AWS CloudFormation: Infrastructure as Code

# Buat Stack Set
aws cloudformation create-stack-set \
  --stack-set-name SharedSecurityPolicies \
  --template-body file://shared-policies.yaml \
  --description "Security policies untuk semua akun" \
  --permission-model SELF_MANAGED \
  --administration-role-arn arn:aws:iam::123456789012:role/AWSCloudFormationStackSetAdministrationRole \
  --execution-role-name AWSCloudFormationStackSetExecutionRole

# Deploy ke target accounts/regions
aws cloudformation create-instances-from-stack-set \
  --stack-set-name SharedSecurityPolicies \
  --accounts '["111111111111","222222222222"]' \
  --regions '["us-east-1","us-west-2","eu-west-1"]'

# Cek status deployment
aws cloudformation list-stack-instances \
  --stack-set-name SharedSecurityPolicies

# Update Stack Set
aws cloudformation update-stack-set \
  --stack-set-name SharedSecurityPolicies \
  --template-body file://shared-policies-v2.yaml \
  --accounts '["111111111111","222222222222"]' \
  --regions '["us-east-1","us-west-2"]'

# Hapus Stack Set
aws cloudformation delete-stack-instances \
  --stack-set-name SharedSecurityPolicies \
  --accounts '["111111111111"]' \
  --regions '["us-east-1"]' \
  --retain-resources NONE

aws cloudformation delete-stack-set \
  --stack-set-name SharedSecurityPolicies

# Mulai drift detection
aws cloudformation detect-stack-resource-drift \
  --stack-name my-web-stack

# Atau deteksi drift untuk semua resource dalam stack
DRIFT_DETECTION_ID=$(aws cloudformation detect-stack-drift \
  --stack-name my-web-stack \
  --query 'StackDriftDetectionId' \
  --output text)

echo "Detection ID: $DRIFT_DETECTION_ID"

# Cek status drift detection
aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id $DRIFT_DETECTION_ID

# Lihat detail drift
aws cloudformation describe-stack-resource-drifts \
  --stack-name my-web-stack \
  --stack-resource-drift-status-filters MODIFIED DELETED

# Output detail drift:
# StackResourceDrift:
#   - LogicalResourceId: WebSecurityGroup
#     ResourceType: AWS::EC2::SecurityGroup
#     StackResourceDriftStatus: MODIFIED
#     ActualProperties: '{"SecurityGroupIngress": [...443, 80, 22...]}'
#     ExpectedProperties: '{"SecurityGroupIngress": [...80, 443, 22...]}'
#     PropertyDifferences:
#       - PropertyPath: "/SecurityGroupIngress/1/FromPort"
#         ExpectedValue: "443"
#         ActualValue: "8443"
#         DifferenceType: NOT_EQUAL

# Batch detect untuk semua stack
aws cloudformation list-stack-resource-drifts \
  --stack-name my-web-stack \
  --stack-resource-drift-status-filters MODIFIED

# Option 1: Update stack untuk sync kembali ke template
# CloudFormation akan mengembalikan resource ke state template
aws cloudformation update-stack \
  --stack-name my-web-stack \
  --use-previous-template

# Option 2: Import resource yang di-drift
# Jika ingin mengadopsi perubahan manual ke template
aws cloudformation import-resources-to-stack \
  --stack-name my-web-stack \
  --resource-identifiers \
    'ResourceType=AWS::EC2::SecurityGroup,LogicalResourceId=WebServerSG,ResourceIdentifier=sg-0123456789abcdef'

# Option 3: Auto-remediation dengan EventBridge
# Trigger drift detection otomatis via schedule
aws events put-rule \
  --name "MonthlyDriftDetection" \
  --schedule-expression "cron(0 1 1 * ? *)" \
  --description "Deteksi drift bulanan"

# Script remediation otomatis
cat << 'EOF' > remediate-drift.sh
#!/bin/bash
STACK_NAME=$1
DRIFT_ID=$(aws cloudformation detect-stack-drift \
  --stack-name $STACK_NAME \
  --query 'StackDriftDetectionId' --output text)

aws cloudformation wait stack-drift-detection-complete \
  --stack-drift-detection-id $DRIFT_ID

