amazon-cloudformation - How can I check if a resource was created by CloudFormation?

Question

I have inherited an AWS account with a lot of resources. Some of them were created manually, other by CloudFormation.

How can I check if a resource (in my case Security Group) was created by CloudFormation and belongs to a stack?

For some security groups aws ec2 describe-security-groups --group-ids real_id results in:

...
"Tags": [
            {
                "Value": "REAL_NAME",
                "Key": "aws:cloudformation:logical-id"
            },
            {
                "Value": "arn:aws:cloudformation:<REAL_ID>",
                "Key": "aws:cloudformation:stack-id"
            },
]
...

Other security groups don't have any tags.

Is it the only indicator? I mean, someone could easily remove tags form an SG created by CloudFormation.

标签： amazon-cloudformation

Answer 1

根据官方文档，除了您定义的任何标签外，AWS CloudFormation 还会自动创建以下堆栈级标签，前缀为 aws::

aws:cloudformation:逻辑 ID

aws:cloudformation:堆栈 ID

aws:cloudformation:堆栈名称

所有堆栈级标签（包括自动创建的标签）都会传播到 AWS CloudFormation 支持的资源。目前，标签不会传播到从块储存设备映射创建的 Amazon EBS 卷。

--

这应该是一个很好的起点，但由于 CF 不强制执行堆栈状态，因此如果有人手动删除了某些内容，那么您永远不会知道。

如果我是你，我会通过 Cloudformer 导出所有内容（支持）并按照我的方式重新设计整个设置。

另一种方式：

您可以将资源的PhysicalResourceId传递给describe_stack_resources，如果它属于 CF 堆栈，则可以获取堆栈信息。这是一个例子：

cf = boto3.client('cloudformation') cf.describe_stack_resources(PhysicalResourceId="i-0xxxxxxxxxxxxxxxx")

https://boto3.readthedocs.io/en/latest/reference/services/cloudformation.html#CloudFormation.Client.describe_stack_resources