AWS CloudFormation: Infrastructure as Code

Resources:
  # EC2 Instance
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t3.micro
      ImageId: ami-0c55b159cbfafe1f0
      KeyName: my-key-pair
      SecurityGroups:
        - !Ref WebSecurityGroup
      Tags:
        - Key: Name
          Value: MyWebServer

  # Security Group
  WebSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP and SSH
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0

  # S3 Bucket
  AppBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-app-bucket-unique-name
      VersioningConfiguration:
        Status: Enabled
      Tags:
        - Key: Environment
          Value: Production

Parameters:
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large
    Description: Pilih tipe EC2 instance

  EnvironmentName:
    Type: String
    AllowedValues:
      - dev
      - staging
      - production
    Description: Nama environment
    ConstraintDescription: Harus dev, staging, atau production

  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Nama EC2 Key Pair untuk SSH

  DBPassword:
    Type: String
    NoEcho: true
    MinLength: 8
    MaxLength: 64
    Description: Password untuk database RDS
    AllowedPattern: '[a-zA-Z0-9]*'
    ConstraintDescription: Password harus alphanumeric

Outputs:
  InstancePublicIP:
    Description: IP Public dari EC2 instance
    Value: !GetAtt WebServer.PublicIp
    Export:
      Name: !Sub '${AWS::StackName}-InstanceIP'

  BucketARN:
    Description: ARN dari S3 bucket
    Value: !GetAtt AppBucket.Arn
    Export:
      Name: !Sub '${AWS::StackName}-BucketARN'

  SecurityGroupId:
    Description: ID Security Group
    Value: !Ref WebSecurityGroup
    Export:
      Name: !Sub '${AWS::StackName}-SGId'

  WebsiteURL:
    Description: URL website
    Value: !Sub 'http://${WebServer.PublicDnsName}'
    Export:
      Name: !Sub '${AWS::StackName}-URL'

Mappings:
  RegionMap:
    us-east-1:
      AMI: ami-0c55b159cbfafe1f0
      InstanceType: t3.micro
    us-west-2:
      AMI: ami-0c55b159cbfafe1f0
      InstanceType: t3.small
    ap-southeast-1:
      AMI: ami-0c55b159cbfafe1f0
      InstanceType: t3.micro
    eu-west-1:
      AMI: ami-0c55b159cbfafe1f0
      InstanceType: t3.medium

Conditions:
  IsProduction: !Equals [!Ref EnvironmentName, production]
  IsUSRegion: !Contains
    - !Ref 'AWS::Region'
    - us
  CreateMonitoring: !Or
    - !Condition IsProduction
    - !Equals [!Ref EnableMonitoring, 'true']

Resources:
  # Hanya dibuat di production
  AlarmTopic:
    Type: AWS::SNS::Topic
    Condition: IsProduction
    Properties:
      TopicName: !Sub '${EnvironmentName}-alerts'

  # Dibuat berdasarkan kondisi
  CloudWatchAlarm:
    Type: AWS::CloudWatch::Alarm
    Condition: CreateMonitoring
    Properties:
      AlarmName: HighCPU
      MetricName: CPUUtilization
      Namespace: AWS/EC2
      Statistic: Average
      Period: 300
      EvaluationPeriods: 2
      Threshold: 80

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Web Server Stack - VPC, EC2, RDS, S3'

# ==============================
# PARAMETERS
# ==============================
Parameters:
  VpcCIDR:
    Type: String
    Default: 10.0.0.0/16
    Description: CIDR block untuk VPC

  PublicSubnet1CIDR:
    Type: String
    Default: 10.0.1.0/24

  PublicSubnet2CIDR:
    Type: String
    Default: 10.0.2.0/24

  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large

  EnvironmentName:
    Type: String
    Default: dev
    AllowedValues:
      - dev
      - staging
      - production

# ==============================
# RESOURCES
# ==============================
Resources:

  # --- VPC ---
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcCIDR
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-VPC'
        - Key: Environment
          Value: !Ref EnvironmentName

  # --- Internet Gateway ---
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-IGW'

  IGWAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  # --- Public Subnet 1 ---
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PublicSubnet1CIDR
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-PublicSubnet1'

  # --- Public Subnet 2 ---
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Ref PublicSubnet2CIDR
      AvailabilityZone: !Select [1, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-PublicSubnet2'

