CloudFormation - Bootstrap UserData/Metadata

Here is a simple template in json to create an EC2 instance:

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "AWS CloudFormation Sample Template: Create an Amazon EC2 instance. This example creates an EC2 security group for the instance to give you SSH access.",

  "Parameters" : {
    "KeyName": {
      "Description" : "Name of an existing EC2 KeyPair to enable SSH access to the instance",
      "Type": "AWS::EC2::KeyPair::KeyName",
      "Default" : "einsteinish",
      "ConstraintDescription" : "must be the name of an existing EC2 KeyPair."
    },

    "InstanceType" : {
      "Description" : "WebServer EC2 instance type",
      "Type" : "String",
      "Default" : "t2.nano",
      "AllowedValues" : [ "t1.micro", "t2.nano", "t2.micro"],
      "ConstraintDescription" : "must be a valid EC2 instance type."
    },

    "SSHLocation" : {
      "Description" : "The IP address range that can be used to SSH to the EC2 instances",
      "Type": "String",
      "MinLength": "9",
      "MaxLength": "18",
      "Default": "0.0.0.0/0",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
   }
  },

  "Mappings" : {
  },

  "Resources" : {
    "WebServerInstance" : {
      "Type" : "AWS::EC2::Instance",
      "Properties" : {
        "InstanceType" : { "Ref" : "InstanceType" },
        "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ],
        "KeyName" : { "Ref" : "KeyName" },
        "ImageId" : "ami-80861296"
      }
    },

    "InstanceSecurityGroup" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "GroupDescription" : "Enable SSH access via port 22",
        "SecurityGroupIngress" : [
          {"IpProtocol" : "tcp", "FromPort" : "80", "ToPort" : "80", "CidrIp" : "0.0.0.0/0"},
          {"IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "CidrIp" : { "Ref" : "SSHLocation"}}
        ]
      }
    }
  },

  "Outputs" : {
    "InstanceId" : {
      "Description" : "InstanceId of the newly created EC2 instance",
      "Value" : { "Ref" : "WebServerInstance" }
    },
    "AZ" : {
      "Description" : "Availability Zone of the newly created EC2 instance",
      "Value" : { "Fn::GetAtt" : [ "WebServerInstance", "AvailabilityZone" ] }
    },
    "PublicDNS" : {
      "Description" : "Public DNSName of the newly created EC2 instance",
      "Value" : { "Fn::GetAtt" : [ "WebServerInstance", "PublicDnsName" ] }
    },
    "PublicIP" : {
      "Description" : "Public IP address of the newly created EC2 instance",
      "Value" : { "Fn::GetAtt" : [ "WebServerInstance", "PublicIp" ] }
    }
  }
}

The sample template shows most of the sections used in CloudFormation:

Source : AWS Infrastructure as Code - September 2016 Webinar Series

To install the applications, we need to add a UserData property and Metadata property:

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "AWS CloudFormation Sample Template: Create an Amazon EC2 instance. This example creates an EC2 security group for the instance to give you SSH access.",

  "Parameters" : {
   ...
  },

  "Mappings" : {
  },

  "Resources" : {
    "WebServerInstance" : {
      "Type" : "AWS::EC2::Instance",
      
      "Metadata" : {
        "AWS::CloudFormation::Init" : {
          "config" : {
            "packages" : {               
            },
            "groups" : {   
            },
            "users" : {              
            },
            "sources" : {              
            },
            "files" : {               
            },
            "commands" : {               
            },
            "services" : {               
            }
          }
        }
      },
      
      "Properties" : {
        "InstanceType" : { "Ref" : "InstanceType" },
        "SecurityGroups" : [ { "Ref" : "InstanceSecurityGroup" } ],
        "KeyName" : { "Ref" : "KeyName" },
        "ImageId" : "ami-80861296",
        
        "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
        ]]}}
        
      }
    },

    "InstanceSecurityGroup" : {
     ...
    }
  },

  "Outputs" : {
   ...
  }
}

For more detail, check Deploying Applications on Amazon EC2 with AWS CloudFormation.

