AWS AWSCloudFormation documentation change
Summary
Restructured tutorial steps, updated code examples to YAML format, added SSH key pair configuration, and modernized AMI references. Changed instance types and added security group configuration for SSH access.
Security assessment
The changes add documentation about configuring SSH access using key pairs and security group ingress rules (port 22 with CIDR restrictions), which are security-related features. However, there's no evidence this addresses a specific security vulnerability - it's standard security practice documentation.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/updating.stacks.walkthrough.md b/AWSCloudFormation/latest/UserGuide/updating.stacks.walkthrough.md index ca8466bbf..89ca3cd46 100644 --- a//AWSCloudFormation/latest/UserGuide/updating.stacks.walkthrough.md +++ b//AWSCloudFormation/latest/UserGuide/updating.stacks.walkthrough.md @@ -5 +5 @@ -A simple applicationCreate the initial stackUpdate the applicationChanging resource propertiesAdding resource propertiesChange the stack's resourcesAvailability and impact considerationsRelated resources +Step 1: Create the initial stackStep 2: Update the applicationStep 3: Add SSH access with a key pairStep 4: Update the instance typeStep 5: Update the AMIAvailability and impact considerationsRelated resources @@ -7 +7 @@ A simple applicationCreate the initial stackUpdate the applicationChanging resou -# Updating a stack +# Update a CloudFormation stack @@ -9 +9 @@ A simple applicationCreate the initial stackUpdate the applicationChanging resou -With CloudFormation, you can update the properties for resources in your existing stacks. These changes can range from simple configuration changes, such as updating the alarm threshold on a CloudWatch alarm, to more complex changes, such as updating the Amazon Machine Image (AMI) running on an Amazon EC2 instance. Many of the AWS resources in a template can be updated, and we continue to add support for more. +###### Note @@ -11 +11 @@ With CloudFormation, you can update the properties for resources in your existin -This section walks through a simple progression of updates of a running stack. It shows how the use of templates makes it possible to use a version control system for the configuration of your AWS infrastructure, just as you use version control for the software you are running. We will walk through the following steps: +This tutorial builds on concepts from the [Deploy applications on Amazon EC2](./deploying.applications.html) tutorial. If you haven't completed that tutorial, we recommend doing so first to understand EC2 bootstrapping with CloudFormation. @@ -13 +13 @@ This section walks through a simple progression of updates of a running stack. I - 1. Create the initial stack – create a stack using a base Amazon Linux AMI, installing the Apache Web Server and a simple PHP application using the CloudFormation helper scripts. +This topic demonstrates a simple progression of updates to a running stack. We will walk through the following steps: @@ -15 +15 @@ This section walks through a simple progression of updates of a running stack. I - 2. Update the application – update one of the files in the application and deploy the software using CloudFormation. + 1. Create the initial stack – Create a stack using a base Amazon Linux 2 AMI, installing the Apache Web Server and a simple PHP application using the CloudFormation helper scripts. @@ -17 +17 @@ This section walks through a simple progression of updates of a running stack. I - 3. Update the instance type – change the instance type of the underlying Amazon EC2 instance. + 2. Update the application – Update one of the files in the application and deploy the software using CloudFormation. @@ -19 +19 @@ This section walks through a simple progression of updates of a running stack. I - 4. Update the AMI on an Amazon EC2 instance – change the Amazon Machine Image (AMI) for the Amazon EC2 instance in your stack. + 3. Add a key pair – Add an Amazon EC2 key pair to the instance, and then update the security group to allow SSH access to the instance. @@ -21 +21 @@ This section walks through a simple progression of updates of a running stack. I - 5. Add a key pair to an instance – add an Amazon EC2 key pair to the instance, and then update the security group to allow SSH access to the instance. + 4. Update the instance type – Change the instance type of the underlying Amazon EC2 instance. @@ -23 +23 @@ This section walks through a simple progression of updates of a running stack. I - 6. Change the stack's resources – add and remove resources from the stack, converting it to an auto-scaled, load-balanced application by updating the template. + 5. Update the AMI – Change the Amazon Machine Image (AMI) for the Amazon EC2 instance in your stack. @@ -28 +28 @@ This section walks through a simple progression of updates of a running stack. I -## A simple application +###### Note @@ -30 +30 @@ This section walks through a simple progression of updates of a running stack. I -We'll begin by creating a stack that we can use throughout the rest of this section. We have provided a simple template that launches a single instance PHP web application hosted on the Apache Web Server and running on an Amazon Linux AMI. +CloudFormation is free, but you'll be charged for the Amazon EC2 resources you create. However, if you're new to AWS, you can take advantage of the [Free Tier](https://aws.amazon.com/free/) to minimize or eliminate costs during this learning process. @@ -32 +32 @@ We'll begin by creating a stack that we can use throughout the rest of this