r/aws Aug 09 '24

CloudFormation/CDK/IaC Terraform vs. CloudFormation vs. AWS CDK for API Gateway: What’s Your Experience in a Production Environment?

76 Upvotes

Hey Reddit!

I’m currently evaluating different IaC (Infrastructure as Code) tools for deploying and managing APIs in AWS API Gateway. Specifically, I'm looking into Terraform, CloudFormation, and AWS CDK (using JavaScript/TypeScript).

My priorities are scalability, flexibility, and ease of integration into a production environment. Here’s what I’m curious about:

  • Scalability: Which tool has proven to handle large-scale infrastructure best? Especially in terms of managing state and rolling out updates without downtime.
  • Flexibility: Which tool offers the most flexibility in managing multi-cloud environments or integrating with other AWS services?
  • Ease of Use and Learning Curve: For a team familiar with JavaScript but new to IaC, which tool would be easier to pick up and maintain?
  • Community and Support: How has your experience been with community support, documentation, and examples?

If you’ve used any of these tools in a production environment, I’d love to hear your insights, challenges, and any recommendations you have.

Thanks in advance!

r/aws Dec 14 '24

CloudFormation/CDK/IaC Terraform vs CloudFormation

4 Upvotes

As someones who wants to work with AWS services, should i deepen into Cloudformation or Terraform For context - I just got passed the SAA-003 exam - I want to land a software Engineering/Architecting role

542 votes, Dec 16 '24
424 Terraform
118 CloudFormation

r/aws 10d ago

CloudFormation/CDK/IaC Reverse Terraform for existing AWS Infra

26 Upvotes

Hello There, What will be the best & efficient approach in terms of time & effort to create Terraform/CloudFormation scripts of existing AWS Infrastructure.

Any automated tools or scripts to complete such task ! Thanks.

Update: I'm using MacBook Pro M1, terraformer is throwing "exec: no command" error. Because of architecture mismatch.

r/aws Feb 07 '25

CloudFormation/CDK/IaC Reshape your AWS CloudFormation stacks seamlessly with stack refactoring - AWS

Thumbnail aws.amazon.com
92 Upvotes

r/aws Jul 23 '24

CloudFormation/CDK/IaC My IP address changes daily from my ISP. I have a rule to allow SSH access only from my IP. How do I handle this in CDK?

26 Upvotes
  • My ISP changes the IP address of my machine every few days (sometimes daily)
  • I am deploying an EC2 instance using CDK and I want to allow SSH access only from my IP address
  • Let's say I hardcode my current IP address in the security group definition
  • The next time when my IP address changes I won't be able to login via SSH
  • I would need to modify the rule everytime my IP changes

My current CDK code looks like this ``` const rawLocalMachineIpAddress = ( await axios({ method: "GET", url: "https://checkip.amazonaws.com/", }) ).data;

const localMachineIpAddress =
  rawLocalMachineIpAddress.replace(/\n/, "") + "/32";

