left screen was his production application—secure, encrypted, and monitored. On the right screen was a blank AWS Console.

He let out a long, heavy sigh.

Margaret stopped by his desk. "Why the long face, Timothy? Your application is running perfectly."

"I know," Timothy said. "But now the team wants a Staging Environment to test new features. I have to rebuild the entire thing from scratch. The VPC, the Lambda functions, the DynamoDB tables, the Alarms, the IAM roles..."

He clicked a button on the screen. "It took me three weeks to build it the first time. I am afraid I will miss a checkbox or forget an encryption setting."

Margaret reached over and closed the browser tab on his right monitor.

"Friends don't let friends do ClickOps," she said. "Stop clicking. Start coding."

"Today," she said, "we discuss Infrastructure as Code (IaC). Specifically, AWS CloudFormation."

The Template (YAML)

Margaret opened a text editor.

"Right now, your infrastructure exists only in your head and in the AWS Console," she said. "If you delete it, it is gone. To fix this, we define the infrastructure in a text file called a Template."

"We write this template in YAML," she explained. "It stands for YAML Ain't Markup Language. It is a data format designed to be easily read by humans. Unlike other formats that use heavy brackets or tags, YAML simply uses indentation to define structure."

She typed a simple block of YAML code:

Resources:
  MyUserTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: Users-Staging
      BillingMode: PAY_PER_REQUEST
      SSESpecification:
        SSEEnabled: true

"This is Declarative," Margaret noted. "You do not write a script that says 'Click this button, then wait, then click that.' You simply declare: 'I want a DynamoDB table with Encryption enabled.' AWS reads this file and figures out how to create it."

"So the infrastructure is just text?" Timothy asked.

"Yes. It is code. You can save it in Git. You can version control it. You can review it. And most importantly, you can copy it."

The Stack (Provisioning)

"So how do I run it?"

"You upload the Template to AWS CloudFormation," Margaret said. "You can do this via the Console, the command line (CLI), or an automated pipeline."

"CloudFormation reads the file and creates a Stack. A Stack is simply the collection of real AWS resources—the actual Table, the actual Lambda function—that were created by your Template."

"If you want a Staging environment," she continued, "you just upload the same Template again and name the stack Staging-Stack. If you want a Production environment, you upload it and name it Production-Stack."

"It takes minutes," she added. "Not weeks. And they are guaranteed to be identical."

Drift (Configuration Management)

Timothy nodded, impressed. "This is powerful. I will write the template."

He paused. "But what if I need to make a quick change? Can I just go into the DynamoDB console and change a setting manually?"

"You can," Margaret warned, "but you must not."

"This creates Drift."

"Drift happens when the reality (the Stack) no longer matches the definition (the Template)," she explained.

"Imagine your Template says the database capacity is '5'. But one day, you manually increase it to '10' in the console. The next time you deploy your Template, CloudFormation looks at the file, sees '5', and resets your database back to '5'. You could cause a production outage simply because you touched the console."

"So the Console is read-only?"

"Ideally, yes," Margaret said. "If you want to change the infrastructure, you change the code. You validate it with aws cloudformation validate-template, and then you update the Stack."

The Lesson

Timothy looked at the blank console, then at the text editor. He realized that clicking buttons wasn't "building"—it was just manual labor.

"I need to write a Template for the Database," Timothy said. "And the Lambda functions. And the Alarms."

"Write it once," Margaret smiled. "Deploy it anywhere."

She tapped the monitor.

"Infrastructure is no longer hardware, Timothy. It is software. Treat it with the same respect you treat your application code."

---

Aaron Rose is a software engineer and technology writer at tech-reader.blog and the author of Think Like a Genius.