Every year, just in time for re:invent, AWS announces a plethora of upgrades to the services in the AWS ecosphere. This year is no different, even though re:invent will be completely virtual.
For anyone using CloudFormation and nested stacks, one of the major frustrations has been the inability to see what changes are being applied to the nested stacks when doing a stack update. In case you missed it, on November 18, 2020, AWS released a change to CloudFormation allowing users to see the changesets being applied to the nested stacks.
What’s a nested stack you ask?
A nested stack is when one CloudFormation stack has another stack as a resource. Consider this fragment:
# select the VPC the stack is being deployed in.
Description: Select the VPC
- Name: containerInsights
BucketName: !Ref BucketName
This fragment creates the ECS Cluster resource named ClusterA, and then uses another CloudFormation stack to create the LoadBalancer resource by using the
AWS::CloudFormation::Stack resource type. The nested stack template must exist in an S3 bucket accessible to CloudFormation. Assuming the templates are deployed to an S3 bucket, we can use either the CloudFormation console or the AWS CLI to create the stack and its resources.
aws cloudformationcreate-stack --stack-name my-sample-changeset --template-url https://labr-cfn.s3.amazonaws.com/parent.yaml --parameters "ParameterKey=BucketName,ParameterValue=my-sample-changset"
We can use the console to verify the stack:
With the resources created, what happens when we want to apply a change to those resources?
To illustrate using the changeset, let’s change the name of our S3 bucket.
As we progress through the update process in the console, we get to the last page where we can review the changes being applied. We are interested in the Changeset Preview section.
Prior to November 18, 2020, the changeset preview would list only the stack name. The link to “View nested stack changeset” did not exist. To see the changes being applied to our nested stack, click on the link.
We can see the changes being applied to our stack. We cannot execute the changeset from this view, there is a warning at the top of the page indicating the changeset can only be executed or deleted from the root changeset.
Click to return to the root changeset, and then execute the changeset. At this point, the view changes back to the parent stack events.
From this view, we can continue to monitor the progress of our update as normal.
This is a very nice addition to CloudFormation as the changes being applied to the nested stacks may not be what we expect, especially in complex stacks. By reviewing the changes being applied to our nested stacks, we can choose to not deploy the change should there be an impact we are not expecting.
It would be nice to see all of the changes in the single view, instead of having to navigate through each nested changeset, but this is a good start.
About the Author
Chris is a highly-skilled Information Technology, AWS Cloud, Training and Security Professional bringing cloud, security, training, and process engineering leadership to simplify and deliver high-quality products. He is the co-author of seven books and author of more than 70 articles and book chapters in technical, management, and information security publications. His extensive technology, information security, and training experience make him a key resource who can help companies through technical challenges. Chris is a member of the AWS Community Builder Program.
This article is Copyright © 2020, Chris Hare.