  # --- Route Table ---
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-PublicRT'

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: IGWAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  Subnet1RTAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  Subnet2RTAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  # --- Security Group ---
  WebServerSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP and SSH
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-WebSG'

  # --- EC2 Instance ---
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      ImageId: !FindInMap [RegionMap, !Ref 'AWS::Region', AMI]
      KeyName: my-key-pair
      SubnetId: !Ref PublicSubnet1
      SecurityGroupIds:
        - !Ref WebServerSG
      UserData:
        Fn::Base64: |
          #!/bin/bash
          yum update -y
          yum install -y httpd
          systemctl start httpd
          systemctl enable httpd
          echo "<h1>Hello from CloudFormation!</h1>" > /var/www/html/index.html
      Tags:
        - Key: Name
          Value: !Sub '${EnvironmentName}-WebServer'

  # --- S3 Bucket ---
  AppBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${EnvironmentName}-app-assets-${AWS::AccountId}'
      VersioningConfiguration:
        Status: Enabled
      LifecycleConfiguration:
        Rules:
          - Id: TransitionToIA
            Status: Enabled
            Transitions:
              - TransitionInDays: 90
                StorageClass: STANDARD_IA
      Tags:
        - Key: Environment
          Value: !Ref EnvironmentName

# ==============================
# MAPPINGS
# ==============================
Mappings:
  RegionMap:
    us-east-1:
      AMI: ami-0c55b159cbfafe1f0
    us-west-2:
      AMI: ami-0c55b159cbfafe1f0
    ap-southeast-1:
      AMI: ami-0c55b159cbfafe1f0

# ==============================
# OUTPUTS
# ==============================
Outputs:
  VPCId:
    Description: VPC ID
    Value: !Ref VPC
    Export:
      Name: !Sub '${AWS::StackName}-VPCId'

  WebServerPublicIP:
    Description: Public IP Web Server
    Value: !GetAtt WebServer.PublicIp

  WebsiteURL:
    Description: URL Website
    Value: !Sub 'http://${WebServer.PublicDnsName}'

  BucketName:
    Description: Nama S3 Bucket
    Value: !Ref AppBucket

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "S3 Bucket Template - JSON Format",

  "Parameters": {
    "BucketName": {
      "Type": "String",
      "Description": "Nama S3 Bucket",
      "MinLength": 3,
      "MaxLength": 63,
      "AllowedPattern": "[a-z0-9.-]*"
    },
    "Environment": {
      "Type": "String",
      "Default": "dev",
      "AllowedValues": ["dev", "staging", "production"]
    },
    "EnableVersioning": {
      "Type": "String",
      "Default": "true",
      "AllowedValues": ["true", "false"]
    }
  },

  "Resources": {
    "S3Bucket": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": {"Ref": "BucketName"},
        "VersioningConfiguration": {
          "Status": {
            "Fn::If": [
              "IsVersioningEnabled",
              "Enabled",
              "Suspended"
            ]
          }
        },
        "Tags": [
          {
            "Key": "Environment",
            "Value": {"Ref": "Environment"}
          },
          {
            "Key": "ManagedBy",
            "Value": "CloudFormation"
          }
        ]
      }
    },
    "BucketPolicy": {
      "Type": "AWS::S3::BucketPolicy",
      "Properties": {
        "Bucket": {"Ref": "S3Bucket"},
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Sid": "AllowSSLRequestsOnly",
              "Effect": "Deny",
              "Principal": "*",
              "Action": "s3:*",
              "Resource": {
                "Fn::Sub": "arn:aws:s3:::${S3Bucket}/*"
              },
              "Condition": {
                "Bool": {
                  "aws:SecureTransport": "false"
                }
              }
            }
          ]
        }
      }
    }
  },

  "Conditions": {
    "IsVersioningEnabled": {
      "Fn::Equals": [{"Ref": "EnableVersioning"}, "true"]
    }
  },

  "Outputs": {
    "BucketARN": {
      "Description": "ARN S3 Bucket",
      "Value": {"Fn::GetAtt": ["S3Bucket", "Arn"]}
    },
    "BucketName": {
      "Description": "Nama S3 Bucket",
      "Value": {"Ref": "S3Bucket"}
    }
  }
}