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Description" : "AWS CloudFormation Sample Template: Create an Amazon EC2 instance. This example creates an EC2 security group for the instance to give you SSH access.",

  "Parameters" : {
    "KeyName": {
      "Description" : "Name of an existing EC2 KeyPair to enable SSH access to the instance",
      "Type": "AWS::EC2::KeyPair::KeyName",
      "Default" : "einsteinish",
      "ConstraintDescription" : "must be the name of an existing EC2 KeyPair."
    },

    "DBName": {
      "Default": "MyDatabase",
      "Description" : "MySQL database name",
      "Type": "String",
      "MinLength": "1",
      "MaxLength": "64",
      "AllowedPattern" : "[a-zA-Z][a-zA-Z0-9]*",
      "ConstraintDescription" : "Must begin with a letter and contain only alphanumeric characters"
    },

    "DBUsername": {
      "NoEcho": "true",
      "Description" : "Username for MySQL database access",
      "Type": "String",
      "MinLength": "1",
      "MaxLength": "16",
      "AllowedPattern" : "[a-zA-Z][a-zA-Z0-9]*",
      "Default" : "myusername",
      "ConstraintDescription" : "Must begin with a letter and contain only alphanumeric characters"
    },

    "DBPassword": {
      "NoEcho": "true",
      "Description" : "Password for MySQL database access",
      "Type": "String",
      "MinLength": "1",
      "MaxLength": "41",
      "AllowedPattern" : "[a-zA-Z0-9]*",
      "Default" : "mypassword",
      "ConstraintDescription" : "Must contain only alphanumeric characters"
    },

    "DBRootPassword": {
      "NoEcho": "true",
      "Description" : "Root password for MySQL",
      "Type": "String",
      "MinLength": "1",
      "MaxLength": "41",
      "AllowedPattern" : "[a-zA-Z0-9]*",
      "Default" : "mypassword",
      "ConstraintDescription" : "Must contain only alphanumeric characters"
    },

    "InstanceType" : {
      "Description" : "WebServer EC2 instance type",
      "Type" : "String",
      "Default" : "t2.nano",
      "AllowedValues" : [ "t1.micro", "t2.nano", "t2.micro"]
,
      "ConstraintDescription" : "must be a valid EC2 instance type."
    },

    "SSHLocation" : {
      "Description" : "The IP address range that can be used to SSH to the EC2 instances",
      "Type": "String",
      "MinLength": "9",
      "MaxLength": "18",
      "Default": "0.0.0.0/0",
      "AllowedPattern": "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})",
      "ConstraintDescription": "must be a valid IP CIDR range of the form x.x.x.x/x."
   }
  },

  "Mappings" : {
  },

  "Resources" : {
    "WebServerInstance" : {
      "Type" : "AWS::EC2::Instance",

      "Metadata" : {
          "Comment1" : "Configure the bootstrap helpers to install the Apache Web Server and PHP",
          "Comment2" : "Save website content to /var/www/html/index.php",

          "AWS::CloudFormation::Init" : {
              "configSets" : {
                  "Install" : [ "Install" ]
              },

              "Install" : {
                  "packages" : {
                      "yum" : {
                          "mysql"        : [],
                          "mysql-server" : [],
                          "mysql-libs"   : [],
                          "httpd"        : [],
                          "php"          : [],
                          "php-mysql"    : []
                      }
                  },

                  "files" : {
                      "/var/www/html/index.php" : {
                          "content" : { "Fn::Join" : [ "", [

