Ressources CloudFormation

---

Introduction aux ressources

Les ressources sont le cœur d'un template CloudFormation. Elles représentent les composants AWS à créer.

Resources:
  LogicalResourceName:
    Type: AWS::Service::Resource
    Properties:
      PropertyName: PropertyValue

---

Syntaxe d'une ressource

Resources:
  MyWebServer:                    # Nom logique (unique dans le template)
    Type: AWS::EC2::Instance      # Type de ressource AWS
    DependsOn: MySecurityGroup    # Dépendance explicite (optionnel)
    Condition: IsProduction       # Condition (optionnel)
    DeletionPolicy: Retain        # Politique de suppression (optionnel)
    UpdateReplacePolicy: Retain   # Politique de remplacement (optionnel)
    Metadata:                     # Métadonnées (optionnel)
      Comment: Serveur web principal
    Properties:                   # Propriétés spécifiques au type
      InstanceType: t3.micro
      ImageId: ami-12345678

---

Types de ressources courants

EC2 - Compute

Resources:
  # Instance EC2
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t3.micro
      ImageId: !Ref AMIId
      KeyName: !Ref KeyPair
      SecurityGroupIds:
        - !Ref WebSecurityGroup
      SubnetId: !Ref PublicSubnet
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 20
            VolumeType: gp3
            Encrypted: true
      UserData:
        Fn::Base64: |
          #!/bin/bash
          yum update -y
          yum install -y httpd
          systemctl start httpd
          systemctl enable httpd
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-webserver'

  # Auto Scaling Group
  WebASG:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      LaunchTemplate:
        LaunchTemplateId: !Ref WebLaunchTemplate
        Version: !GetAtt WebLaunchTemplate.LatestVersionNumber
      MinSize: 2
      MaxSize: 10
      DesiredCapacity: 2
      VPCZoneIdentifier:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      TargetGroupARNs:
        - !Ref WebTargetGroup
      HealthCheckType: ELB
      HealthCheckGracePeriod: 300

VPC - Networking

Resources:
  # VPC
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-vpc'

  # Internet Gateway
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-igw'

  # Attachment
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  # Public Subnet
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-public-subnet'

  # Route Table
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-public-rt'

  # Route
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  # Association
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

S3 - Storage

Resources:
  # Bucket S3
  DataBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${AWS::StackName}-data-${AWS::AccountId}'
      VersioningConfiguration:
        Status: Enabled
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      LifecycleConfiguration:
        Rules:
          - Id: TransitionToIA
            Status: Enabled
            Transitions:
              - StorageClass: STANDARD_IA
                TransitionInDays: 30
              - StorageClass: GLACIER
                TransitionInDays: 90
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-data'

  # Bucket Policy
  DataBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref DataBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: EnforceHTTPS
            Effect: Deny
            Principal: '*'
            Action: 's3:*'
            Resource:
              - !GetAtt DataBucket.Arn
              - !Sub '${DataBucket.Arn}/*'
            Condition:
              Bool:
                'aws:SecureTransport': false

RDS - Database

Resources:
  # Subnet Group
  DBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: Subnets for RDS
      SubnetIds:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-db-subnet-group'

  # Security Group
  DBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for RDS
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          SourceSecurityGroupId: !Ref AppSecurityGroup

  # RDS Instance
  Database:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Snapshot
    UpdateReplacePolicy: Snapshot
    Properties:
      DBInstanceIdentifier: !Sub '${AWS::StackName}-db'
      DBInstanceClass: db.t3.medium
      Engine: postgres
      EngineVersion: '15.4'
      MasterUsername: !Ref DBUsername
      MasterUserPassword: !Ref DBPassword
      AllocatedStorage: 20
      MaxAllocatedStorage: 100
      StorageType: gp3
      StorageEncrypted: true
      MultiAZ: true
      DBSubnetGroupName: !Ref DBSubnetGroup
      VPCSecurityGroups:
        - !Ref DBSecurityGroup
      BackupRetentionPeriod: 7
      PreferredBackupWindow: '03:00-04:00'
      PreferredMaintenanceWindow: 'Mon:04:00-Mon:05:00'
      EnablePerformanceInsights: true
      DeletionProtection: true
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-database'

IAM - Identity

Resources:
  # IAM Role
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${AWS::StackName}-ec2-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: S3Access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource: !Sub '${DataBucket.Arn}/*'

  # Instance Profile
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: !Sub '${AWS::StackName}-ec2-profile'
      Roles:
        - !Ref EC2Role

---

Dépendances

Dépendances implicites

CloudFormation détecte automatiquement les dépendances via !Ref et !GetAtt.

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16

  Subnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC  # Dépendance implicite sur VPC
      CidrBlock: 10.0.1.0/24

Dépendances explicites

Utilisez DependsOn quand la dépendance n'est pas détectable.

Resources:
  VPCGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: VPCGatewayAttachment  # Dépendance explicite
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

---

Politiques de suppression

Resources:
  # Retain - Conserver la ressource
  CriticalData:
    Type: AWS::S3::Bucket
    DeletionPolicy: Retain
    Properties:
      BucketName: critical-data

  # Snapshot - Créer un snapshot avant suppression (RDS, EBS)
  Database:
    Type: AWS::RDS::DBInstance
    DeletionPolicy: Snapshot
    Properties:
      # ...

  # Delete - Supprimer (défaut)
  TempBucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: temp-bucket

Politique	Description	Types supportés
Delete	Supprime la ressource (défaut)	Tous
Retain	Conserve la ressource	Tous
Snapshot	Crée un snapshot	RDS, Redshift, EC2 Volume

---

Attributs de ressources

Chaque type de ressource expose des attributs accessibles via !GetAtt.

Resources:
  MyBucket:
    Type: AWS::S3::Bucket

  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      # ...

Outputs:
  BucketArn:
    Value: !GetAtt MyBucket.Arn
  
  BucketDomainName:
    Value: !GetAtt MyBucket.DomainName
  
  InstancePublicIP:
    Value: !GetAtt MyInstance.PublicIp
  
  InstancePrivateIP:
    Value: !GetAtt MyInstance.PrivateIp
  
  InstanceAZ:
    Value: !GetAtt MyInstance.AvailabilityZone

---

Ressources personnalisées

Pour des cas non couverts par CloudFormation natif :

Resources:
  CustomResource:
    Type: Custom::MyResource
    Properties:
      ServiceToken: !GetAtt CustomLambda.Arn
      Parameter1: value1
      Parameter2: value2

  CustomLambda:
    Type: AWS::Lambda::Function
    Properties:
      FunctionName: !Sub '${AWS::StackName}-custom-resource'
      Runtime: python3.11
      Handler: index.handler
      Role: !GetAtt LambdaRole.Arn
      Code:
        ZipFile: |
          import cfnresponse
          import boto3
          
          def handler(event, context):
              try:
                  if event['RequestType'] == 'Create':
                      # Logique de création
                      pass
                  elif event['RequestType'] == 'Update':
                      # Logique de mise à jour
                      pass
                  elif event['RequestType'] == 'Delete':
                      # Logique de suppression
                      pass
                  
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, {})
              except Exception as e:
                  cfnresponse.send(event, context, cfnresponse.FAILED, {'Error': str(e)})

---

Résumé

• Les ressources sont définies dans la section Resources
• Chaque ressource a un nom logique unique
• Le Type détermine le service AWS
• Properties configure la ressource
• Les dépendances peuvent être implicites ou explicites
• DeletionPolicy contrôle le comportement à la suppression

---

← Bases des Templates | Paramètres →