# Sub — substitusi variabel
BucketName: !Sub
  - '${Env}-bucket-${AccountId}'
  - Env: !Ref EnvironmentName
    AccountId: !Ref 'AWS::AccountId'

# Join — gabungkan string
FullName: !Join
  - '-'
  - - !Ref Project
    - !Ref Environment
    - !Ref Component

# Select — pilih dari list
AZ: !Select [0, !GetAZs '']

# Split — pecah string
Subnets:
  Fn::Split:
    - ','
    - !Ref SubnetList

# Transform — ubah case
Upper: !Transform
  - String
  - !Ref Environment
  - ToUpper

# GetAtt — ambil attribute resource
Endpoint: !GetAtt MyLoadBalancer.DNSName
ARN: !GetAtt MyLambda.Arn

# FindInMap — lookup dari Mappings
AMI: !FindInMap
  - RegionMap
  - !Ref 'AWS::Region'
  - AMI

# ImportValue — import dari stack lain
VPCId: !ImportValue SharedStack-VPCId

# GetAZs — list availability zones
AZs: !GetAZs !Ref 'AWS::Region'

# Ref — referensi ke parameter atau pseudo-parameter
StackName: !Ref 'AWS::StackName'
Region: !Ref 'AWS::Region'
AccountId: !Ref 'AWS::AccountId'
NotificationARNs: !Ref 'AWS::NotificationARNs'

# If — kondisional
InstanceType: !If
  - IsProduction
  - m5.large
  - t3.micro

# Equals — perbandingan
Condition: !Equals [!Ref Env, 'production']

# And / Or / Not — logika boolean
ComplexCondition: !And
  - !Equals [!Ref Env, 'prod']
  - !Equals [!Ref Region, 'us-east-1']

# Contains — cek keanggotaan
IsUSRegion: !Contains
  - [us-east-1, us-west-2, us-east-2]
  - !Ref 'AWS::Region'

# EachMemberEquals — semua anggota sama
AllProdRegions: !EachMemberEquals
  - !Ref 'AWS::Region'
  - us-east-1

# Base64 — encode base64
UserData: !Base64 |
  #!/bin/bash
  yum install -y httpd
  systemctl start httpd

# Cidr — hitung CIDR blocks
VPCCIDR: 10.0.0.0/16
Subnet1CIDR: !Select [0, !Cidr [!Ref VPCCIDR, 6, 8]]
Subnet2CIDR: !Select [1, !Cidr [!Ref VPCCIDR, 6, 8]]
# Output: 10.0.0.0/24, 10.0.1.0/24, dst.

# ImportValue
SharedVPC: !ImportValue Shared-VPC-ID

# Transform (macros)
Macros: !Transform
  - Name: MyMacro
  - { Input: 'some value' }
  - !Ref 'AWS::NoValue'

# Validasi template
aws cloudformation validate-template \
  --template-body file://template.yaml

# Buat stack baru
aws cloudformation create-stack \
  --stack-name my-web-stack \
  --template-body file://template.yaml \
  --parameters ParameterKey=InstanceType,ParameterValue=t3.micro \
               ParameterKey=EnvironmentName,ParameterValue=dev \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
  --tags Key=Project,Value=MyApp Key=Environment,Value=Dev

# Cek status stack
aws cloudformation describe-stacks \
  --stack-name my-web-stack \
  --query 'Stacks[0].StackStatus'

# Output dari stack
aws cloudformation describe-stacks \
  --stack-name my-web-stack \
  --query 'Stacks[0].Outputs'

# Update stack
aws cloudformation update-stack \
  --stack-name my-web-stack \
  --template-body file://template-v2.yaml \
  --parameters ParameterKey=InstanceType,ParameterValue=t3.small

# Rollback manual jika update stuck
aws cloudformation continue-update-rollback \
  --stack-name my-web-stack

# Delete stack
aws cloudformation delete-stack \
  --stack-name my-web-stack

# Tunggu stack selesai
aws cloudformation wait stack-create-complete \
  --stack-name my-web-stack

# List semua stack
aws cloudformation list-stacks \
  --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE

# Lihat event stack
aws cloudformation describe-stack-events \
  --stack-name my-web-stack \
  --query 'StackEvents[*].[Timestamp,LogicalResourceId,ResourceStatus,ResourceStatusReason]' \
  --output table