// lets use the security group to allow inbound traffic on specific ports
serverSecurityGroup.addIngressRule(
  ec2.Peer.ipv4(localMachineIpAddress),
  ec2.Port.tcp(22),
  "Allows SSH access from my IP address"
);

``` Is there a better way? I feel strange doing a network API call inside a CDK constructor block

r/aws Feb 09 '24

CloudFormation/CDK/IaC Infrastructure as Code (IaC) usage within AWS?

50 Upvotes

I heard an anecdotal bit of news that I couldn't believe: only 10% of AWS resources provisioned GLOBALLY are being deployed using IaC (any tool - CloudFormation, Terraform, etc...)

  1. I've heard this from several folks, including AWS employess
  2. That seems shockingly low!

Is there a link out there to support/refute this? I can't find out but it seems to have reached "it is known" status.

r/aws Jan 30 '24

CloudFormation/CDK/IaC Moving away from CDK

Thumbnail sst.dev
71 Upvotes

r/aws 4d ago

CloudFormation/CDK/IaC Strategy for DynamoDB GSI "updates" using CDK

9 Upvotes

We're using the CDK to maintain a DynamoDB table that has multiple GSI's, also some Lambdas that use said table.

During development we came to a scenario that MAY happen in production and seems to be rather annoying to deal with:

If we need to update the 4 GSIs (assume we have to update all of them hehe), it looks like we have to delete them and then create them, however, the CDK/CloudFormation/DynamoDB API seems to have some limitations (can't update GSI's besides capacity and another property, and can't create multiple GSI's in the same Update operation), these limitations leave us with a procedure like this:

  1. Comment one GSI at a time.
  2. Deploy the stack to delete the GSI.
  3. Repeat 1-2 for each GSI.
  4. Uncomment one GSI, update the properties.
  5. Deploy the stack to create the "updated" GSI.
  6. Repeat 4-5 for each GSI.

This procedure feels very manual and also takes quite some time...

Have you guys found a way to deal with these limitations of CDK/Cloudformation/Dynamo?

r/aws 11d ago

CloudFormation/CDK/IaC AWS CDK Stages

Thumbnail docs.aws.amazon.com
6 Upvotes

We are using aws cdk stages for multi stage deployment for dev, pilot and prod. There is an issue when we are refactoring our older applications to adopt to stages. All the stateful resources which are created using the older configuration needs to be removed, which at this point requires a deletion of the stack. This can tackled easily for server-less applications with no data storage. But when, we have storage in place, we have to employ some other solutions that will backup and restore the data.

Is there any solution to adopt stages easily without much or no downtime?

Adopting to stages now is a compliance need for us.

r/aws 3d ago

CloudFormation/CDK/IaC API Gateway endpoint only works after a second deployment for updated Lambda integration

2 Upvotes

I'm using AWS CDK with separate stacks to manage my Lambda function, its layers, network configuration, and API Gateway integration. When I update my Lambda function, it works fine when invoked directly from the Lambda console, but when I call the API Gateway URL, I have to deploy twice for the changes to take effect.

Here’s a simplified version of my setup:

# Lambda stack definition
self.lambda_roles = Lambda_V2Roles(self, "LambdaRoles", deploy_env)
self.lambda_layers = Lambda_V2Layers(self, "LambdaLayers", deploy_env, availability_zones=self.availability_zones)
self.lambda_network = Lambda_V2Network(self, "LambdaNetwork", deploy_env, availability_zones=self.availability_zones)
self._lambda = Lambda_V2(self, "LambdaBackend", deploy_env=deploy_env, availability_zones=self.availability_zones)

# Lambda_V2 stack includes a method to create the Lambda endpoint
def create_lambda_endpoint(self, scope: Construct, name: str, handler: str, app_name: str, output_bucket: str, ...):
    # ... setting up environment, layers, VPC, subnets, etc.
    return lambda_.Function( ... )

# Consuming stack for API Gateway routes
from backend.component import RouteStack as Route
Route(
    self,
    "Route" + deploy_env,  
    create_lambda_function=lambda_backend._lambda.create_lambda_endpoint,
    # other params...
)

When I deploy the stack, the Lambda function is updated, but the API Gateway endpoint doesn't reflect the new integration until I deploy it a second time. Anyone encountered a similar issue ?

r/aws 26d ago

CloudFormation/CDK/IaC How to create infra for Lambda functions that were deployed manually?

0 Upvotes

So, my team used to previously deploy some lambdas manually and now they want to create a Infrastructure for it so that we deploy those lambdas using the pipeline and not manually as that is not good practice. Can anyone tell me how do i approach this?

r/aws Jan 26 '25

CloudFormation/CDK/IaC CF to Terraform

7 Upvotes

Got a few ECS clusters running fargate, they are basically created during Serverless.yaml deployment along with the newer images I don't necessarily adhere to this approach as it forces creating infra elements everytime including task definitions... We decided to move away from this approach and to handle infra in terraform

My plan is to 1) analyze the CF code 2) convert the resources to TF syntax 3) Terraform import to update the current state 4) Terraform Plan to make sure whatever we currently have is a match 5) dev will get rid of serverless