sect -The Apache Web Server, PHP, and the simple PHP application are all installed by the CloudFormation helper scripts that are installed by default on the Amazon Linux AMI. The following template snippet shows the metadata that describes the packages and files to install, in this case the Apache Web Server and the PHP infrastructure from the Yum repository for the Amazon Linux AMI. The snippet also shows the Services section, which ensures that the Apache Web Server is running. In the Properties section of the Amazon EC2 instance definition, the UserData property contains the CloudInit script that calls cfn-init to install the packages and files. +###### Topics @@ -33,0 +34 @@ The Apache Web Server, PHP, and the simple PHP application are all installed by + * Step 1: Create the initial stack @@ -35,11 +36 @@ The Apache Web Server, PHP, and the simple PHP application are all installed by - "WebServerInstance": { - "Type" : "AWS::EC2::Instance", - "Metadata" : { - "AWS::CloudFormation::Init" : { - "config" : { - "packages" : { - "yum" : { - "httpd" : [], - "php" : [] - } - }, + * Step 2: Update the application @@ -47 +38 @@ The Apache Web Server, PHP, and the simple PHP application are all installed by - "files" : { + * Step 3: Add SSH access with a key pair @@ -49,12 +40 @@ The Apache Web Server, PHP, and the simple PHP application are all installed by - "/var/www/html/index.php" : { - "content" : { "Fn::Join" : ["", [ - "<?php\n", - "echo '<h1>AWS CloudFormation sample PHP application</h1>';\n", - "echo '<p>", { "Ref" : "WelcomeMessage" }, "</p>';\n", - "?>\n" - ]]}, - "mode" : "000644", - "owner" : "apache", - "group" : "apache" - }, - }, + * Step 4: Update the instance type @@ -62 +42 @@ The Apache Web Server, PHP, and the simple PHP application are all installed by - : + * Step 5: Update the AMI @@ -64,8 +44 @@ The Apache Web Server, PHP, and the simple PHP application are all installed by - "services" : { - "sysvinit" : { - "httpd" : { "enabled" : "true", "ensureRunning" : "true" } - } - } - } - } - }, + * Availability and impact considerations @@ -73,5 +46 @@ The Apache Web Server, PHP, and the simple PHP application are all installed by - "Properties": { - : - "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [ - "#!/bin/bash\n", - "yum install -y aws-cfn-bootstrap\n", + * Related resources @@ -79 +47,0 @@ The Apache Web Server, PHP, and the simple PHP application are all installed by - : @@ -81,358 +48,0 @@ The Apache Web Server, PHP, and the simple PHP application are all installed by - "# Install the files and packages from the metadata\n", - "/opt/aws/bin/cfn-init -v ", - " --stack ", { "Ref" : "AWS::StackName" }, - " --resource WebServerInstance ", - " --region ", { "Ref" : "AWS::Region" }, "\n", - : - ]]}} - } - }, - -The application itself is a two-line "Hello World" example that's entirely defined within the template. For a real-world application, the files may be stored on Amazon S3, GitHub, or another repository and referenced from the template. CloudFormation can download packages (such as RPMs or RubyGems), and reference individual files and expand `.zip` and `.tar` files to create the application artifacts on the Amazon EC2 instance. - -The template enables and configures the cfn-hup daemon to listen for changes to the configuration defined in the metadata for the Amazon EC2 instance. By using the cfn-hup daemon, you can update application software, such as the version of Apache or PHP, or you can update the PHP application file itself from CloudFormation. The following snippet from the same Amazon EC2 resource in the template shows the pieces necessary to configure cfn-hup to call cfn-init to update the software if any changes to the metadata are detected: - - - "WebServerInstance": { - "Type" : "AWS::EC2::Instance", - "Metadata" : { - "AWS::CloudFormation::Init" : { - "config" : { - - : - - "files" : { - - : - - "/etc/cfn/cfn-hup.conf" : { - "content" : { "Fn::Join" : ["", [ - "[main]\n", - "stack=", { "Ref" : "AWS::StackName" }, "\n", - "region=", { "Ref" : "AWS::Region" }, "\n" - ]]}, - "mode" : "000400", - "owner" : "root", - "group" : "root" - }, - - "/etc/cfn/hooks.d/cfn-auto-reloader.conf" : { - "content": { "Fn::Join" : ["", [ - "[cfn-auto-reloader-hook]\n", - "triggers=post.update\n", - "path=Resources.WebServerInstance.Metadata.AWS::CloudFormation::Init\n", - "action=/opt/aws/bin/cfn-init -s ", { "Ref" : "AWS::StackId" }, " -r WebServerInstance ", - " --region ", { "Ref" : "AWS::Region" }, "\n", - "runas=root\n" - ]]} - } - }, - : - }, - - "Properties": { - - : - - "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [ - - : - - "# Start up the cfn-hup daemon to listen for changes to the Web Server metadata\n", - "/opt/aws/bin/cfn-hup || error_exit 'Failed to start cfn-hup'\n", - - : - ]]}} - } - }, - -To complete the stack, the template creates an Amazon EC2 security group. - - - { - "AWSTemplateFormatVersion" : "2010-09-09", - - "Description" : "AWS CloudFormation Sample Template: Sample template that can be used to test EC2 updates. **WARNING** This template creates an Amazon Ec2 Instance. You will be billed for the AWS resources used if you create a stack from this template.", - - "Parameters" : { - - "InstanceType" : { - "Description" : "WebServer EC2 instance type", - "Type" : "String", - "Default" : "t2.small", - "AllowedValues" : [ - "t1.micro", - "t2.nano", - "t2.micro", - "t2.small", - "t2.medium", - "t2.large", - "m1.small", - "m1.medium", - "m1.large", - "m1.xlarge", - "m2.xlarge", - "m2.2xlarge", - "m2.4xlarge", - "m3.medium", - "m3.large", - "m3.xlarge", - "m3.2xlarge", - "m4.large", - "m4.xlarge",