# Output contoh:
# | 2026-06-26T10:00:00Z | WebServer        | CREATE_COMPLETE   | -                  |
# | 2026-06-26T09:58:00Z | WebServer        | CREATE_IN_PROGRESS| -                  |
# | 2026-06-26T09:57:00Z | WebSecurityGroup | CREATE_COMPLETE   | -                  |
# | 2026-06-26T09:55:00Z | VPC              | CREATE_COMPLETE   | -                  |
# | 2026-06-26T09:50:00Z | my-web-stack     | CREATE_IN_PROGRESS| -                  |

# Buat change set dari template yang sudah ada
aws cloudformation create-change-set \
  --stack-name my-web-stack \
  --change-set-name add-rds-database \
  --template-body file://template-with-rds.yaml \
  --parameters ParameterKey=InstanceType,ParameterValue=t3.small \
  --capabilities CAPABILITY_IAM

# Cek status change set
aws cloudformation describe-change-set \
  --stack-name my-web-stack \
  --change-set-name add-rds-database

# Lihat detail perubahan
aws cloudformation describe-change-set \
  --stack-name my-web-stack \
  --change-set-name add-rds-database \
  --query 'Changes[*].[Type,ResourceChange.Action,ResourceChange.LogicalResourceId,ResourceChange.ResourceType]'

# Preview perubahan
# Action types:
#   Add    → Resource baru akan dibuat
#   Modify → Resource akan diubah
#   Remove → Resource akan dihapus

# Execute change set (terapkan perubahan)
aws cloudformation execute-change-set \
  --stack-name my-web-stack \
  --change-set-name add-rds-database

# Hapus change set jika tidak jadi
aws cloudformation delete-change-set \
  --stack-name my-web-stack \
  --change-set-name add-rds-database

# List semua change sets
aws cloudformation list-change-sets \
  --stack-name my-web-stack

Change Set: add-rds-database
Stack: my-web-stack
Status: CREATE_COMPLETE

Changes:
┌──────────────────┬─────────┬───────────────────────────────┬──────────────────────┐
│ Type             │ Action  │ LogicalResourceId             │ ResourceType         │
├──────────────────┼─────────┼───────────────────────────────┼──────────────────────┤
│ Resource         │ Add     │ DatabaseSubnetGroup           │ AWS::RDS::           │
│                  │         │                               │ DBSubnetGroup        │
│ Resource         │ Add     │ RDSDatabase                   │ AWS::RDS::           │
│                  │         │                               │ DBInstance           │
│ Resource         │ Modify  │ WebServerSG                   │ AWS::EC2::           │
│                  │         │                               │ SecurityGroup        │
│ Resource         │ Add     │ DatabaseSecurityGroup          │ AWS::EC2::           │
│                  │         │                               │ SecurityGroup        │
│ Resource         │ Add     │ DBSubnet1                     │ AWS::EC2::Subnet    │
│ Resource         │ Add     │ DBSubnet2                     │ AWS::EC2::Subnet    │
└──────────────────┴─────────┴───────────────────────────────┴──────────────────────┘

# Buat Stack Set
aws cloudformation create-stack-set \
  --stack-set-name SharedSecurityPolicies \
  --template-body file://shared-policies.yaml \
  --description "Security policies untuk semua akun" \
  --permission-model SELF_MANAGED \
  --administration-role-arn arn:aws:iam::123456789012:role/AWSCloudFormationStackSetAdministrationRole \
  --execution-role-name AWSCloudFormationStackSetExecutionRole

# Deploy ke target accounts/regions
aws cloudformation create-instances-from-stack-set \
  --stack-set-name SharedSecurityPolicies \
  --accounts '["111111111111","222222222222"]' \
  --regions '["us-east-1","us-west-2","eu-west-1"]'

# Cek status deployment
aws cloudformation list-stack-instances \
  --stack-set-name SharedSecurityPolicies

# Update Stack Set
aws cloudformation update-stack-set \
  --stack-set-name SharedSecurityPolicies \
  --template-body file://shared-policies-v2.yaml \
  --accounts '["111111111111","222222222222"]' \
  --regions '["us-east-1","us-west-2"]'

