Saltar al contenido principal

Lab : CloudFormation

Objetivo​

Crear plantillas de CloudFormation para desplegar una infraestructura completa de manera reproducible.

Parte 1 : Plantilla Básica​

Ejercicio 1.1 : Security Group​

Cree una plantilla para un Security Group que permita HTTP y SSH:

AWSTemplateFormatVersion: "2010-09-09"
Description: Security Group pour serveur web

Resources:
  WebServerSG:
    Type: _______________
    Properties:
      GroupDescription: _______________
      SecurityGroupIngress:
        - IpProtocol: ___
          FromPort: ___
          ToPort: ___
          CidrIp: _______________
        - IpProtocol: ___
          FromPort: ___
          ToPort: ___
          CidrIp: _______________
💡 Solución
AWSTemplateFormatVersion: "2010-09-09"
Description: Security Group pour serveur web

Resources:
  WebServerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP and SSH access
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

Ejercicio 1.2 : Agregar Parámetros​

Mejore la plantilla con parámetros:

Parameters:
  SSHLocation:
    Type: _______________
    Default: _______________
    Description: IP range for SSH access
    AllowedPattern: _______________
    ConstraintDescription: Must be valid CIDR

  Environment:
    Type: String
    AllowedValues:
      - ___
      - ___
      - ___
💡 Solución
Parameters:
  SSHLocation:
    Type: String
    Default: 0.0.0.0/0
    Description: IP range for SSH access
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: Must be valid CIDR (e.g., 10.0.0.0/24)

  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - staging
      - prod
    Description: Environment type

Luego en el Security Group:

SecurityGroupIngress:
  - IpProtocol: tcp
    FromPort: 22
    ToPort: 22
    CidrIp: !Ref SSHLocation

Parte 2 : Instancia EC2​

Ejercicio 2.1 : Plantilla EC2 Completa​

AWSTemplateFormatVersion: "2010-09-09"
Description: Web Server avec EC2

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues: [dev, staging, prod]
  
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium]

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 Key Pair

Mappings:
  RegionAMI:
    us-east-1:
      AMI: ami-0c55b159cbfafe1f0
    eu-west-1:
      AMI: ami-0d729a60

Resources:
  # Complétez les ressources
  WebServerSG:
    Type: _______________
    # ...

  WebServer:
    Type: _______________
    Properties:
      ImageId: _______________
      InstanceType: _______________
      KeyName: _______________
      SecurityGroupIds:
        - _______________
      Tags:
        - Key: Name
          Value: _______________
      UserData:
        Fn::Base64: |
          #!/bin/bash
          # Complétez le script

Outputs:
  PublicIP:
    Value: _______________
  WebURL:
    Value: _______________
💡 Solución Completa
AWSTemplateFormatVersion: "2010-09-09"
Description: Web Server avec EC2

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues: [dev, staging, prod]
  
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium]

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 Key Pair

Mappings:
  RegionAMI:
    us-east-1:
      AMI: ami-0c55b159cbfafe1f0
    eu-west-1:
      AMI: ami-0d729a60

Resources:
  WebServerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP and SSH
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-web-sg"
        - Key: Environment
          Value: !Ref Environment

  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !FindInMap [RegionAMI, !Ref "AWS::Region", AMI]
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyName
      SecurityGroupIds:
        - !Ref WebServerSG
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-web-server"
        - Key: Environment
          Value: !Ref Environment
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum update -y
          yum install -y httpd
          systemctl start httpd
          systemctl enable httpd
          echo "<h1>Environment: ${Environment}</h1>" > /var/www/html/index.html
          echo "<p>Instance Type: ${InstanceType}</p>" >> /var/www/html/index.html

Outputs:
  InstanceId:
    Description: Instance ID
    Value: !Ref WebServer
  
  PublicIP:
    Description: Public IP
    Value: !GetAtt WebServer.PublicIp
  
  WebURL:
    Description: Website URL
    Value: !Sub "http://${WebServer.PublicIp}"

Parte 3 : VPC Completa​

Ejercicio 3.1 : Arquitectura VPC​

Cree una plantilla para esta arquitectura:

┌─────────────────────────────────────────────────────────────┐
│                    VPC 10.0.0.0/16                          │
│                                                              │
│   ┌─────────────────────┐    ┌─────────────────────┐       │
│   │   Public Subnet     │    │   Private Subnet    │       │
│   │   10.0.1.0/24       │    │   10.0.2.0/24       │       │
│   │                     │    │                     │       │
│   │   ┌───────────┐     │    │   ┌───────────┐     │       │
│   │   │    EC2    │     │    │   │    EC2    │     │       │
│   │   │   (web)   │     │    │   │   (app)   │     │       │
│   │   └───────────┘     │    │   └───────────┘     │       │
│   │                     │    │                     │       │
│   └─────────────────────┘    └─────────────────────┘       │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Plantilla a completar:

Resources:
  # VPC
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: _______________
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

  # Internet Gateway
  InternetGateway:
    Type: _______________

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: _______________
      InternetGatewayId: _______________

  # Public Subnet
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: _______________
      CidrBlock: _______________
      MapPublicIpOnLaunch: ___
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public"

  # Private Subnet
  PrivateSubnet:
    Type: _______________
    # Complétez...

  # Route Table Public
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: _______________
      DestinationCidrBlock: _______________
      GatewayId: _______________

  PublicSubnetRouteAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: _______________
      RouteTableId: _______________
💡 Solución
AWSTemplateFormatVersion: "2010-09-09"
Description: VPC avec subnets public et private

Parameters:
  Environment:
    Type: String
    Default: dev

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-igw"

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [0, !GetAZs ""]
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public"

  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      MapPublicIpOnLaunch: false
      AvailabilityZone: !Select [0, !GetAZs ""]
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-private"

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-rt"

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetRouteAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

Outputs:
  VPCId:
    Value: !Ref VPC
    Export:
      Name: !Sub "${AWS::StackName}-VPCId"
  
  PublicSubnetId:
    Value: !Ref PublicSubnet
    Export:
      Name: !Sub "${AWS::StackName}-PublicSubnetId"
  
  PrivateSubnetId:
    Value: !Ref PrivateSubnet
    Export:
      Name: !Sub "${AWS::StackName}-PrivateSubnetId"

Parte 4 : Resolución de Problemas​

Ejercicio 4.1 : Identificar Errores​

Esta plantilla contiene errores. Encuéntrelos:

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  InstanceType:
    Type: string  # Erreur 1
    Default: t3.micro

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-12345678
      InstanceType: !Ref instancetype  # Erreur 2
      SecurityGroups:
        - !Ref MySG  # Erreur 3 (ordre)
      Tags:
        - Key: Name
          Value: !Sub ${AWS:StackName}-instance  # Erreur 4

  MySG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription  # Erreur 5
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
💡 Soluciones
  1. Error 1: string → String (mayúscula)
  2. Error 2: instancetype → InstanceType (respetar la mayúscula del parámetro)
  3. Error 3: MySG debe estar definido antes o usar DependsOn
  4. Error 4: AWS:StackName → AWS::StackName (doble dos puntos)
  5. Error 5: Falta : "Description" después de GroupDescription

Plantilla corregida:

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  InstanceType:
    Type: String
    Default: t3.micro

Resources:
  MySG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Security group for web server"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-12345678
      InstanceType: !Ref InstanceType
      SecurityGroupIds:
        - !Ref MySG
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-instance"

Parte 5 : Proyecto Final​

Ejercicio 5.1 : Infraestructura Completa​

Cree una plantilla para la siguiente arquitectura:

┌─────────────────────────────────────────────────────────────┐
│                    Arquitectura Web 3-Tiers                  │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│   Internet → ALB → EC2 (Auto Scaling) → RDS                 │
│                                                              │
│   Componentes requeridos:                                    │
│   • VPC con 2 subnets públicas y 2 privadas                 │
│   • Security Groups (ALB, EC2, RDS)                        │
│   • Application Load Balancer                               │
│   • Launch Template + Auto Scaling Group                   │
│   • RDS MySQL (opcional)                                   │
│                                                              │
│   Parámetros:                                                │
│   • Environment (dev/staging/prod)                         │
│   • InstanceType                                            │
│   • MinSize, MaxSize, DesiredCapacity                      │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Criterios de Validación​

CriterioPuntos
Plantilla válida (sin errores)/15
Parámetros bien definidos/15
VPC correctamente configurada/20
Security Groups restrictivos/15
ALB + ASG funcionales/20
Outputs útiles/10
Documentación/comentarios/5
Total/100

Entregable Final​

Documento a Producir​

  1. Plantilla CloudFormation completa (YAML)
  2. Instrucciones de despliegue (comandos CLI)
  3. Esquema de la arquitectura
  4. Lista de parámetros y valores
  5. Pruebas de validación realizadas

¡Fin del curso! Le deseamos mucho éxito en su recorrido por AWS.