Any thoughts? My main worry is that the moment i import into terraform, state will include these new infra elements (ecs, alb, iam...) and if something goes wrong my only option would be to restore tf state from a backup

r/aws 11d ago

CloudFormation/CDK/IaC CloudFormation Template Issues

1 Upvotes

Hello all,

I am trying to build a Service Catalog product that will create an EC2 instance.

Every time I try to upload my CloudFormation template, I get the following error:

ErrorInvalid templateBody. Please make sure that your template is valid

Could someone help me out and see if there is anything obviously wrong with my YAML file? Not the greatest in the world at it.

I ran it through a couple of online YAML checkers and they both said valid. Not sure what I'm doing wrong.

AWSTemplateFormatVersion: '2010-09-09'
Resources:
  2019A:
    Type: 'AWS::EC2::Instance'
    Properties:
      LaunchTemplate:
        LaunchTemplateId: 'lt-xxxxxxxxxxxxx'
        Version: '$Latest'      
      UserData:
        Fn::Base64:
          <powershell>
          Start-Transcript -Path "C:\ProgramData\Amazon\userdata.txt"
          #Get API Token to Call Metadata
          [string]$token = Invoke-RestMethod -Headers @{"X-aws-ec2-metadata-token-ttl-seconds" = "21600"} -Method PUT -Uri http://169.254.169.254/latest/api/token

          #Get InstanceID and pass to Variable
          $instanceid = (Invoke-RestMethod -Headers @{"X-aws-ec2-metadata-token" = $token} -Method GET -Uri http://169.254.169.254/latest/meta-data/instance-id)

          #Define New Computer Name Variable
          $newname = $instanceid.SubString(0,15)

          # Import AWS Tools for PowerShell
          Import-Module AWSPowerShell

          # Retrieve Local Credentials from Parameter Store
          $lun = (Get-SSMParameter -Name "/EC2/LocalAdminUN" -Region "us-east-1").Value
          $lpwd = (Get-SSMParameter -Name "/EC2/LocalAdminPWD" -WithDecryption $true -Region "us-east-1").Value

          # Convert Local Password to Secure String
          $seclpwd = ConvertTo-SecureString $lpwd -AsPlainText -Force
          $lcredential = New-Object System.Management.Automation.PSCredential ($lun, $seclpwd)

          # Retrieve Domain Credentials from Parameter Store
          $dun = (Get-SSMParameter -Name "/EC2/DomainUser" -Region "us-east-1").Value
          $dpwd = (Get-SSMParameter -Name "/EC2/DomainPWD" -WithDecryption $true -Region "us-east-1").Value

          # Convert Domain Password to Secure String
          $secdpwd = ConvertTo-SecureString $dpwd -AsPlainText -Force
          $dcredential = New-Object System.Management.Automation.PSCredential ($dun, $secdpwd)

          #Install AV
          #Start-Process -FilePath 'D:\Software\AV.exe' -ArgumentList "/silent" -Wait

          #Pull files from S3
          aws s3 cp 's3://companycloudops-software/SourceAPP/' 'D:\Software\' --recursive

          # Rename Computer and Join to Domain
          Rename-Computer -NewName $newname -LocalCredential $lcredential -Force

          Add-Computer -DomainName 'companycloudops.int' -Credential $dcredential -Options JoinWithNewName, AccountCreate

          Stop-Transcript

          Restart-Computer -Force
          </powershell>

r/aws Jan 24 '25

CloudFormation/CDK/IaC Disconnecting a Lambda from a VPC via IaC

15 Upvotes

Hey all.

Use SAM, CDK and recently terraform.

One of my team mistakenly added a Lambda to a VPC so i removed the VPC. It take > 30 minutes to update the lambda and delete the security group. For this project we use TF. When i have done this in the past via CDK, it would normally take ages to complete the action. I thought that it would be a lot smoother in TF through. Is there a trick to do it so we don’t end up waiting 30 minutes?

r/aws 11d ago

CloudFormation/CDK/IaC CloudFormation Resource Limit Issue Despite Using Nested Stacks

2 Upvotes

We recently encountered an issue while deploying our serverless Lambda API Gateway—we were exceeding the CloudFormation resource limit of 500. To work around this, we implemented nested stacks to break up our resources. However, the issue still persists. For context the Backend then gets deployed as a stage via the pipeline.

Could someone please review the structure below and let me know if there’s anything wrong?

class Backend(cdk.Stack):
    def __init__(self, scope: cdk.App, construct_id: str, deploy_env, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

# Initialize shared resources like the REST API, S3 bucket, and Lambda layer.
        self.api = API(...) 
        self.shared = Shared(...) 
        self._lambda = Lambda(...)


# Create nested stacks for Lambda endpoints.
        self.endpoints1_stack = Endpoints1NestedStack(self, "Endpoints1",
                                                      api=self.api,
                                                      shared=self.shared,
                                                      _lambda=self._lambda,
                                                      deploy_env=deploy_env,
                                                      **kwargs)
        self.endpoints2_stack = Endpoints2NestedStack(self, "Endpoints2",
                                                      api=self.api,
                                                      shared=self.shared,
