Infrastructure-As-Code for AWS using Azure DevOps, CloudFormation Template, and Terraform
By: Jagdeep Soni
Tags: Azure Devops, Cloudformation, AWS, Terraform, Infrastructure As Code

Infrastructure as code is now mainstream for cloud infrastructure provisioning and managing. There is no second argument about the need of setting up IaC as a part of modern application development. There are various frameworks and tools available to setup IaC. Terraform is one of the most popular infrastructures as a code software tool. In this article, we will see how to use Terraform for AWS cloud.

You may be wondering why I am using all these tools together. So, here is my explanation.

1) Azure DevOps is used as a CI tool to create pipelines. We can also use AWS CI tools or gitlab runners or any other tool. 2) CloudFormation is used to create first VM in AWS that could be registered as an AZ DevOps agent. We can also create this VM using Web Portal or AWS CLI. 3) And finally Terraform, which is my tool of choice for IaC. You can continue to use CloudFormation templates for other infrastructure set up as well.

So, what is in it for you?

The end goal is to be able to execute the Terraform code to create AWS resources. Usually, we have to deal with the complexity of managing access keys to initiate terraform but we will first create EC2 instance with an Admin role to execute terraform code.

The whole activity can be split into the following steps:

CloudFormation template to create a VM

Register this VM as Azure DevOps agent

Create an Azure DevOps pipeline to trigger the CloudFormation template

Terraform sample to create AWS resource

Azure DevOps pipeline sample to trigger terraform

Let’s get started with some code

We need a CloudFormation template to create an AWS stack. The below gist can be used to create a VM and other required resources.

💡 It is important to note role assignment in the above snippet. arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM is required for instance connection and arn:aws:iam::aws:policy/AdministratorAccess to execute terraform code from this agent

Now that we have the VM in place, we need to configure this VM as a DevOps agent. We can follow the steps described here to configure this VM as an agent. Some of these steps can be configured in UserData field in the above template. A small snippet is shown below.

UserData:

Fn::Base64: !Sub |

#!/bin/bash

export PAT_TOKEN=${PatToken}

export POOL_NAME=${PoolName}

export AGENT_NAME=${AgentName} ## Download the Linux agent /home/ubuntu/buildagent/config.sh --unattended --auth pat --token $PAT_TOKEN --url https://dev.azure.com/ --pool $POOL_NAME --agent $AGENT_NAME sudo /home/ubuntu/buildagent/svc.sh install sudo /home/ubuntu/buildagent/svc.sh start

Time to put the pipeline in place

Let’s create an Azure DevOps pipeline to trigger this CloudFormation template. We first need to create AWS Service Connection in Azure DevOps.

Service Connection in Azure DevOps

We can then use AWS tasks to configure this pipeline. In this case, we need the AWS CloudFormation Create/Update Stack task. We need to fill in some of the following inputs to use this task.

Finally, the pipeline yaml would look like the below snippet.

Time to create a Terraform script

There are a few good scripts in this repository. For this article, we will take a simple example to create Elastic Container Registry(ECR) using terraform.

Now the final step is to create an Azure DevOps Pipeline to trigger terraform code. Below is the code snippet for Azure DevOps Pipeline.

We need to make sure that we should use same Agent Pool in which we have registered the instance created in step 1

Conclusion 🎉

I hope this article will help you to kick start IaC in your application. Please feel free to share your questions, feedback, and experience in the comments section.

👋 Join FAUN today and receive similar stories each week in your inbox! ️ Get your weekly dose of the must-read tech stories, news, and tutorials.

Follow us on Twitter 🐦 and Facebook 👥 and Instagram 📷 and join our Facebook and Linkedin Groups 💬