Solutions

CI/CD

StackSets Code services

Deployment
models

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
Solutions

CI/CD

StackSets Code services

Deployment
models

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
CloudFormation StackSets solutions

We need to do infrastructure
deployments to multiple accounts. Is
there a way to streamline this process?
Cloud architect

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
 AWS CloudFormation

AWS
Amazon ECS
CloudFormation

• Infrastructure as
Code
• Integrates with
version control
• JSON or YAML
format
• Templates Developers AWS CodeCommit AWS CodePipeline
• Stacks
• Supports a wide
range of AWS
resources AWS CodeBuild Amazon ECR

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
CI/CD for infrastructure deployments

Infrastructure

Write Build Validate Automate Deploy

Prod
infra code AMIs templates deployment infras
IT ops
AWS
CloudFormation

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
 CloudFormation StackSets solutions
Without CloudFormation StackSets

Stack Stack Stack Stack

deploy 1 deploy 2 deploy 3 deploy 4
• The stack must be
deployed to
multiple accounts
• Multiple
deployment Target account A Target account B Target account A Target account B
operations done
from each account
within each
Region Stack Stack Stack Stack

Account C Account D Account E … Account C Account D Account E

Region Region

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
 CloudFormation StackSets solutions
With CloudFormation StackSets
Administrator account

• Extends Stack set

functionality of
stacks
• Enables you to
create, update, or
delete stacks Target account A Target account B Target account A Target account B
across multiple
accounts and
regions in a single
operation Stack Stack Stack Stack

Account C Account D Account E Account C Account D Account E

Region Region

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
 Permissions model for StackSets

Self managed Trusted access

• Before you can • Create the IAM roles that StackSets • Enable trusted access with AWS
use a stack set to requires to deploy across account and Organizations
create stacks in a Regions
target account, • Deploy stack instances with service-
you must set up a • Manually set up trust relationships managed permissions
trust relationship between the “administrator” account • StackSets creates the necessary IAM
between the and the target accounts
administrator and roles in the management account and
target accounts target accounts

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
 Creating and deploying a stack set

Options
Choose a template to deploy Configure tags
Concurrency
• Specify the
number of Ensure all dependent resources Configure deployment location
accounts in which
an operation is exist (account or OU)
performed
Failure tolerance
Create the stack Specify Regions
• Specify the
number of failed
deployments
before
deployment gives Monitor stack creation Select options
up

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
 Stack set operations

Stack set
Create
Stack Stack Stack Stack

• Create stack set

Update
• Update stack set
• Delete stacks Preferences Stack Stack Stack Stack
Tags
• Delete stack set

Delete
Stack Stack Stack Stack

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.
StackSets best practices

Ensure global resources (IAM/Amazon S3) won’t have naming conflicts

Store templates in an Amazon S3 bucket

Updating a stack set updates all stack instances

Test, test, test ...

You can only perform one operation at a time per stack set

© 2021 Amazon Web Services, Inc. or its affiliates. All rights reserved.