Sintaxis y Plantillas CloudFormation

Introducción

CloudFormation utiliza plantillas en YAML o JSON para definir la infraestructura. Este capítulo cubre la sintaxis en detalle y proporciona ejemplos prácticos de plantillas.

Estructura de una Plantilla

# Estructura completa de una plantilla CloudFormation
AWSTemplateFormatVersion: "2010-09-09"

Description: >
  Descripción de lo que hace la plantilla
  (opcional pero recomendado)

Metadata:
  # Información adicional (opcional)

Parameters:
  # Valores de entrada personalizables (opcional)

Mappings:
  # Correspondencias clave-valor estáticas (opcional)

Conditions:
  # Lógica condicional (opcional)

Transform:
  # Macros o SAM (opcional)

Resources:
  # Recursos AWS a crear (OBLIGATORIO)

Outputs:
  # Valores de salida (opcional)

Sección Parameters

Sintaxis Básica

Parameters:
  EnvironmentType:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - staging
      - prod
    Description: Tipo de entorno

  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
    Description: Tipo de instancia EC2

  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Nombre del par de claves SSH

  VpcCidr:
    Type: String
    Default: 10.0.0.0/16
    AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$
    Description: CIDR del VPC

Tipos de Parámetros AWS

Parameters:
  # Tipos básicos
  StringParam:
    Type: String
  
  NumberParam:
    Type: Number
    MinValue: 1
    MaxValue: 100
  
  ListParam:
    Type: List<Number>
  
  CommaListParam:
    Type: CommaDelimitedList

  # Tipos AWS específicos
  EC2KeyPair:
    Type: AWS::EC2::KeyPair::KeyName
  
  SecurityGroupId:
    Type: AWS::EC2::SecurityGroup::Id
  
  SubnetId:
    Type: AWS::EC2::Subnet::Id
  
  VpcId:
    Type: AWS::EC2::VPC::Id
  
  AMIId:
    Type: AWS::EC2::Image::Id
  
  AvailabilityZone:
    Type: AWS::EC2::AvailabilityZone::Name

  # Listas AWS
  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
  
  SecurityGroupIds:
    Type: List<AWS::EC2::SecurityGroup::Id>

Sección Resources

Sintaxis de un Recurso

Resources:
  NomLogiqueRessource:
    Type: AWS::Service::Resource
    Properties:
      Property1: Value1
      Property2: Value2
    DependsOn:
      - AutreRessource
    DeletionPolicy: Retain | Delete | Snapshot
    UpdateReplacePolicy: Retain | Delete | Snapshot
    Condition: MaCondition

Ejemplos de Recursos Comunes

VPC

Resources:
  MonVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: MonVPC-Production

Subnet

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MonVPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: Public-Subnet-1

Internet Gateway

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: MonIGW

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref MonVPC
      InternetGatewayId: !Ref InternetGateway

Security Group

  WebSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group para servidor web
      VpcId: !Ref MonVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 10.0.0.0/8
      Tags:
        - Key: Name
          Value: Web-SG

EC2 Instance

  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: !Ref AMIId
      KeyName: !Ref KeyPairName
      SubnetId: !Ref PublicSubnet1
      SecurityGroupIds:
        - !Ref WebSecurityGroup
      Tags:
        - Key: Name
          Value: WebServer-1
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum update -y
          yum install -y httpd
          systemctl start httpd
          systemctl enable httpd
          echo "Hello from ${AWS::StackName}" > /var/www/html/index.html

Funciones Intrínsecas

Ref

# Referencia un parámetro o un recurso
VpcId: !Ref MonVPC
InstanceType: !Ref ParametreInstanceType

# Sintaxis larga
VpcId:
  Ref: MonVPC

GetAtt

# Obtener un atributo de un recurso
Outputs:
  InstancePublicIP:
    Value: !GetAtt WebServer.PublicIp
  
  SecurityGroupId:
    Value: !GetAtt WebSecurityGroup.GroupId

# Sintaxis larga
Value:
  Fn::GetAtt:
    - WebServer
    - PublicIp

Sub (Sustitución)

# Sustitución de variables
UserData:
  Fn::Base64: !Sub |
    #!/bin/bash
    echo "Region: ${AWS::Region}"
    echo "Stack: ${AWS::StackName}"
    echo "Instance: ${WebServer}"

# Con variables personalizadas
Value: !Sub 
  - "arn:aws:s3:::${BucketName}/*"
  - BucketName: !Ref MonBucket

Join

# Unir elementos con un separador
Value: !Join 
  - ","
  - - subnet-12345
    - subnet-67890
    - subnet-abcde
# Resultado: "subnet-12345,subnet-67890,subnet-abcde"

# Sintaxis corta
Value: !Join [",", [!Ref Subnet1, !Ref Subnet2]]

Select

# Seleccionar un elemento de una lista
AvailabilityZone: !Select 
  - 0
  - !GetAZs ''
# Selecciona la primera AZ de la región

Split

# Dividir una cadena
Value: !Select 
  - 0
  - !Split [",", "a,b,c"]
# Resultado: "a"

If (Condición)

