是否可以执行命令，然后在CloudFormation模板中更新安全组？

Question

I would like to perform the following operations in order with CloudFormation.

1. Start up an EC2 instance.
2. Give it privileges to access the full internet using security group A.
3. Download particular versions of Java and Python
4. Remove its internet privileges by removing security group A and adding a security group B.

I observe that there is a DependsOn attribute for specifying the order in which to create resources, but I was unable to find a feature that would allow me to update the security groups on the same EC2 instance twice over the course of creating a stack.

Is this possible with CloudFormation?

Answer 1

Not in CloudFormation natively, but you could launch the EC2 instance with a configured userdata script that itself downloads Java/Python and the awscli , as necessary, and then uses the awscli to switch security groups for the current EC2 instance.

However, if all you need is Java and Python pre-loaded then why not simply create an AMI with them already installed and launch from that AMI?

Answer 2

The best way out is to utilise a Cloudformation custom resource here. You can create a lambda function that does exactly what you need. This lambda function can then be called as a custom resource function in the cloud formation template.

You can pass your new security group ID and instance ID to the lambda function and code the lambda function to use AWS SDK and do the modifications that you need.

I have leveraged it to post an update to my web server about the progress of the cloud formation template. Below is the sample code of the template.

EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Path: /
      Roles: [!Ref 'EC2Role']
  MarkInstanceProfileComplete:
    Type: 'Custom::EC2InstanceProfileDone'
    Version: '1.0'
    DependsOn: EC2InstanceProfile
    Properties: 
      ServiceToken: !Ref CustomResourceArn
      HostURL: !Ref Host
      LoginType: !Ref LoginType
      SecretId: !Ref SecretId
      WorkspaceId: !Ref WorkspaceId
      Event: 2
      Total: 3

Here the resource MarkInstanceProfileComplete is a custom resource that calls a Lambda function. It takes the event count and total count as input and processes them to calculate percentage progress. Based on that it sends out a request to my web server. For all we care, this Lambda function can do potentially anything you want it to do.