How to use the power of CloudFormation custom resources for great good
Tags: aws, cloudformation, lambda, programming
Published: 2019-09-01 21:25:51

---
title: How to use the power of CloudFormation custom resources for great good
published: true
tags: AWS,CloudFormation,Lambda,Programming
canonical_url: https://theburningmonk.com/2019/09/how-to-use-the-power-of-cloudformation-custom-resources-for-great-good/
---

<section>
<div></div>
<div>
<div>
<p><strong>Disclaimer</strong>: if you’re new to CloudFormation custom resources, then I recommend you start by reading <a href="https://www.alexdebrie.com/posts/cloudformation-custom-resources/" target="_blank" rel="noopener noreferrer" data-href="https://www.alexdebrie.com/posts/cloudformation-custom-resources/"><strong>this excellent post</strong></a> by Alex Debrie first.</p>
</div>
</div>
</section><section>
<div>
<hr>
</div>
<div>
<div>
<p>Custom resources bring a whole new dimension to CloudFormation and enable some fascinating use cases. For example:</p>
<ul>
<li>provision DataDog dashboards as part of your CloudFormation stack</li>
<li>run a load test every time you deploy a CloudFormation stack</li>
<li>provision/modify AWS resources that are not natively supported by CloudFormation (e.g. EventBridge)</li>
</ul>
<p>You can use custom resources to run one-off tasks as part of every CloudFormation deployment. Which is something I wanted to do in many of my SAR apps such as <a href="https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:374852340823:applications~auto-subscribe-log-group-to-arn" target="_blank" rel="noopener noreferrer" data-href="https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:374852340823:applications~auto-subscribe-log-group-to-arn">this</a> and <a href="https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:374852340823:applications~auto-set-log-group-retention" target="_blank" rel="noopener noreferrer" data-href="https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:374852340823:applications~auto-set-log-group-retention">this</a>. However, I had always assumed that this would require a two-step process:</p>
<ol>
<li>deploy a SAR/CloudFormation stack to provision the custom resource Lambda function</li>
<li>deploy the intended SAR app which uses the custom resource</li>
</ol>
<p><strong>Turns out, I was wrong</strong>. You can include the custom resource Lambda function in the same CloudFormation stack that uses it. In hindsight, I was overthinking things – in essence, all we are doing is referencing a Lambda function by ARN. You’ll see what this means later.</p>
<p>My latest SAR app, <a href="https://github.com/lumigo-io/SAR-Propagate-CFN-Tags" target="_blank" rel="noopener noreferrer" data-href="https://github.com/lumigo-io/SAR-Propagate-CFN-Tags"><strong>propagate-cfn-tags</strong></a>, tackles the issue that CloudFormation does not propagate its tags to some resources such as CloudWatch log groups. This means you can’t include CloudWatch log groups in your cost monitoring (via cost allocation tags), amongst other things.</p>
<p>When you deploy the app, I want to run a one-off script to process all existing stacks in the region and propagate their tags. This is where custom resources come in.</p>
<p>With the help of custom resources, I can:</p>
</div>
</div>
</section>
- create a `PropagateAll` Lambda function to process existing CloudFormation stacks

![](https://theburningmonk.com/wp-content/uploads/2019/09/img_5d6c1c5c5f154.png)

- create a Lambda function to support a `Custom::LambdaInvocation` custom resource type

![](https://theburningmonk.com/wp-content/uploads/2019/09/img_5d6c1c68de8d4.png)

- create a `Custom::LambdaInvocation` resource to trigger the `PropagateAll` function during the CloudFormation deployment

![](https://theburningmonk.com/wp-content/uploads/2019/09/img_5d6c1c72a4b12.png)

I can do all these in the same SAR app. This gives the user a seamless experience. As far as they’re concerned, you just deploy the app and everything happens as advertised. No two-step deployment process, no need to trigger functions manually.

This simple pattern combines very well with CloudWatch events (or EventBridge):

- a custom resource to update existing resources (e.g. propagate tags for existing CloudFormation stacks)
- CloudTrail + event pattern to process future changes (e.g. propagate tags for future CloudFormation stack deployments)

I find this combination especially useful when building “platform” features. That is, features that span across all my applications running in AWS. For example, making sure all CloudWatch log groups are subscribed to a Kinesis stream. These are not decision points that should be taken at the project level. Which is why I’m not a fan of using Serverless framework plugins to configure these settings.

 ![](https://theburningmonk.com/wp-content/uploads/2019/03/img_5c8ca195210d5.png)

Hi, my name is **Yan Cui**. I’m an **[AWS Serverless Hero](https://aws.amazon.com/developer/community/heroes/yan-cui/)** and the author of [**Production-Ready Serverless**](https://bit.ly/production-ready-serverless). I have run production workload at scale in AWS for nearly 10 years and I have been an architect or principal engineer with a variety of industries ranging from banking, e-commerce, sports streaming to mobile gaming. I currently work as an independent consultant focused on AWS and serverless.

You can contact me via [Email](mailto:theburningmonk.com), [Twitter](https://twitter.com/theburningmonk) and [LinkedIn](https://www.linkedin.com/in/theburningmonk/).

[Hire me.](https://theburningmonk.com/hire-me)

The post [How to use the power of CloudFormation custom resources for great good](https://theburningmonk.com/2019/09/how-to-use-the-power-of-cloudformation-custom-resources-for-great-good/) appeared first on [theburningmonk.com](https://theburningmonk.com).

 ![](http://feeds.feedburner.com/~r/theburningmonk/~4/eU9p4192PL8)