Conditions:
  IsProd: !Equals [!Ref Environment, prod]

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !If 
        - IsProd
        - m5.large
        - t3.micro

GetAZs

# Obtener las AZ de una región
AvailabilityZones: !GetAZs ''  # Región actual
AvailabilityZones: !GetAZs 'us-east-1'  # Región específica

Sección Conditions

Parameters:
  Environment:
    Type: String
    AllowedValues: [dev, staging, prod]

Conditions:
  IsProd: !Equals [!Ref Environment, prod]
  IsNotProd: !Not [!Equals [!Ref Environment, prod]]
  IsProdOrStaging: !Or 
    - !Equals [!Ref Environment, prod]
    - !Equals [!Ref Environment, staging]
  IsProdAndMultiAZ: !And
    - !Equals [!Ref Environment, prod]
    - !Equals [!Ref MultiAZ, true]

Resources:
  ProdOnlyResource:
    Type: AWS::EC2::Instance
    Condition: IsProd  # Se crea solo si IsProd es true
    Properties:
      # ...

Sección Mappings

Mappings:
  RegionAMI:
    us-east-1:
      HVM64: ami-0123456789abcdef0
      HVM32: ami-0123456789abcdef1
    us-west-2:
      HVM64: ami-abcdef0123456789a
      HVM32: ami-abcdef0123456789b
    eu-west-1:
      HVM64: ami-fedcba9876543210f
      HVM32: ami-fedcba9876543210e

  EnvironmentConfig:
    dev:
      InstanceType: t3.micro
      MinSize: 1
      MaxSize: 2
    prod:
      InstanceType: m5.large
      MinSize: 2
      MaxSize: 10

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !FindInMap [RegionAMI, !Ref "AWS::Region", HVM64]
      InstanceType: !FindInMap [EnvironmentConfig, !Ref Environment, InstanceType]

Sección Outputs

Outputs:
  VpcId:
    Description: ID del VPC creado
    Value: !Ref MonVPC
    Export:
      Name: !Sub "${AWS::StackName}-VpcId"

  PublicSubnetId:
    Description: ID del subnet público
    Value: !Ref PublicSubnet1
    Export:
      Name: !Sub "${AWS::StackName}-PublicSubnetId"

  WebServerPublicIP:
    Description: IP pública del servidor web
    Value: !GetAtt WebServer.PublicIp
    Condition: IsProd  # Output condicional

  WebsiteURL:
    Description: URL del sitio web
    Value: !Sub "http://${WebServer.PublicDnsName}"

Ejemplo de Plantilla Completa

AWSTemplateFormatVersion: "2010-09-09"
Description: Infraestructura web simple con VPC, EC2 y Security Group

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues: [dev, staging, prod]
    Description: Entorno de despliegue

  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium]

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Par de claves SSH

Mappings:
  RegionAMI:
    us-east-1:
      AMI: ami-0123456789abcdef0
    ca-central-1:
      AMI: ami-0abcdef1234567890

Conditions:
  IsProd: !Equals [!Ref Environment, prod]

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-VPC"

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-Public-Subnet"

  InternetGateway:
    Type: AWS::EC2::InternetGateway

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  SubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref RouteTable

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Web Server Security Group
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !If [IsProd, t3.small, !Ref InstanceType]
      ImageId: !FindInMap [RegionAMI, !Ref "AWS::Region", AMI]
      KeyName: !Ref KeyName
      SubnetId: !Ref PublicSubnet
      SecurityGroupIds:
        - !Ref SecurityGroup
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-WebServer"
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum update -y
          yum install -y httpd
          systemctl start httpd
          echo "<h1>Env: ${Environment}</h1>" > /var/www/html/index.html

Outputs:
  VpcId:
    Value: !Ref VPC
    Export:
      Name: !Sub "${AWS::StackName}-VpcId"

  WebServerIP:
    Value: !GetAtt WebServer.PublicIp
    Description: IP pública del servidor

  WebsiteURL:
    Value: !Sub "http://${WebServer.PublicDnsName}"
    Description: URL del sitio web

Resumen

Una plantilla tiene una estructura definida con Resources obligatorio
Parameters permiten la personalización en el despliegue
Funciones intrínsecas (!Ref, !GetAtt, !Sub, etc.) para referenciar
Conditions para crear recursos condicionalmente
Mappings para valores estáticos por región/entorno
Outputs para exportar valores

Próxima sección : Quiz de Validación

Introducción​

Estructura de una Plantilla​

Sección Parameters​

Sintaxis Básica​

Tipos de Parámetros AWS​

Sección Resources​

Sintaxis de un Recurso​

Ejemplos de Recursos Comunes​

VPC​

Subnet​

Internet Gateway​

Security Group​

EC2 Instance​

Funciones Intrínsecas​

Ref​

GetAtt​

Sub (Sustitución)​

Join​

Select​

Split​

If (Condición)​

GetAZs​

Sección Conditions​

Sección Mappings​

Sección Outputs​

Ejemplo de Plantilla Completa​

Resumen​