AWS CloudFormation の dry-run を cli でやるコマンド

AWS CloudFormation で dry-run して差分が見たい場合、以下のように create-change-set と describe-change-set のコマンドで見れる。

$ aws cloudformation create-change-set --stack-name test-stack --change-set-name test-stack-dry-run --template-body file://test-stack.yml
$ aws cloudformation describe-change-set --stack-name test-stack --change-set-name test-stack-dry-run

以下に例を示す。

前提

例えば以下のような yaml がある。

AWSTemplateFormatVersion: 2010-09-09
Resources:
  S3Bucket:
    Type: AWS::S3::Bucket

create-stack でスタックを作成する。

$ aws cloudformation create-stack --stack-name test-stack --template-body file://test-stack.yml
{
    "StackId": "arn:aws:cloudformation:ap-northeast-1:999999999999:stack/test-stack/99xx99xx-99xx-99xx-99xx-99xx99xx99xx"
}

修正

以下のように AccessControl を追加する修正を行う。

 AWSTemplateFormatVersion: 2010-09-09
 Resources:
   S3Bucket:
     Type: AWS::S3::Bucket
+    Properties:
+      AccessControl: PublicReadWrite

dry-run 結果

修正を create-change-set と describe-change-set で dry-run する。
結果は以下。

$ aws cloudformation create-change-set --stack-name test-stack --change-set-name test-stack-dry-run --template-body file://test-stack.yml
{
    "Id": "arn:aws:cloudformation:ap-northeast-1:999999999999:changeSet/test-stack-dry-run/9999xxxx-9999-99xx-99xx-9999xxxx9999",
    "StackId": "arn:aws:cloudformation:ap-northeast-1:999999999999:stack/test-stack/99xx99xx-99xx-99xx-99xx-99xx99xx99xx"
}

$ aws cloudformation describe-change-set --stack-name test-stack --change-set-name test-stack-dry-run
{
    "Changes": [
        {
            "Type": "Resource",
            "ResourceChange": {
                "Action": "Modify",
                "LogicalResourceId": "S3Bucket",
                "PhysicalResourceId": "test-stack-s3bucket-99xx99xx99xx",
                "ResourceType": "AWS::S3::Bucket",
                "Replacement": "False",
                "Scope": [
                    "Properties"
                ],
                "Details": [
                    {
                        "Target": {
                            "Attribute": "Properties",
                            "Name": "AccessControl",
                            "RequiresRecreation": "Never"
                        },
                        "Evaluation": "Static",
                        "ChangeSource": "DirectModification"
                    }
                ]
            }
        }
    ],
    "ChangeSetName": "test-stack-dry-run",
    "ChangeSetId": "arn:aws:cloudformation:ap-northeast-1:999999999999:changeSet/test-stack-dry-run/9999xxxx-9999-99xx-99xx-9999xxxx9999",
    "StackId": "arn:aws:cloudformation:ap-northeast-1:999999999999:stack/test-stack/99xx99xx-99xx-99xx-99xx-99xx99xx99xx",
    "StackName": "test-stack",
    "Description": null,
    "Parameters": null,
    "CreationTime": "2019-06-16T17:00:00.823Z",
    "ExecutionStatus": "AVAILABLE",
    "Status": "CREATE_COMPLETE",
    "StatusReason": null,
    "NotificationARNs": [],
    "RollbackConfiguration": {},
    "Capabilities": [],
    "Tags": null
}