AWS CloudFormation: Infrastructure as Code

# Mulai drift detection
aws cloudformation detect-stack-resource-drift \
  --stack-name my-web-stack

# Atau deteksi drift untuk semua resource dalam stack
DRIFT_DETECTION_ID=$(aws cloudformation detect-stack-drift \
  --stack-name my-web-stack \
  --query 'StackDriftDetectionId' \
  --output text)

echo "Detection ID: $DRIFT_DETECTION_ID"

# Cek status drift detection
aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id $DRIFT_DETECTION_ID

# Lihat detail drift
aws cloudformation describe-stack-resource-drifts \
  --stack-name my-web-stack \
  --stack-resource-drift-status-filters MODIFIED DELETED

# Output detail drift:
# StackResourceDrift:
#   - LogicalResourceId: WebSecurityGroup
#     ResourceType: AWS::EC2::SecurityGroup
#     StackResourceDriftStatus: MODIFIED
#     ActualProperties: '{"SecurityGroupIngress": [...443, 80, 22...]}'
#     ExpectedProperties: '{"SecurityGroupIngress": [...80, 443, 22...]}'
#     PropertyDifferences:
#       - PropertyPath: "/SecurityGroupIngress/1/FromPort"
#         ExpectedValue: "443"
#         ActualValue: "8443"
#         DifferenceType: NOT_EQUAL

# Batch detect untuk semua stack
aws cloudformation list-stack-resource-drifts \
  --stack-name my-web-stack \
  --stack-resource-drift-status-filters MODIFIED

# Option 1: Update stack untuk sync kembali ke template
# CloudFormation akan mengembalikan resource ke state template
aws cloudformation update-stack \
  --stack-name my-web-stack \
  --use-previous-template

# Option 2: Import resource yang di-drift
# Jika ingin mengadopsi perubahan manual ke template
aws cloudformation import-resources-to-stack \
  --stack-name my-web-stack \
  --resource-identifiers \
    'ResourceType=AWS::EC2::SecurityGroup,LogicalResourceId=WebServerSG,ResourceIdentifier=sg-0123456789abcdef'

# Option 3: Auto-remediation dengan EventBridge
# Trigger drift detection otomatis via schedule
aws events put-rule \
  --name "MonthlyDriftDetection" \
  --schedule-expression "cron(0 1 1 * ? *)" \
  --description "Deteksi drift bulanan"

# Script remediation otomatis
cat << 'EOF' > remediate-drift.sh
#!/bin/bash
STACK_NAME=$1
DRIFT_ID=$(aws cloudformation detect-stack-drift \
  --stack-name $STACK_NAME \
  --query 'StackDriftDetectionId' --output text)

aws cloudformation wait stack-drift-detection-complete \
  --stack-drift-detection-id $DRIFT_ID

DRIFT_STATUS=$(aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id $DRIFT_ID \
  --query 'DetectionStatus' --output text)

if [ "$DRIFT_STATUS" = "DETECTION_COMPLETE" ]; then
  MODIFIED=$(aws cloudformation describe-stack-resource-drifts \
    --stack-name $STACK_NAME \
    --stack-resource-drift-status-filters MODIFIED \
    --query 'length(StackResourceDrifts)' --output text)

  if [ "$MODIFIED" -gt "0" ]; then
    echo "Drift detected! Resources modified: $MODIFIED"
    aws cloudformation update-stack \
      --stack-name $STACK_NAME \
      --use-previous-template
  fi
fi
EOF

# Template Parent (main.yaml)
AWSTemplateFormatVersion: '2010-09-09'
Description: Main Infrastructure Stack

Parameters:
  EnvironmentName:
    Type: String
    Default: dev

Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-templates/vpc.yaml
      Parameters:
        VpcCIDR: 10.0.0.0/16
        EnvironmentName: !Ref EnvironmentName

  ComputeStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: VPCStack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-templates/compute.yaml
      Parameters:
        VPCId: !GetAtt VPCStack.Outputs.VPCId
        SubnetId: !GetAtt VPCStack.Outputs.PublicSubnet1
        InstanceType: t3.micro

  DatabaseStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: VPCStack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-templates/database.yaml
      Parameters:
        VPCId: !GetAtt VPCStack.Outputs.VPCId
        SubnetIds: !GetAtt VPCStack.Outputs.PrivateSubnetIds
        DBPassword: !Ref DBPassword

Outputs:
  VPCId:
    Value: !GetAtt VPCStack.Outputs.VPCId
  WebServerIP:
    Value: !GetAtt ComputeStack.Outputs.PublicIP
  DatabaseEndpoint:
    Value: !GetAtt DatabaseStack.Outputs.Endpoint

# GitHub Actions: Deploy CloudFormation
name: Deploy CloudFormation
on:
  push:
    branches: [main]
    paths:
      - 'templates/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate templates
        run: |
          for f in templates/*.yaml; do
            echo "Validating $f..."
            aws cloudformation validate-template \
              --template-body file://$f
          done

  deploy:
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Dev
        run: |
          aws cloudformation deploy \
            --template-file templates/main.yaml \
            --stack-name my-app-dev \
            --parameter-overrides file://parameters/dev.json \
            --capabilities CAPABILITY_IAM \
            --tags Environment=Dev Project=MyApp

      - name: Run Tests
        run: |
          # Test endpoints
          curl -f http://$(aws cloudformation describe-stacks \
            --stack-name my-app-dev \
            --query 'Stacks[0].Outputs[?OutputKey==`WebServerIP`].OutputValue' \
            --output text)/health

      - name: Deploy to Production
        if: github.ref == 'refs/heads/main'
        run: |
          aws cloudformation deploy \
            --template-file templates/main.yaml \
            --stack-name my-app-production \
            --parameter-overrides file://parameters/production.json \
            --capabilities CAPABILITY_IAM \
            --no-fail-on-empty-changeset \
            --tags Environment=Production Project=MyApp