Lab : CloudFormation

Objectif

Créer des templates CloudFormation pour déployer une infrastructure complète de manière reproductible.

Partie 1 : Template de Base

Exercice 1.1 : Security Group

Créez un template pour un Security Group permettant HTTP et SSH :

AWSTemplateFormatVersion: "2010-09-09"
Description: Security Group pour serveur web

Resources:
  WebServerSG:
    Type: _______________
    Properties:
      GroupDescription: _______________
      SecurityGroupIngress:
        - IpProtocol: ___
          FromPort: ___
          ToPort: ___
          CidrIp: _______________
        - IpProtocol: ___
          FromPort: ___
          ToPort: ___
          CidrIp: _______________

💡 Solution

AWSTemplateFormatVersion: "2010-09-09"
Description: Security Group pour serveur web

Resources:
  WebServerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP and SSH access
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

Exercice 1.2 : Ajout de Paramètres

Améliorez le template avec des paramètres :

Parameters:
  SSHLocation:
    Type: _______________
    Default: _______________
    Description: IP range for SSH access
    AllowedPattern: _______________
    ConstraintDescription: Must be valid CIDR

  Environment:
    Type: String
    AllowedValues:
      - ___
      - ___
      - ___

💡 Solution

Parameters:
  SSHLocation:
    Type: String
    Default: 0.0.0.0/0
    Description: IP range for SSH access
    AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
    ConstraintDescription: Must be valid CIDR (e.g., 10.0.0.0/24)

  Environment:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - staging
      - prod
    Description: Environment type

Puis dans le Security Group :

SecurityGroupIngress:
  - IpProtocol: tcp
    FromPort: 22
    ToPort: 22
    CidrIp: !Ref SSHLocation

Partie 2 : Instance EC2

Exercice 2.1 : Template EC2 Complet

AWSTemplateFormatVersion: "2010-09-09"
Description: Web Server avec EC2

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues: [dev, staging, prod]
  
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium]

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 Key Pair

Mappings:
  RegionAMI:
    us-east-1:
      AMI: ami-0c55b159cbfafe1f0
    eu-west-1:
      AMI: ami-0d729a60

Resources:
  # Complétez les ressources
  WebServerSG:
    Type: _______________
    # ...

  WebServer:
    Type: _______________
    Properties:
      ImageId: _______________
      InstanceType: _______________
      KeyName: _______________
      SecurityGroupIds:
        - _______________
      Tags:
        - Key: Name
          Value: _______________
      UserData:
        Fn::Base64: |
          #!/bin/bash
          # Complétez le script

Outputs:
  PublicIP:
    Value: _______________
  WebURL:
    Value: _______________

💡 Solution Complète

AWSTemplateFormatVersion: "2010-09-09"
Description: Web Server avec EC2

Parameters:
  Environment:
    Type: String
    Default: dev
    AllowedValues: [dev, staging, prod]
  
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium]

  KeyName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 Key Pair

Mappings:
  RegionAMI:
    us-east-1:
      AMI: ami-0c55b159cbfafe1f0
    eu-west-1:
      AMI: ami-0d729a60

Resources:
  WebServerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP and SSH
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-web-sg"
        - Key: Environment
          Value: !Ref Environment

  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !FindInMap [RegionAMI, !Ref "AWS::Region", AMI]
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyName
      SecurityGroupIds:
        - !Ref WebServerSG
      Tags:
        - Key: Name
          Value: !Sub "${Environment}-web-server"
        - Key: Environment
          Value: !Ref Environment
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum update -y
          yum install -y httpd
          systemctl start httpd
          systemctl enable httpd
          echo "<h1>Environment: ${Environment}</h1>" > /var/www/html/index.html
          echo "<p>Instance Type: ${InstanceType}</p>" >> /var/www/html/index.html

Outputs:
  InstanceId:
    Description: Instance ID
    Value: !Ref WebServer
  
  PublicIP:
    Description: Public IP
    Value: !GetAtt WebServer.PublicIp
  
  WebURL:
    Description: Website URL
    Value: !Sub "http://${WebServer.PublicIp}"

Partie 3 : VPC Complet

Exercice 3.1 : Architecture VPC

Créez un template pour cette architecture :

┌─────────────────────────────────────────────────────────────┐
│                    VPC 10.0.0.0/16                          │
│                                                              │
│   ┌─────────────────────┐    ┌─────────────────────┐       │
│   │   Public Subnet     │    │   Private Subnet    │       │
│   │   10.0.1.0/24       │    │   10.0.2.0/24       │       │
│   │                     │    │                     │       │
│   │   ┌───────────┐     │    │   ┌───────────┐     │       │
│   │   │    EC2    │     │    │   │    EC2    │     │       │
│   │   │   (web)   │     │    │   │   (app)   │     │       │
│   │   └───────────┘     │    │   └───────────┘     │       │
│   │                     │    │                     │       │
│   └─────────────────────┘    └─────────────────────┘       │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Template à compléter :