DRIFT_STATUS=$(aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id $DRIFT_ID \
  --query 'DetectionStatus' --output text)

if [ "$DRIFT_STATUS" = "DETECTION_COMPLETE" ]; then
  MODIFIED=$(aws cloudformation describe-stack-resource-drifts \
    --stack-name $STACK_NAME \
    --stack-resource-drift-status-filters MODIFIED \
    --query 'length(StackResourceDrifts)' --output text)

  if [ "$MODIFIED" -gt "0" ]; then
    echo "Drift detected! Resources modified: $MODIFIED"
    aws cloudformation update-stack \
      --stack-name $STACK_NAME \
      --use-previous-template
  fi
fi
EOF

# Template Parent (main.yaml)
AWSTemplateFormatVersion: '2010-09-09'
Description: Main Infrastructure Stack

Parameters:
  EnvironmentName:
    Type: String
    Default: dev

Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-templates/vpc.yaml
      Parameters:
        VpcCIDR: 10.0.0.0/16
        EnvironmentName: !Ref EnvironmentName

  ComputeStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: VPCStack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-templates/compute.yaml
      Parameters:
        VPCId: !GetAtt VPCStack.Outputs.VPCId
        SubnetId: !GetAtt VPCStack.Outputs.PublicSubnet1
        InstanceType: t3.micro

  DatabaseStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: VPCStack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-templates/database.yaml
      Parameters:
        VPCId: !GetAtt VPCStack.Outputs.VPCId
        SubnetIds: !GetAtt VPCStack.Outputs.PrivateSubnetIds
        DBPassword: !Ref DBPassword

Outputs:
  VPCId:
    Value: !GetAtt VPCStack.Outputs.VPCId
  WebServerIP:
    Value: !GetAtt ComputeStack.Outputs.PublicIP
  DatabaseEndpoint:
    Value: !GetAtt DatabaseStack.Outputs.Endpoint

# 1. Gunakan NoEcho untuk secrets
DBPassword:
  Type: String
  NoEcho: true
  MinLength: 12

# 2. Gunakan AWS Secrets Manager
DBSecret:
  Type: AWS::SecretsManager::Secret
  Properties:
    Name: !Sub '${EnvironmentName}/database/credentials'
    GenerateSecretString:
      SecretStringTemplate: '{"username": "admin"}'
      GenerateStringKey: password
      PasswordLength: 32
      ExcludeCharacters: '"@/\'

# 3. Gunakan KMS untuk encryption
EncryptedBucket:
  Type: AWS::S3::Bucket
  Properties:
    BucketEncryption:
      ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: aws:kms
            KMSMasterKeyID: !Ref KMSKey

# 4. VPC Endpoints untuk akses private
VPCEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    ServiceName: !Sub 'com.amazonaws.${AWS::Region}.s3'
    VpcId: !Ref VPC
    RouteTableIds:
      - !Ref PrivateRouteTable

# 5. Stack policy untuk proteksi resource kritis
# Simpan sebagai stack-policy.json:
# {
#   "Statement": [
#     {
#       "Effect": "Deny",
#       "Action": "Update:*",
#       "Principal": "*",
#       "Resource": "LogicalResourceId/DatabaseInstance",
#       "Condition": {
#         "StringEquals": {"ResourceType": "AWS::RDS::DBInstance"}
#       }
#     }
#   ]
# }

# GitHub Actions: Deploy CloudFormation
name: Deploy CloudFormation
on:
  push:
    branches: [main]
    paths:
      - 'templates/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate templates
        run: |
          for f in templates/*.yaml; do
            echo "Validating $f..."
            aws cloudformation validate-template \
              --template-body file://$f
          done

  deploy:
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Dev
        run: |
          aws cloudformation deploy \
            --template-file templates/main.yaml \
            --stack-name my-app-dev \
            --parameter-overrides file://parameters/dev.json \
            --capabilities CAPABILITY_IAM \
            --tags Environment=Dev Project=MyApp

      - name: Run Tests
        run: |
          # Test endpoints
          curl -f http://$(aws cloudformation describe-stacks \
            --stack-name my-app-dev \
            --query 'Stacks[0].Outputs[?OutputKey==`WebServerIP`].OutputValue' \
            --output text)/health

      - name: Deploy to Production
        if: github.ref == 'refs/heads/main'
        run: |
          aws cloudformation deploy \
            --template-file templates/main.yaml \
            --stack-name my-app-production \
            --parameter-overrides file://parameters/production.json \
            --capabilities CAPABILITY_IAM \
            --no-fail-on-empty-changeset \
            --tags Environment=Production Project=MyApp