Enhancing AWS CloudFormation Workflows with CFN-Lint and Taskcat

You, Sun Oct 01 2023 • aws cloudformation cfn-lint taskcat

AWS CloudFormation provides a way for developers to model and set up their AWS resources so they can spend less time managing those resources and more time focusing on their applications that run in AWS. However, as with any infrastructure-as-code tool, it's easy to make mistakes. That's where cfn-lint and taskcat come in. These tools help in catching these mistakes early in the development process.

What is CFN-Lint?

cfn-lint is a tool that checks AWS CloudFormation templates against the AWS CloudFormation Resource Specification and a set of additional checks. It helps you ensure that CloudFormation templates are accurate, secure, and use best practices.

What is TaskCat?

taskcat is an open-source tool that tests the deployment of CloudFormation templates. It does this by launching (and eventually cleaning up) stacks in multiple AWS regions, providing a simple way to test CloudFormation templates across different environments.

How to Use CFN-Lint and TaskCat Together

Step 1: Install the tools

pip install cfn-lint taskcat

Step 2: Create a Sample CloudFormation Template

Let's create a simple CloudFormation template named sample-template.yaml:

[...]
  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Example Security Group
      SecurityGroupIngress:
        - Description: Example rule to allow tcp/443 traffic from SecurityGroup
          FromPort: 443
          ToPort: 443
          IpProtocol: tcp
          SourceSecurityGroupId: !Ref SecurityGroup
[...]

Step 3: Lint the Template with CFN-Lint

To lint the template, run:

cfn-lint sample-template.yaml

This will display errors (if any) related to the template. For the above example, it will display:

E3004 Circular Dependencies for resource SecurityGroup. Circular dependency with [SecurityGroup]
[...]

Since there is a circular dependency, move the SecurityGroupIngress configuration from SecurityGroup to AWS::EC2::SecurityGroupIngress:

  SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Example Security Group
      SecurityGroupEgress:
        - Description: Example rule limiting egress traffic to 127.0.0.1/32
          CidrIp: 127.0.0.1/32
          IpProtocol: "-1"
      VpcId: !Ref Vpc

  SecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      Description: Example rule to allow tcp/443 traffic from SecurityGroup
      FromPort: 443
      ToPort: 443
      GroupId: !Ref SecurityGroup
      IpProtocol: tcp
      SourceSecurityGroupId: !Ref SecurityGroup

This time you should not get any error when you run cfn-lint again.

Step 4: Test the Template with TaskCat

To test the template, you'll need a configuration file for taskcat. Create a file named taskcat.yml:

project:
  name: sample-cloudformation-project
  regions:  
  - us-east-1
  - us-east-2
tests:
  default:
    template: ./sample-template.yaml
    s3_bucket: my-globally-defined-bucket
    parameters:
      KeyPair: my-ec2-keypair

s3_bucket is required to store temporary files. If you do not specify it, taskcat will automatically create a bucket for you when you run a test.

Then, run taskcat:

taskcat test run

TaskCat will deploy the CloudFormation stack to multiple AWS regions and provide results.

Step 5: Interpret the Results

After running TaskCat, you'll get a report. If the CloudFormation template is valid and can be successfully deployed, TaskCat will provide success messages for each region. Otherwise, it will show errors, allowing you to quickly address them.

Best Practices

Frequent Linting: Make cfn-lint a regular part of your development cycle. Consider integrating it into your CI/CD pipeline to catch issues early.

Use Parameterized Templates with TaskCat: TaskCat allows you to use parameters in your CloudFormation templates. This is especially useful for testing resources with unique naming constraints across multiple regions.

Stay Updated: AWS continuously evolves. Ensure you regularly update both cfn-lint and taskcat to keep up with AWS's changes.

Conclusion

Using cfn-lint and taskcat in tandem provides a robust way to ensure your AWS CloudFormation templates are both syntactically correct and functionally deployable across various AWS regions. By integrating these tools into your workflow, you can increase the reliability and quality of your infrastructure-as-code deployments.

Reference

Examples taken from AWS.