Cloudformation Extension - Activation Guide
Tags: aws, serverless
Published: 2023-08-22 11:28:11

# **📖** Cloudformation Registry

Cloudformation Provides registry extensions to use in the Cloudformation template through which we can create custom resources, manage or view resource configuraitons at the build time of the Cloudformation stack. More on the [AWS Cloudformation Docs] (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/registry.html)

The CloudFormation registry lets you manage extensions, both public and private, such as resources, modules, and hooks that are available for use in your AWS account. Currently, you can use the following extension types in the AWS registry: [`resources types`](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/resource-types.html), [`modules`](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/modules.html), and [`hooks`](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/hooks.html). The registry makes it easier to discover and provision extensions in your AWS CloudFormation templates in the same manner you use AWS-provided resources.

In this guide, we will be using Serverless framework to write the CF template.

> *Note: We can only deploy the activation resources once as we can only Activate the extension one time in a single AWS Account. Deploying same after the extension is activated might throw error in the Cloudformation.*
> 

# **🛠** Extension Setup & Configurations

Cloudformation Extensions require `Execution Role` which can help extension perform certain actions for the resource we want to create or manage.

Additionally we can provide the `Logging Config` which can help log the events from the extensions. We can also pass `Extention Configurations` to have any additional configurations added to the extension at run time.

# **💡**Extension Activation

In this article we will try to activate public third party extensions of different types. 

First we will create execution role which can be used by the Extensions to perform actions on Cloudformation Resources.

### **🔐** Execution Role

You can define more permissions in the role policy if you need to attach other service policies.

```jsx
ExecutionRole: {
    Type: "AWS::IAM::Role",
    Properties: {
      Path: "/",
      RoleName: `ExtensionExecutionRule`,
      Description: "IAM Role Execution role for Cloudformation Extension",
      MaxSessionDuration: 8400,
      AssumeRolePolicyDocument: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Allow",
            Principal: {
              Service: [
                "hooks.cloudformation.amazonaws.com",
                "resources.cloudformation.amazonaws.com",
              ],
            },
            Action: "sts:AssumeRole",
          },
        ],
      },
    },
  }
```

### Resource Type

[`Github::Repository::Secret`](https://eu-west-1.console.aws.amazon.com/cloudformation/home?region=eu-west-1#/registry/public-extensions/details/configuration?arn=arn%3Aaws%3Acloudformation%3Aeu-west-1%3A%3Atype%2Fhook%2Fe1238fdd31aee1839e14fb3fb2dac9db154dae29%2FGeneric-SecretsProtection-Hook) is a public third party RESOURCE type extension.

```jsx
GithubRepoSecretExtensionActivation: {
  Type: "AWS::CloudFormation::TypeActivation",
  Properties: {
    AutoUpdate: true,
    ExecutionRoleArn: {
      "Fn::GetAtt": ["ExecutionRole", "Arn"],
    },
		LoggingConfig: {
			LogGroupName : {
				Ref: "GithubRepoSecretExtensionLogGroup"
			},
		  LogRoleArn : ["ExtensionLogRole", "Arn"]
		}
    PublicTypeArn: {
      "Fn::Join": [
        "",
        [
          "arn:aws:cloudformation:",
          { Ref: "AWS::Region" },
          "::type/resource/c830e97710da0c9954d80ba8df021e5439e7134b/GitHub-Repositories-Secret",
        ],
      ],
    },
    Type: "RESOURCE",
    TypeName: "GitHub::Repositories::Secret",
    VersionBump: "MAJOR",
  },
}
```

### Module Type

[`JFrog::Vpc::MultiAz::MODULE`](https://eu-west-1.console.aws.amazon.com/cloudformation/home?region=eu-west-1#/registry/public-extensions/details/schema?arn=arn%3Aaws%3Acloudformation%3Aeu-west-1%3A%3Atype%2Fmodule%2F06ff50c2e47f57b381f874871d9fac41796c9522%2FJFrog-Vpc-MultiAz-MODULE) is a public third party MODULE resource.

```jsx
JFrogModuleExtensionActivation: {
  Type: "AWS::CloudFormation::TypeActivation",
  Properties: {
    AutoUpdate: true,
    ExecutionRoleArn: {
      "Fn::GetAtt": ["ExecutionRole", "Arn"],
    },
		LoggingConfig: {
			LogGroupName : {
				Ref: "JFrogModuleExtensionLogGroup"
			},
		  LogRoleArn : ["ExtensionLogRole", "Arn"]
		}
    PublicTypeArn: {
      "Fn::Join": [
        "",
        [
          "arn:aws:cloudformation:",
          { Ref: "AWS::Region" },
          "::type/module/06ff50c2e47f57b381f874871d9fac41796c9522/JFrog-Vpc-MultiAz-MODULE",
        ],
      ],
    },
    Type: "MODULE",
    TypeName: "JFrog::Vpc::MultiAz::MODULE",
    VersionBump: "MAJOR",
  },
}
```

### Hooks Type

[`Generic::SecretsProtection::Hook`](https://eu-west-1.console.aws.amazon.com/cloudformation/home?region=eu-west-1#/registry/public-extensions/details/configuration?arn=arn%3Aaws%3Acloudformation%3Aeu-west-1%3A%3Atype%2Fhook%2Fe1238fdd31aee1839e14fb3fb2dac9db154dae29%2FGeneric-SecretsProtection-Hook) is a third party HOOK resource type. 

```jsx
GenericSecretsProtectionHookExtensionActivation: {
  Type: "AWS::CloudFormation::TypeActivation",
  Properties: {
    AutoUpdate: true,
    ExecutionRoleArn: {
      "Fn::GetAtt": ["ExecutionRole", "Arn"],
    },
		LoggingConfig: {
			LogGroupName : {
				Ref: "GenericSecretsProtectionHookExtensionLogGroup"
			},
		  LogRoleArn : ["ExtensionLogRole", "Arn"]
		}
    PublicTypeArn: {
      "Fn::Join": [
        "",
        [
          "arn:aws:cloudformation:",
          { Ref: "AWS::Region" },
          "::type/hook/e1238fdd31aee1839e14fb3fb2dac9db154dae29/Generic-SecretsProtection-Hook",
        ],
      ],
    },
    Type: "HOOK",
    TypeName: "Generic::SecretsProtection::Hook",
    VersionBump: "MAJOR",
  },
}
```

In addition to these fields you can pass `TypeNameAlias` properties which can be set to any custom values developer wants. And can be used in Cloudformation using that Alias Name. You can find all the properties for [`Cloudformation TypeActivation`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudformation-typeactivation.html) in AWS Docs.

# **⚙️** Setting up Extension Configurations

If the extension needs any additional configurations needed then we can set them using an AWS CLI command

```bash
aws cloudformation set-type-configuration --type-name "GitHub::Repositories::Secret" --type RESOURCE --configuration-alias ConfigurationName --configuration '{"Credentials": {"ApiKey": "abc", "ApplicationKey": "abc"}}'
```

> Note: _If you specify TypeNameAlias field when extension activation, you’ll need to enter that Alias as `--type-name` while executing above command to set type configurations._


Hope this help a developer in need! 🎁