# Hapus Stack Set
aws cloudformation delete-stack-instances \
  --stack-set-name SharedSecurityPolicies \
  --accounts '["111111111111"]' \
  --regions '["us-east-1"]' \
  --retain-resources NONE

aws cloudformation delete-stack-set \
  --stack-set-name SharedSecurityPolicies

# Mulai drift detection
aws cloudformation detect-stack-resource-drift \
  --stack-name my-web-stack

# Atau deteksi drift untuk semua resource dalam stack
DRIFT_DETECTION_ID=$(aws cloudformation detect-stack-drift \
  --stack-name my-web-stack \
  --query 'StackDriftDetectionId' \
  --output text)

echo "Detection ID: $DRIFT_DETECTION_ID"

# Cek status drift detection
aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id $DRIFT_DETECTION_ID

# Lihat detail drift
aws cloudformation describe-stack-resource-drifts \
  --stack-name my-web-stack \
  --stack-resource-drift-status-filters MODIFIED DELETED

# Output detail drift:
# StackResourceDrift:
#   - LogicalResourceId: WebSecurityGroup
#     ResourceType: AWS::EC2::SecurityGroup
#     StackResourceDriftStatus: MODIFIED
#     ActualProperties: '{"SecurityGroupIngress": [...443, 80, 22...]}'
#     ExpectedProperties: '{"SecurityGroupIngress": [...80, 443, 22...]}'
#     PropertyDifferences:
#       - PropertyPath: "/SecurityGroupIngress/1/FromPort"
#         ExpectedValue: "443"
#         ActualValue: "8443"
#         DifferenceType: NOT_EQUAL

# Batch detect untuk semua stack
aws cloudformation list-stack-resource-drifts \
  --stack-name my-web-stack \
  --stack-resource-drift-status-filters MODIFIED

# Option 1: Update stack untuk sync kembali ke template
# CloudFormation akan mengembalikan resource ke state template
aws cloudformation update-stack \
  --stack-name my-web-stack \
  --use-previous-template

# Option 2: Import resource yang di-drift
# Jika ingin mengadopsi perubahan manual ke template
aws cloudformation import-resources-to-stack \
  --stack-name my-web-stack \
  --resource-identifiers \
    'ResourceType=AWS::EC2::SecurityGroup,LogicalResourceId=WebServerSG,ResourceIdentifier=sg-0123456789abcdef'

# Option 3: Auto-remediation dengan EventBridge
# Trigger drift detection otomatis via schedule
aws events put-rule \
  --name "MonthlyDriftDetection" \
  --schedule-expression "cron(0 1 1 * ? *)" \
  --description "Deteksi drift bulanan"

# Script remediation otomatis
cat << 'EOF' > remediate-drift.sh
#!/bin/bash
STACK_NAME=$1
DRIFT_ID=$(aws cloudformation detect-stack-drift \
  --stack-name $STACK_NAME \
  --query 'StackDriftDetectionId' --output text)

aws cloudformation wait stack-drift-detection-complete \
  --stack-drift-detection-id $DRIFT_ID

DRIFT_STATUS=$(aws cloudformation describe-stack-drift-detection-status \
  --stack-drift-detection-id $DRIFT_ID \
  --query 'DetectionStatus' --output text)

if [ "$DRIFT_STATUS" = "DETECTION_COMPLETE" ]; then
  MODIFIED=$(aws cloudformation describe-stack-resource-drifts \
    --stack-name $STACK_NAME \
    --stack-resource-drift-status-filters MODIFIED \
    --query 'length(StackResourceDrifts)' --output text)

  if [ "$MODIFIED" -gt "0" ]; then
    echo "Drift detected! Resources modified: $MODIFIED"
    aws cloudformation update-stack \
      --stack-name $STACK_NAME \
      --use-previous-template
  fi
fi
EOF

# Template Parent (main.yaml)
AWSTemplateFormatVersion: '2010-09-09'
Description: Main Infrastructure Stack

Parameters:
  EnvironmentName:
    Type: String
    Default: dev

Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-templates/vpc.yaml
      Parameters:
        VpcCIDR: 10.0.0.0/16
        EnvironmentName: !Ref EnvironmentName

  ComputeStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: VPCStack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-templates/compute.yaml
      Parameters:
        VPCId: !GetAtt VPCStack.Outputs.VPCId
        SubnetId: !GetAtt VPCStack.Outputs.PublicSubnet1
        InstanceType: t3.micro

