{"id":4439,"date":"2021-05-02T16:50:02","date_gmt":"2021-05-02T14:50:02","guid":{"rendered":"http:\/\/miro.borodziuk.eu\/?p=4439"},"modified":"2021-06-28T17:31:35","modified_gmt":"2021-06-28T15:31:35","slug":"cloudformation-8-stack-policies","status":"publish","type":"post","link":"http:\/\/miro.borodziuk.eu\/index.php\/2021\/05\/02\/cloudformation-8-stack-policies\/","title":{"rendered":"CloudFormation &#8211; 8 &#8211; Stack Policies"},"content":{"rendered":"<p><!--more--><\/p>\n<p>We have such a yaml template:<\/p>\n<pre class=\"lang:default decode:true\">Parameters:\r\n  VPCId:\r\n    Description: VPC to create the security group into\r\n    Type: AWS::EC2::VPC::Id\r\n  \r\n  CidrSSH:\r\n    Type: String\r\n    Default: \"0.0.0.0\/0\"\r\n\r\n  CidrHTTP:\r\n    Type: String\r\n    Default: \"0.0.0.0\/0\"\r\n\r\nResources:\r\n  SSHSecurityGroup:\r\n    Type: \"AWS::EC2::SecurityGroup\"\r\n    Properties:\r\n      GroupDescription: Test Drift SSH Security Group\r\n      SecurityGroupIngress:\r\n        - CidrIp: !Ref CidrSSH\r\n          FromPort: 22\r\n          ToPort: 22\r\n          IpProtocol: tcp\r\n      VpcId: !Ref VPCId\r\n\r\n  CriticalSecurityGroup:\r\n    Type: \"AWS::EC2::SecurityGroup\"\r\n    Properties:\r\n      GroupDescription: Test Drift HTTP Security Group\r\n      SecurityGroupIngress:\r\n        - CidrIp: !Ref CidrHTTP\r\n          FromPort: 80\r\n          ToPort: 80\r\n          IpProtocol: tcp\r\n      VpcId: !Ref VPCId\r\n<\/pre>\n<p>And a json Stack Policy:<\/p>\n<pre class=\"lang:default decode:true \">{\r\n    \"Statement\": [\r\n        {\r\n            \"Effect\": \"Allow\",\r\n            \"Action\": \"Update:*\",\r\n            \"Principal\": \"*\",\r\n            \"Resource\": \"*\"\r\n        },\r\n        {\r\n            \"Effect\": \"Deny\",\r\n            \"Action\": \"Update:*\",\r\n            \"Principal\": \"*\",\r\n            \"Resource\": \"LogicalResourceId\/CriticalSecurityGroup\"\r\n        },\r\n        {\r\n            \"Effect\" : \"Deny\",\r\n            \"Action\" : \"Update:*\",\r\n            \"Principal\": \"*\",\r\n            \"Resource\" : \"*\",\r\n            \"Condition\" : {\r\n              \"StringEquals\" : {\r\n                \"ResourceType\" : [\"AWS::RDS::DBInstance\"]\r\n              }\r\n            }\r\n        }\r\n    ]\r\n}<\/pre>\n<p>This stack policy which will allow us to update SSHSecurityGroup but update of CriticalSecurityGroup will be denied.<\/p>\n<p>So lets&#8217;s create a stack:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-4444 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation75.jpg\" alt=\"\" width=\"687\" height=\"695\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation75.jpg 687w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation75-297x300.jpg 297w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation75-100x100.jpg 100w\" sizes=\"(max-width: 687px) 100vw, 687px\" \/><\/p>\n<p><code>Next -&gt;<\/code><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-4445 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation76.jpg\" alt=\"\" width=\"699\" height=\"627\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation76.jpg 699w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation76-300x269.jpg 300w\" sizes=\"(max-width: 699px) 100vw, 699px\" \/><\/p>\n<p><code>Next -&gt;<\/code><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-4446 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation77.jpg\" alt=\"\" width=\"685\" height=\"711\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation77.jpg 685w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation77-289x300.jpg 289w\" sizes=\"(max-width: 685px) 100vw, 685px\" \/><\/p>\n<p><code>Next -&gt; Create stack<\/code><\/p>\n<p>The Stack has been created with stack\u00a0 policy. Now let&#8217;s try to update it.<\/p>\n<p>First we will update CidrSSH subnet:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-4448 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation78.jpg\" alt=\"\" width=\"702\" height=\"483\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation78.jpg 702w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation78-300x206.jpg 300w\" sizes=\"(max-width: 702px) 100vw, 702px\" \/><\/p>\n<p><code>Next -&gt; Next -&gt;\u00a0 Update stack<\/code><\/p>\n<p>And update has finished because stack policy allowed for this.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-4449 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation79.jpg\" alt=\"\" width=\"773\" height=\"565\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation79.jpg 773w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation79-300x219.jpg 300w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation79-768x561.jpg 768w\" sizes=\"(max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/p>\n<p>Now let&#8217;s try to update CidrHTTP:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-4450 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation80.jpg\" alt=\"\" width=\"723\" height=\"483\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation80.jpg 723w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation80-300x200.jpg 300w\" sizes=\"(max-width: 723px) 100vw, 723px\" \/><\/p>\n<p>Next -&gt; Next -&gt; Update stack<\/p>\n<p>Update of stack has failed because action was denied by the stack policy.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-4452 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation81.jpg\" alt=\"\" width=\"770\" height=\"540\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation81.jpg 770w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation81-300x210.jpg 300w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/CloudFormation81-768x539.jpg 768w\" sizes=\"(max-width: 767px) 89vw, (max-width: 1000px) 54vw, (max-width: 1071px) 543px, 580px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<div>\n<div>Read\u00a0more\u00a0here:<\/div>\n<div><a href=\"https:\/\/docs.aws.amazon.com\/AWSCloudFormation\/latest\/UserGuide\/protect-stack-resources.html\">https:\/\/docs.aws.amazon.com\/AWSCloudFormation\/latest\/UserGuide\/protect-stack-resources.html<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89],"tags":[],"_links":{"self":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/4439"}],"collection":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/comments?post=4439"}],"version-history":[{"count":6,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/4439\/revisions"}],"predecessor-version":[{"id":4453,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/4439\/revisions\/4453"}],"wp:attachment":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/media?parent=4439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/categories?post=4439"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/tags?post=4439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}