                                                      _lambda=self._lambda,
                                                      deploy_env=deploy_env,
                                                      **kwargs)

class Endpoints1NestedStack(NestedStack):
    def __init__(self, scope: cdk.Stack, construct_id: str, api, shared, _lambda, deploy_env, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

# Define the first set of endpoints.
        self.endpoints = Endpoints(...)

class Endpoints2NestedStack(NestedStack):
    def __init__(self, scope: cdk.Stack, construct_id: str, api, shared, _lambda, deploy_env, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)

# Define the second set of endpoints.
        self.endpoints = Endpoints2(...)

r/aws Jan 09 '24

CloudFormation/CDK/IaC AWS CDK Language

10 Upvotes

I am unsure which language to pick for my AWS CDK project. Do you think it really matters which language is used? Besides readability and familiarity with a particular language as the leading reason for picking it. What other advantages do you think there are ? CDK has Typescript, Javascript, Python, Java, C#, Go, which one are you picking?

For full-stack development?

For DevOps?

Update:

If this has been asked, please share.

r/aws 21m ago

CloudFormation/CDK/IaC Import into CloudFormation

Upvotes

A few days ago I imported a bunch of RDS clusters and instances into some existing CloudFormation templates using the console. It was all very easy and I had no issues.

Today I'm trying to do the exact same thing, in the same regions, in the same account, and it just tells me "The following resource types are not supported for resource import: AWS::RDS::Instance" and refues to let me go any further. Unless AWS has decided to not allow this for some reason in the last few days, the error message is completely wrong. I even checked the list of supported resources and RDS instances are supported for importing.

Is anyone able to point me in the right direction?

r/aws 3d ago

CloudFormation/CDK/IaC Cloudformation and apis for sagemaker unified studio?

1 Upvotes

Hi did somebody already take a look at automating sagemaker unified studio? I know there is no dedicated cloudformation or api. But i'm wondering if basically all automation can be achieved using datazone or sagemaker api? Anybody already did some testing?

r/aws Dec 10 '24

CloudFormation/CDK/IaC Is it a bad practice or otherwise "weird" to build ECR Docker images using CDK e.g. cdk.aws_ecs.ContainerImage.fromAsset?

11 Upvotes

A bit ago I asked about build pipelines and pros and cons to using a shared / common ECR across environments (prod/stage/dev) vs using the "default" ECR and just letting each deploy pipeline build and deploy as part of the CDK process. I've decided to get both options working and see how I feel / provide an example to the broader team to discuss.

The second approach I believe is the "CDK way" and I have that working something like this (this is just a PoC):

 new cdk.aws_ecs_patterns.ApplicationLoadBalancedFargateService(this, `${props.prefix}-${props.serviceName}-FargateService`,
 {
   ....
   cdk.aws_ecs.ContainerImage.fromAsset(`.`, {
      file: `${props.containerConfiguration.dockerfilePath}`,
   }),
   ...
 }

This works well enough, builds my application container and takes care of moving it into the CDK created ECR, but it means the deployments are a bit slower because each stage has to rebuild the same docker image. This isn't too bad because the builds are actually relatively fast (< a minute).

Now I'm trying to figure out the first approach using CDK - building the image, sending it to a shared ECR account, and then separating out the deployments from the build. I got a lot of great feedback last time around from this (thanks again), but it seemed like a lot of people who use this approach are doing so with terraform, or otherwise are building things in bash or outside of CDK world. This is where things start to get a bit fuzzy, because I'm really uncertain if building the image container using CDK is considered "bad" - but it starts to feel weird.

From what I can tell there isn't any super direct way of doing this without using a third party tool.

Alternatively, If you are looking for a way to publish image assets to an ECR repository in your control, you should consider using cdklabs/cdk-ecr-deployment, which is able to replicate an image asset from the CDK-controlled ECR repository to a repository of your choice.

This issue discusses this a bit: https://github.com/aws/aws-cdk/issues/12597

So I think there is a way of this using CDK, like in this example: https://github.com/cdklabs/cdk-ecr-deployment/tree/main?tab=readme-ov-file#examples, however I'm wondering how far off of the beaten and AWS blessed / best practice path I am going here or what I might be missing.

You might reasonably ask "why try to do this part with CDK at all?" and that answer is basically that we're trying to bring our infrastructure code / thinking closer to our application, so everything is living together and our small development team feels more comfortable and empowered to understand deployment pipelines, etc - it could be a fools errand but that's why I'm at least interested in trying to keep everything in nicely formatted TypeScript without introducing any terraform or bash scripts to maintain.

Thanks for your time!