                              "<html>\n",
                              "  <head>\n",
                              "    <title>AWS CloudFormation PHP Sample</title>\n",
                              "    <meta http-equiv=\"Content-Type\" content=\"text/html; charset=ISO-8859-1\">\n",
                              "  </head>\n",
                              "  <body>\n",
                              "    <h1>Welcome to the AWS CloudFormation PHP Sample</h1>\n",
                              "    <p/>\n",
                              "    <?php\n",
                              "      // Print out the current data and time\n",
                              "      print \"The Current Date and Time is: <br/>\";\n",
                              "      print date(\"g:i A l, F j Y.\");\n",
                              "    ?>\n",
                              "    <p/>\n",
                              "    <?php\n",
                              "      // Setup a handle for CURL\n",
                              "      $curl_handle=curl_init();\n",
                              "      curl_setopt($curl_handle,CURLOPT_CONNECTTIMEOUT,2);\n",
                              "      curl_setopt($curl_handle,CURLOPT_RETURNTRANSFER,1);\n",
                              "      // Get the hostname of the intance from the instance metadata\n",
                              "      curl_setopt($curl_handle,CURLOPT_URL,'http://169.254.169.254/latest/meta-data/public-hostname');\n",
                              "      $hostname = curl_exec($curl_handle);\n",
                              "      if (empty($hostname))\n",
                              "      {\n",
                              "        print \"Sorry, for some reason, we got no hostname back <br />\";\n",
                              "      }\n",
                              "      else\n",
                              "      {\n",
                              "        print \"Server = \" . $hostname . \"<br />\";\n",
                              "      }\n",
                              "      // Get the instance-id of the intance from the instance metadata\n",
                              "      curl_setopt($curl_handle,CURLOPT_URL,'http://169.254.169.254/latest/meta-data/instance-id');\n",
                              "      $instanceid = curl_exec($curl_handle);\n",
                              "      if (empty($instanceid))\n",
                              "      {\n",
                              "        print \"Sorry, for some reason, we got no instance id back <br />\";\n",
                              "      }\n",
                              "      else\n",
                              "      {\n",
                              "        print \"EC2 instance-id = \" . $instanceid . \"<br />\";\n",
                              "      }\n",
                              "      $Database   = \"", {"Ref" : "DBName"}, "\";\n",
                              "      $DBUser     = \"", {"Ref" : "DBUsername"}, "\";\n",
                              "      $DBPassword = \"", {"Ref" : "DBPassword"}, "\";\n",
                              "      print \"Database = \" . $Database . \"<br />\";\n",
                              "      $dbconnection = mysql_connect($Database, $DBUser, $DBPassword)\n",
                              "                      or die(\"Could not connect: \" . ysql_error());\n",
                              "      print (\"Connected to $Database successfully\");\n",
                              "      mysql_close($dbconnection);\n",
                              "    ?>\n",
                              "    <h2>PHP Information</h2>\n",
                              "    <p/>\n",
                              "    <?php\n",
                              "      phpinfo();\n",
                              "    ?>\n",
                              "  </body>\n",
                              "</html>\n"

                          ]]},
                          "mode"  : "000600",
                          "owner" : "apache",
                          "group" : "apache"
                      }
                  },


                  "services" : {
                      "sysvinit" : {  
                          "httpd"   : { "enabled" : "true", "ensureRunning" : "true" }
                      }
                  }
              }
          }
      },

      "Properties" : {
        "InstanceType" : { "Ref" : "InstanceType" },
        "SecurityGroups" : [ { "Ref" : "WebServerSecurityGroup" } ],
        "KeyName" : { "Ref" : "KeyName" },
        "ImageId" : "ami-c58c1dd3",

        "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
          "#!/bin/bash -xe\n",
          "yum install -y aws-cfn-bootstrap\n",
          "# Install the files and packages from the metadata\n",
          "/opt/aws/bin/cfn-init -v ",
          "         --stack ", { "Ref" : "AWS::StackName" },
          "         --resource WebServerInstance ",
          "         --configsets Install ",
          "         --region ", { "Ref" : "AWS::Region" }, "\n"  
        ]]}}

      }
    },

    "WebServerSecurityGroup" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "GroupDescription" : "Enable SSH & HTTP",
        "SecurityGroupIngress" : [
          {"IpProtocol" : "tcp", "FromPort" : "80", "ToPort" : "80", "CidrIp" : "0.0.0.0/0"},
          {"IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "CidrIp" : { "Ref" : "SSHLocation"}}
        ]
      }
    }
  },

  "Outputs" : {
    "InstanceId" : {
      "Description" : "InstanceId of the newly created EC2 instance",
      "Value" : { "Ref" : "WebServerInstance" }
    },
    "AZ" : {
      "Description" : "Availability Zone of the newly created EC2 instance",
      "Value" : { "Fn::GetAtt" : [ "WebServerInstance", "AvailabilityZone" ] }
    },
    "PublicDNS" : {
      "Description" : "Public DNSName of the newly created EC2 instance",
      "Value" : { "Fn::GetAtt" : [ "WebServerInstance", "PublicDnsName" ] }
    },
    "PublicIP" : {
      "Description" : "Public IP address of the newly created EC2 instance",
      "Value" : { "Fn::GetAtt" : [ "WebServerInstance", "PublicIp" ] }
    },
    "WebsiteURL" : {
      "Description" : "URL for newly created LAMP stack",
      "Value" : { "Fn::Join" : ["", ["http://", { "Fn::GetAtt" : [ "WebServerInstance", "PublicDnsName" ]}]] }
    }
  }
}