Resources:
  # VPC
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: _______________
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

  # Internet Gateway
  InternetGateway:
    Type: _______________

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: _______________
      InternetGatewayId: _______________

  # Public Subnet
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: _______________
      CidrBlock: _______________
      MapPublicIpOnLaunch: ___
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public"

  # Private Subnet
  PrivateSubnet:
    Type: _______________
    # Complétez...

  # Route Table Public
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC

  PublicRoute:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: _______________
      DestinationCidrBlock: _______________
      GatewayId: _______________

  PublicSubnetRouteAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: _______________
      RouteTableId: _______________

💡 Solution

AWSTemplateFormatVersion: "2010-09-09"
Description: VPC avec subnets public et private

Parameters:
  Environment:
    Type: String
    Default: dev

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-vpc"

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-igw"

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      AvailabilityZone: !Select [0, !GetAZs ""]
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public"

  PrivateSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      MapPublicIpOnLaunch: false
      AvailabilityZone: !Select [0, !GetAZs ""]
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-private"

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-public-rt"

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnetRouteAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

Outputs:
  VPCId:
    Value: !Ref VPC
    Export:
      Name: !Sub "${AWS::StackName}-VPCId"
  
  PublicSubnetId:
    Value: !Ref PublicSubnet
    Export:
      Name: !Sub "${AWS::StackName}-PublicSubnetId"
  
  PrivateSubnetId:
    Value: !Ref PrivateSubnet
    Export:
      Name: !Sub "${AWS::StackName}-PrivateSubnetId"

Partie 4 : Dépannage

Exercice 4.1 : Identifier les Erreurs

Ce template contient des erreurs. Trouvez-les :

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  InstanceType:
    Type: string  # Erreur 1
    Default: t3.micro

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-12345678
      InstanceType: !Ref instancetype  # Erreur 2
      SecurityGroups:
        - !Ref MySG  # Erreur 3 (ordre)
      Tags:
        - Key: Name
          Value: !Sub ${AWS:StackName}-instance  # Erreur 4

  MySG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription  # Erreur 5
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80

💡 Solutions

1. Erreur 1 : string → String (majuscule)
2. Erreur 2 : instancetype → InstanceType (respecter la casse du paramètre)
3. Erreur 3 : MySG doit être défini avant ou utiliser DependsOn
4. Erreur 4 : AWS:StackName → AWS::StackName (double deux-points)
5. Erreur 5 : Manque : "Description" après GroupDescription

Template corrigé :

AWSTemplateFormatVersion: "2010-09-09"

Parameters:
  InstanceType:
    Type: String
    Default: t3.micro

Resources:
  MySG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "Security group for web server"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-12345678
      InstanceType: !Ref InstanceType
      SecurityGroupIds:
        - !Ref MySG
      Tags:
        - Key: Name
          Value: !Sub "${AWS::StackName}-instance"

Partie 5 : Projet Final

Exercice 5.1 : Infrastructure Complète

Créez un template pour l'architecture suivante :

┌─────────────────────────────────────────────────────────────┐
│                    Architecture Web 3-Tiers                  │
├─────────────────────────────────────────────────────────────┤
│                                                              │
│   Internet → ALB → EC2 (Auto Scaling) → RDS                 │
│                                                              │
│   Composants requis :                                        │
│   • VPC avec 2 subnets publics et 2 privés                 │
│   • Security Groups (ALB, EC2, RDS)                        │
│   • Application Load Balancer                               │
│   • Launch Template + Auto Scaling Group                   │
│   • RDS MySQL (optionnel)                                  │
│                                                              │
│   Paramètres :                                               │
│   • Environment (dev/staging/prod)                         │
│   • InstanceType                                            │
│   • MinSize, MaxSize, DesiredCapacity                      │
│                                                              │
└─────────────────────────────────────────────────────────────┘

Critères de Validation

Critère	Points
Template valide (pas d'erreurs)	/15
Paramètres bien définis	/15
VPC correctement configuré	/20
Security Groups restrictifs	/15
ALB + ASG fonctionnels	/20
Outputs utiles	/10
Documentation/commentaires	/5
Total	/100

Livrable Final

Document à Produire

1. Template CloudFormation complet (YAML)
2. Instructions de déploiement (commandes CLI)
3. Schéma de l'architecture
4. Liste des paramètres et valeurs
5. Tests de validation effectués

---

Fin du cours ! Bonne continuation dans votre parcours AWS.