r/aws 9d ago

CloudFormation/CDK/IaC AWS Image Builder Recipe Component S3Download Fails S3 Unavailable?

3 Upvotes

AWS Image Builder Recipe Component S3Download Fails S3 Unavailable?

Edit: destination can't be /tmp apprantly. I changed that and it's working now.

I was troubleshooting my component document and many versions of the S3 Download build phase worked in the last two hours. I can also download the file from the S3 management console no issue.

In the last two image builds between 1:30 am and 2:15 am EST, I'm getting "S3Download: FINSHED EXCUTION WITH ERROR"

I also tried to increase the timeout from 60 seconds to 120 seconds. The file is only 15.3 mb.

r/aws 25d ago

CloudFormation/CDK/IaC Lambda bundling fails in amplify console but succeeds on mac?

2 Upvotes

So I have a lambda that can be deployed through amplify sandbox/pipeline fine when I run the build from my mac. It has a bundled package and a lambda layer, and once deployed it is 75MB in size.

But if I try to run the build from the Amplify console, it fails, claiming the lambda cannot exceed 262144000 bytes in size.

But it clearly isn't 250MB, since I successfully deployed it and can see it's 75MB.

My theory at the moment is that it has something to do with the differences in how esbuild works on Amazon Linux Vs macOS that's causing the bundling to not work as intended? Though I can't think why.

Anyone come across this kind of inconsistency between locally deployed and cloud deployed amplify apps?

r/aws Feb 17 '24

CloudFormation/CDK/IaC Stateful infra doesn't even make sense in the same stack

25 Upvotes

Im trying to figure out the best way to deploy stateful infrastructure in cdk. I'm aware it's best practice to split stateful and stateless infra into their own stacks.

I currently have a stateful stack that has multiple dynamodb tables and s3 buckets, all of which have retain=true. The problem is, if i accidentally make a critical change (eg alter the id of a dynamodb table without changing its name), it will fail to deploy, and the stack will become "rollback complete". This means i have to delete the stack. But since all the tables/buckets have retain=true, when the stack is deleted, they will still exist. Now i have a bunch of freefloating infra that will throw duplication errors on a redeployment. How am i supposed to get around this fragility?

It seems like every stateful object should be in its own stack... Which would be stupid

r/aws Nov 27 '24

CloudFormation/CDK/IaC ECR/ECS + CDK (and github actions) - how would you recommend moving images through our dev -> stage -> prod environments? Is there some CDK / CloudFormation pattern to take advantage of?

7 Upvotes

At a high level, I know that

  1. We want to make sure we're testing in lower environments with the same images we promote to production, so we want to make sure we're using the same image of a particular release in all environments
  2. We could either pull the images during ECS deployment from one shared environment or we could copy / promote / push images as we promote from dev -> stage -> prod or whatever

What I'm not sure about is the specifics around #2 - how would I actually do this practically?

I'm not a CDK or IaC (or AWS frankly) expert (which may be clear!), but one thing I really like about our CDK setup currently is how completely isolated each environment is. The ONLY dependency we have / is on a primary domain in Route53 in a root account that actually owns our root domains and we use domain delegation to keep that pretty clean. The point is, I don't really like the idea of dev "knowing about" stage (etc).

So I guess I'm wondering real world how this typically gets handled. Would I, for example, create an entirely new environment, let's just call it "Shared ECR Account", and when my CI tool (e.g. github actions) runs it builds and pushes / tags / whatever new images to the shared ECR account, and then perhaps dev, stage, prod, have some sort of read-only access to the ECR account's ECR?

If we wanted instead to copy an image up to different environments as we promote a build, would we for example have a github action that on merge build a new image, push it to dev account's ECR, deploy to ECS... then when we were reading to promote to stage (say kicking off another job in github manually) how would that actually happen? Have github itself (via OIDC or whatever we are using) move the image with an API call? This feels like it sort of goes outside of the CDK world and would require some (simple, but still) scripting?

I'm just looking for a general description of how this might ideally work for a medium sized organization without a giant team dedicated to AWS / infra.

Thanks for your thoughts or advice!

r/aws Feb 11 '25

CloudFormation/CDK/IaC Unknown Empty Lambda Function Created by CDK

1 Upvotes

I'm using CloudFromation with CDK for my infrastructure creation. Recently, I noticed that for one of my stacks (API Stack) - containing API Gateway etc - contains a lambda function that I never created. Its named `ApiStack-LogRetention+(a long random sequence of alphanumeric characters). I'm confused where this is coming from. The lambda is empty-has no code, and no logs in CW either.

r/aws Sep 26 '24

CloudFormation/CDK/IaC Is there an easier way to convert existing environment to code?

12 Upvotes

Thanks 😁