The UserData property runs two shell commands:

1. installs the AWS CloudFormation helper scripts
2. runs the cfn-init helper script.

Because the helper scripts are updated periodically, running the yum install -y aws-cfn-bootstrap command ensures that we get the latest helper scripts. When we run cfn-init, it reads metadata from the AWS::CloudFormation::Init resource, which describes the actions to be carried out by cfn-init.

For example, we can use cfn-init and AWS::CloudFormation::Init to install packages, write files to disk, or start a service. In our case, cfn-init installs the listed packages (httpd, mysql, and php) and creates the /var/www/html/index.php file (a sample PHP application).

Let's validate and create a stack using the template:

$ aws cloudformation validate-template \
--template-body file:///home/k/AWS/CloudFormation/SimpleEC2.json

$ aws cloudformation create-stack --stack-name my-ec2-stack \
--template-body file:///home/k/AWS/CloudFormation/SimpleEC2.json

To update the stack:

$ aws cloudformation update-stack --stack-name my-ec2-stack \
--template-body file:///home/k/AWS/CloudFormation/SimpleEC2.json

Instead of using update-stack command, we may want to use create-change-set & execute-change-set commands:

$ aws cloudformation create-change-set --stack-name my-ec2-stack \
--template-body file:///home/k/AWS/CloudFormation/SimpleEC2-4.json \
--change-set-name my-ec2-change-set

$ aws cloudformation execute-change-set \
--change-set-name my-ec2-change-set \
--stack-name my-ec2-stack

AWS (Amazon Web Services)

