Hello and come back with our last lecture about cloud formation.
So let's not them out.
This is decs creating or calling a stack or a template from within another template.
So unless stacks are stacked that create other stacks Why would I use it.
I could have a large template that is going to launch a stack and within this template I need or the
resulting stack I need to use that will be multiple times.
So instead of writing the attributes and the properties for that multiple times why don't I just call
the stack that launches and be for me in the resulting bigger stack.
So to create an instance stack use there's a resource under cloud formation which is a stack resource
in your template.
Use it in your template to call reference other templates within your template.
So one big template called different smaller templates.
Think about programs when you have models where you have functions that you can call Unisys stacks to
reuse common template patterns.
And as your infrastructure grows cold and patterns can emerge in which you declare the same components
in each of your templates like ill be like auto scaling.
You can separate out the common components instead of having them within them.
The mother template and create dedicated templates for them.
That way you can mix and match different templates but use nested stacks to create a single bigger unified
stack.
Let's talk about cross stack references which I think also I have touched on briefly.
When do you use it you use it to export shared resources.
So when you organize your elements in resources based on lifecycle and ownership and instead of including
all of your resources in one stack you create related resources in separate stacks then you can referencing
from one another.
So one will be exporting.
Remember when you looked at the import value function in interesting functions we looked at exporting
from one and importing from the other one.
So when you use the crosschecked references.
It to export resources from a stack so that other stacks can use them.
So how can the other ones important using the function important value function as we saw before.
And that's how one will be exporting and the other one will be importing.
So let's take an example let's say for example you have a network stack and the network stack or a template
has the BBC Security Group and a subnet for a public web application and a separate public with application
stack.
So I have two templates two stacks.
One will take care of the VPC Security Group and subnet and the other one will be the web application
stack that will include the web application part so can include the lambda functions can include include
the two instances the easiest containers so on and so forth.
Fine but now when don't have that at the end what do they have.
I would have the VPC created from Stack number one.
Right.
This is number two.
So this is the web app and this is the infra structure.
So the BBC is right there and then I have the security group and the subnet.
This is my security group.
I have all that.
But the applications stack the application guys the application team or the application developers they
need to read to run the other template such that it's going to run the easy to instances inside that
subnet right to run the web and then provide them and also it needs to use the security group in order
to apply to the eyes of these two instances.
So in order to ensure that web applications that will be launched in the easy to instance use the security
group and subnet from the network stack What do I do you need to cross reference or cross tag or cross
stack reference that allows the web application stack which is run by the Web Application developers
are pushing developers to reference the source outputs from the network stack.
What will be the resource output when I am on the network stack and going to get a VPC.
I'm going to get a security group.
I'm going to be at a subnet right.
So what do I need.
I need the VBC ID I need the security group Id need the subnet ID such that I can launch two instances
and then I can reference in the import value function that ID of that security group and VPC to apply
it to create the instance within the subnet based on the subnet Id apply the security group to it inside
the VPC.
So with that cross reference owners of the web applications that dont need to create or maintain networking
rules or assets exactly like what happens today today.
Exactly like what happens on premise.
Some security best practices for cloud formation only allow specific templates and stack policies.
What do you mean here.
And I remember when we said that when you when you are going to create a stack then you need to define
the template that will be used.
Right.
So you can only limit two specific templates and stack policies that you have configure and have control
so you can provide the you are l and this is only what will be allowed to be created that template will
be created for those specific group of I am users.
And also when you come there that could be the application development team where you will allow them
only to deal with easy too but they have nothing to do with S-3 or they have nothing to do with our
ideas that will be for the rest of his team.
So you can restrict what resource type can the I am principles create which I am principals depending
on the group so the group will have right on our ideas and creating RLDS and multiagency and all that.
The storage team will have right on S-3 and creating buckets and all that the application and development
team will have the easy to and abs and so on and so forth that has to do with AC too.
All right.
So restrict what resource types can on and principle create.
Why.
Because you don't want someone who is supposed to launch an easy to instance to end up launching easy
intense and or just going in groups and elbows and elbows and security and knuckles and so on and so
forth so you have to be careful about who does what through I am permissions and I remember who ever
creates a template then that template cannot do more than what the permissions of this user can do.
But if you define an IBM role and then embedded when you are creating the stack then whatever permissions
in the same rule will apply for what resources can be created what can be deleted and so on and so forth.
OK how about cloud trail and asinus.
So classful mission integrates with cloud trail and as you mentioned before if logging is enabled and
you define a bucket for cloud to intercept the logs it will not only send the cloud mission logs its
going to send every single call that cloud for the mission is going to do even to the other end of your
services steps during processing the stack whether it has succeeded or it has failed.
If you are deleting one then all these API calls will be logged in you are looking back at our history
record that you have defined when you enable that.
Also cloud trail can send events to two Asinus for notification purposes so when cloud formation will
create a stack delete the stack so on and so forth it can be integrated with Asinus and not vacation's
for that.
So that was it about cloud formation I hope it is clear now.
So let's take a break now.
Thank you.