  DatabaseStack:
    Type: AWS::CloudFormation::Stack
    DependsOn: VPCStack
    Properties:
      TemplateURL: https://s3.amazonaws.com/my-templates/database.yaml
      Parameters:
        VPCId: !GetAtt VPCStack.Outputs.VPCId
        SubnetIds: !GetAtt VPCStack.Outputs.PrivateSubnetIds
        DBPassword: !Ref DBPassword

Outputs:
  VPCId:
    Value: !GetAtt VPCStack.Outputs.VPCId
  WebServerIP:
    Value: !GetAtt ComputeStack.Outputs.PublicIP
  DatabaseEndpoint:
    Value: !GetAtt DatabaseStack.Outputs.Endpoint

# 1. Gunakan NoEcho untuk secrets
DBPassword:
  Type: String
  NoEcho: true
  MinLength: 12

# 2. Gunakan AWS Secrets Manager
DBSecret:
  Type: AWS::SecretsManager::Secret
  Properties:
    Name: !Sub '${EnvironmentName}/database/credentials'
    GenerateSecretString:
      SecretStringTemplate: '{"username": "admin"}'
      GenerateStringKey: password
      PasswordLength: 32
      ExcludeCharacters: '"@/\'

# 3. Gunakan KMS untuk encryption
EncryptedBucket:
  Type: AWS::S3::Bucket
  Properties:
    BucketEncryption:
      ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: aws:kms
            KMSMasterKeyID: !Ref KMSKey

# 4. VPC Endpoints untuk akses private
VPCEndpoint:
  Type: AWS::EC2::VPCEndpoint
  Properties:
    ServiceName: !Sub 'com.amazonaws.${AWS::Region}.s3'
    VpcId: !Ref VPC
    RouteTableIds:
      - !Ref PrivateRouteTable

# 5. Stack policy untuk proteksi resource kritis
# Simpan sebagai stack-policy.json:
# {
#   "Statement": [
#     {
#       "Effect": "Deny",
#       "Action": "Update:*",
#       "Principal": "*",
#       "Resource": "LogicalResourceId/DatabaseInstance",
#       "Condition": {
#         "StringEquals": {"ResourceType": "AWS::RDS::DBInstance"}
#       }
#     }
#   ]
# }

Rekomendasi Struktur Project:
├── templates/
│   ├── main.yaml              # Parent stack
│   ├── vpc.yaml               # VPC resources
│   ├── compute.yaml           # EC2, ECS, Lambda
│   ├── database.yaml          # RDS, DynamoDB
│   ├── monitoring.yaml        # CloudWatch, SNS
│   └── security.yaml          # IAM, KMS, Secrets
├── parameters/
│   ├── dev.json               # Parameters untuk dev
│   ├── staging.json           # Parameters untuk staging
│   └── production.json        # Parameters untuk production
├── scripts/
│   ├── deploy.sh              # Deployment script
│   ├── validate.sh            # Template validation
│   └── drift-check.sh         # Drift detection
├── README.md
└── .github/
    └── workflows/
        └── deploy.yml         # CI/CD pipeline

# GitHub Actions: Deploy CloudFormation
name: Deploy CloudFormation
on:
  push:
    branches: [main]
    paths:
      - 'templates/**'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Validate templates
        run: |
          for f in templates/*.yaml; do
            echo "Validating $f..."
            aws cloudformation validate-template \
              --template-body file://$f
          done

  deploy:
    needs: validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Deploy to Dev
        run: |
          aws cloudformation deploy \
            --template-file templates/main.yaml \
            --stack-name my-app-dev \
            --parameter-overrides file://parameters/dev.json \
            --capabilities CAPABILITY_IAM \
            --tags Environment=Dev Project=MyApp

      - name: Run Tests
        run: |
          # Test endpoints
          curl -f http://$(aws cloudformation describe-stacks \
            --stack-name my-app-dev \
            --query 'Stacks[0].Outputs[?OutputKey==`WebServerIP`].OutputValue' \
            --output text)/health

      - name: Deploy to Production
        if: github.ref == 'refs/heads/main'
        run: |
          aws cloudformation deploy \
            --template-file templates/main.yaml \
            --stack-name my-app-production \
            --parameter-overrides file://parameters/production.json \
            --capabilities CAPABILITY_IAM \
            --no-fail-on-empty-changeset \
            --tags Environment=Production Project=MyApp