1. AWS : EKS (Elastic Container Service for Kubernetes)
2. AWS : Creating a snapshot (cloning an image)
3. AWS : Attaching Amazon EBS volume to an instance
4. AWS : Adding swap space to an attached volume via mkswap and swapon
5. AWS : Creating an EC2 instance and attaching Amazon EBS volume to the instance using Python boto module with User data
6. AWS : Creating an instance to a new region by copying an AMI
7. AWS : S3 (Simple Storage Service) 1
8. AWS : S3 (Simple Storage Service) 2 - Creating and Deleting a Bucket
9. AWS : S3 (Simple Storage Service) 3 - Bucket Versioning
10. AWS : S3 (Simple Storage Service) 4 - Uploading a large file
11. AWS : S3 (Simple Storage Service) 5 - Uploading folders/files recursively
12. AWS : S3 (Simple Storage Service) 6 - Bucket Policy for File/Folder View/Download
13. AWS : S3 (Simple Storage Service) 7 - How to Copy or Move Objects from one region to another
14. AWS : S3 (Simple Storage Service) 8 - Archiving S3 Data to Glacier
15. AWS : Creating a CloudFront distribution with an Amazon S3 origin
16. AWS : Creating VPC with CloudFormation
17. AWS : WAF (Web Application Firewall) with preconfigured CloudFormation template and Web ACL for CloudFront distribution
18. AWS : CloudWatch & Logs with Lambda Function / S3
19. AWS : Lambda Serverless Computing with EC2, CloudWatch Alarm, SNS
20. AWS : Lambda and SNS - cross account
21. AWS : CLI (Command Line Interface)
22. AWS : CLI (ECS with ALB & autoscaling)
23. AWS : ECS with cloudformation and json task definition
24. AWS Application Load Balancer (ALB) and ECS with Flask app
25. AWS : Load Balancing with HAProxy (High Availability Proxy)
26. AWS : VirtualBox on EC2
27. AWS : NTP setup on EC2
28. AWS: jq with AWS
29. AWS & OpenSSL : Creating / Installing a Server SSL Certificate
30. AWS : OpenVPN Access Server 2 Install
31. AWS : VPC (Virtual Private Cloud) 1 - netmask, subnets, default gateway, and CIDR
32. AWS : VPC (Virtual Private Cloud) 2 - VPC Wizard
33. AWS : VPC (Virtual Private Cloud) 3 - VPC Wizard with NAT
34. DevOps / Sys Admin Q & A (VI) - AWS VPC setup (public/private subnets with NAT)
35. AWS - OpenVPN Protocols : PPTP, L2TP/IPsec, and OpenVPN
36. AWS : Autoscaling group (ASG)
37. AWS : Setting up Autoscaling Alarms and Notifications via CLI and Cloudformation
38. AWS : Adding a SSH User Account on Linux Instance
39. AWS : Windows Servers - Remote Desktop Connections using RDP
40. AWS : Scheduled stopping and starting an instance - python & cron
41. AWS : Detecting stopped instance and sending an alert email using Mandrill smtp
42. AWS : Elastic Beanstalk with NodeJS
43. AWS : Elastic Beanstalk Inplace/Rolling Blue/Green Deploy
44. AWS : Identity and Access Management (IAM) Roles for Amazon EC2
45. AWS : Identity and Access Management (IAM) Policies, sts AssumeRole, and delegate access across AWS accounts
46. AWS : Identity and Access Management (IAM) sts assume role via aws cli2
47. AWS : Creating IAM Roles and associating them with EC2 Instances in CloudFormation
48. AWS Identity and Access Management (IAM) Roles, SSO(Single Sign On), SAML(Security Assertion Markup Language), IdP(identity provider), STS(Security Token Service), and ADFS(Active Directory Federation Services)
49. AWS : Amazon Route 53
50. AWS : Amazon Route 53 - DNS (Domain Name Server) setup
51. AWS : Amazon Route 53 - subdomain setup and virtual host on Nginx
52. AWS Amazon Route 53 : Private Hosted Zone
53. AWS : SNS (Simple Notification Service) example with ELB and CloudWatch
54. AWS : Lambda with AWS CloudTrail
55. AWS : SQS (Simple Queue Service) with NodeJS and AWS SDK
56. AWS : Redshift data warehouse
57. AWS : CloudFormation
58. AWS : CloudFormation Bootstrap UserData/Metadata
59. AWS : CloudFormation - Creating an ASG with rolling update
60. AWS : Cloudformation Cross-stack reference
61. AWS : OpsWorks
62. AWS : Network Load Balancer (NLB) with Autoscaling group (ASG)
63. AWS CodeDeploy : Deploy an Application from GitHub
64. AWS EC2 Container Service (ECS)
65. AWS EC2 Container Service (ECS) II
66. AWS Hello World Lambda Function
67. AWS Lambda Function Q & A
68. AWS Node.js Lambda Function & API Gateway
69. AWS API Gateway endpoint invoking Lambda function
70. AWS API Gateway invoking Lambda function with Terraform
71. AWS API Gateway invoking Lambda function with Terraform - Lambda Container
72. Amazon Kinesis Streams
73. AWS: Kinesis Data Firehose with Lambda and ElasticSearch
74. Amazon DynamoDB
75. Amazon DynamoDB with Lambda and CloudWatch
76. Loading DynamoDB stream to AWS Elasticsearch service with Lambda
77. Amazon ML (Machine Learning)
78. Simple Systems Manager (SSM)
79. AWS : RDS Connecting to a DB Instance Running the SQL Server Database Engine
80. AWS : RDS Importing and Exporting SQL Server Data
81. AWS : RDS PostgreSQL & pgAdmin III
82. AWS : RDS PostgreSQL 2 - Creating/Deleting a Table
83. AWS : MySQL Replication : Master-slave
84. AWS : MySQL backup & restore
85. AWS RDS : Cross-Region Read Replicas for MySQL and Snapshots for PostgreSQL
86. AWS : Restoring Postgres on EC2 instance from S3 backup
87. AWS : Q & A
88. AWS : Security
89. AWS : Security groups vs. network ACLs
90. AWS : Scaling-Up
91. AWS : Networking
92. AWS : Single Sign-on (SSO) with Okta
93. AWS : JIT (Just-in-Time) with Okta