aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Rollback of AWS::EC2::LaunchTemplate does not remove new version of launch template

Open
#1,912 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::LaunchTemplate

### Resource Name

_No response_

### Issue Description

Sample CFN with one ASG and one LT:

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: Sample CFN
Resources:
ControllerAutoscalingGroup:
Type: AWS::AutoScaling::AutoScalingGroup
Properties:
DesiredCapacity: '1'
HealthCheckGracePeriod: 1200
HealthCheckType: EC2
TargetGroupARNs:
- !Ref SomeTargetGroupElsewhereInTheTemplate
LaunchTemplate:
LaunchTemplateId: !Ref ControllerLaunchTemplate
Version: !GetAtt ControllerLaunchTemplate.LatestVersionNumber
MetricsCollection:
- Granularity: 1Minute
MaxSize: '5'
MinSize: '1'
VPCZoneIdentifier:
- !Sub '{{resolve:ssm:/subnets/a}}'
- !Sub '{{resolve:ssm:/subnets/b}}'
- !Sub '{{resolve:ssm:/subnets/c}}'
CreationPolicy:
ResourceSignal:
Timeout: PT120M
Count: '1'
UpdatePolicy:
AutoScalingReplacingUpdate:
WillReplace: true
AutoScalingRollingUpdate:
MaxBatchSize: 1
MinInstancesInService: 1
MinSuccessfulInstancesPercent: 1
PauseTime: PT1H
WaitOnResourceSignals: true
AutoScalingScheduledAction:
IgnoreUnmodifiedGroupSizeProperties: true
ControllerLaunchTemplate:
Type: AWS::EC2::LaunchTemplate
Properties:
LaunchTemplateData:
BlockDeviceMappings:
- DeviceName: /dev/sda1
Ebs:
Encrypted: true
DeleteOnTermination: true
VolumeSize: 256
EbsOptimized: true
IamInstanceProfile:
Name: !Sub '{{resolve:ssm:/iam/role}}'
ImageId: !Sub '{{resolve:ssm:/ami/redhat8:11}}'
Monitoring:
Enabled: true
InstanceType: m4.2xlarge
KeyName: my-shh-key
SecurityGroupIds:
- !Sub '{{resolve:ssm:/some_security_group}}'
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe

PATH="/usr/local/bin:${!PATH}";
REGION="${AWS::Region}";
STACK_NAME="${AWS::StackName}";
ASG_NAME="ControllerAutoscalingGroup";
TEMPLATE_NAME="ControllerLaunchTemplate";

aws configure set default.region ${AWS::Region};

function error_exit {
/usr/bin/cfn-signal --region $REGION --exit-code 1 --reason '$1' --stack $STACK_NAME --resource $ASG_NAME;
exit 1;
}

/usr/bin/cfn-init -v --region $REGION --stack $STACK_NAME --resource $TEMPLATE_NAME --configsets ascending || error_exit 'Failed to run cfn-init.';
/usr/bin/cfn-hup || error_exit 'Failed to start cfn-hup';
/usr/bin/cfn-signal --region $REGION --success true --stack $STACK_NAME --resource $ASG_NAME;
Metadata:
AWS::CloudFormation::Init:
configSets:
ascending:
- '01-config'
- '02-setup'
01-config:
files:
/etc/cfn/cfn-hup.conf:
content: !Sub |
[main]
stack=${AWS::StackId}
region=${AWS::Region}
verbose=true
mode: '000400'
owner: root
group: root
/etc/cfn/hooks.d/cfn-auto-reloader.conf:
content: !Sub |
[cfn-auto-reloader-hook]
triggers=post.update
path=Resources.ControllerLaunchTemplate.Metadata.AWS::CloudFormation::Init
action=/usr/bin/cfn-init -v --stack ${AWS::StackName} --resource ControllerLaunchTemplate --configsets ascending --region ${AWS::Region}
runas=root
services:
sysvinit:
cfn-hup:
enabled: 'true'
ensureRunning: 'true'
files:
- /etc/cfn/cfn-hup.conf
- /etc/cfn/hooks.d/cfn-auto-reloader.conf
02-setup:
files:
/root/setup.sh:
content: |
#!/bin/bash -ex

some amazing things here that may fail
mode: '000774'
owner: root
group: root
commands:
00-install-executor:
command: /root/setup.sh
```

So let's say previous to launch I have 1 version of the launch template resource. After the launch, a new launch template resource gets created. Now let's say CloudFormation rolls back due to some error hit in the ASG. My expectation is that the launch template that was created during the deployment is deleted on rollback.

Now the latest version of the launch template after rollback is version 2.

I find this to be a gotcha if you have a CloudFormation template where you might manage multiple ASGs and LTs or if you want to revert the code for your LT to what you expect is currently deployed so your next update doesn't try to replace your ASG but instead your ASG will attempt to be replaced.

### Expected Behavior

During rollback I expect the new launch template to be deleted and the latest version to be the version which was latest previous to deployment

### Observed Behavior

Latest launch template does not get deleted by CloudFormation upon rollback

### Test Cases

Launch a very simple cloudformation template with a dead simple launch template and asg. Let that succeed. Now update the launch template such that CFN will create a new one (say with a new valid AMI) and also update the ASG to ensure the cfn stack fails (add "exit 1" in the userdata somewhere). Upon rollback your launch template's latest version should be 1. It will instead be 2.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the minimal CloudFormation template in the issue, using an Auto Scaling group and AWS::EC2::LaunchTemplate, then reproduce an update that fails through userdata. Verify that rollback removes the newly created launch template version and restores the previously latest version.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.