aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
Rollback of AWS::EC2::LaunchTemplate does not remove new version of launch template
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::EC2::LaunchTemplate
### Resource Name
_No response_
### Issue Description
Sample CFN with one ASG and one LT:
```yaml
AWSTemplateFormatVersion: '2010-09-09'
Description: Sample CFN
Resources:
ControllerAutoscalingGroup:
Type: AWS::AutoScaling::AutoScalingGroup
Properties:
DesiredCapacity: '1'
HealthCheckGracePeriod: 1200
HealthCheckType: EC2
TargetGroupARNs:
- !Ref SomeTargetGroupElsewhereInTheTemplate
LaunchTemplate:
LaunchTemplateId: !Ref ControllerLaunchTemplate
Version: !GetAtt ControllerLaunchTemplate.LatestVersionNumber
MetricsCollection:
- Granularity: 1Minute
MaxSize: '5'
MinSize: '1'
VPCZoneIdentifier:
- !Sub '{{resolve:ssm:/subnets/a}}'
- !Sub '{{resolve:ssm:/subnets/b}}'
- !Sub '{{resolve:ssm:/subnets/c}}'
CreationPolicy:
ResourceSignal:
Timeout: PT120M
Count: '1'
UpdatePolicy:
AutoScalingReplacingUpdate:
WillReplace: true
AutoScalingRollingUpdate:
MaxBatchSize: 1
MinInstancesInService: 1
MinSuccessfulInstancesPercent: 1
PauseTime: PT1H
WaitOnResourceSignals: true
AutoScalingScheduledAction:
IgnoreUnmodifiedGroupSizeProperties: true
ControllerLaunchTemplate:
Type: AWS::EC2::LaunchTemplate
Properties:
LaunchTemplateData:
BlockDeviceMappings:
- DeviceName: /dev/sda1
Ebs:
Encrypted: true
DeleteOnTermination: true
VolumeSize: 256
EbsOptimized: true
IamInstanceProfile:
Name: !Sub '{{resolve:ssm:/iam/role}}'
ImageId: !Sub '{{resolve:ssm:/ami/redhat8:11}}'
Monitoring:
Enabled: true
InstanceType: m4.2xlarge
KeyName: my-shh-key
SecurityGroupIds:
- !Sub '{{resolve:ssm:/some_security_group}}'
UserData:
Fn::Base64: !Sub |
#!/bin/bash -xe
PATH="/usr/local/bin:${!PATH}";
REGION="${AWS::Region}";
STACK_NAME="${AWS::StackName}";
ASG_NAME="ControllerAutoscalingGroup";
TEMPLATE_NAME="ControllerLaunchTemplate";
aws configure set default.region ${AWS::Region};
function error_exit {
/usr/bin/cfn-signal --region $REGION --exit-code 1 --reason '$1' --stack $STACK_NAME --resource $ASG_NAME;
exit 1;
}
/usr/bin/cfn-init -v --region $REGION --stack $STACK_NAME --resource $TEMPLATE_NAME --configsets ascending || error_exit 'Failed to run cfn-init.';
/usr/bin/cfn-hup || error_exit 'Failed to start cfn-hup';
/usr/bin/cfn-signal --region $REGION --success true --stack $STACK_NAME --resource $ASG_NAME;
Metadata:
AWS::CloudFormation::Init:
configSets:
ascending:
- '01-config'
- '02-setup'
01-config:
files:
/etc/cfn/cfn-hup.conf:
content: !Sub |
[main]
stack=${AWS::StackId}
region=${AWS::Region}
verbose=true
mode: '000400'
owner: root
group: root
/etc/cfn/hooks.d/cfn-auto-reloader.conf:
content: !Sub |
[cfn-auto-reloader-hook]
triggers=post.update
path=Resources.ControllerLaunchTemplate.Metadata.AWS::CloudFormation::Init
action=/usr/bin/cfn-init -v --stack ${AWS::StackName} --resource ControllerLaunchTemplate --configsets ascending --region ${AWS::Region}
runas=root
services:
sysvinit:
cfn-hup:
enabled: 'true'
ensureRunning: 'true'
files:
- /etc/cfn/cfn-hup.conf
- /etc/cfn/hooks.d/cfn-auto-reloader.conf
02-setup:
files:
/root/setup.sh:
content: |
#!/bin/bash -ex
some amazing things here that may fail
mode: '000774'
owner: root
group: root
commands:
00-install-executor:
command: /root/setup.sh
```
So let's say previous to launch I have 1 version of the launch template resource. After the launch, a new launch template resource gets created. Now let's say CloudFormation rolls back due to some error hit in the ASG. My expectation is that the launch template that was created during the deployment is deleted on rollback.
Now the latest version of the launch template after rollback is version 2.
I find this to be a gotcha if you have a CloudFormation template where you might manage multiple ASGs and LTs or if you want to revert the code for your LT to what you expect is currently deployed so your next update doesn't try to replace your ASG but instead your ASG will attempt to be replaced.
### Expected Behavior
During rollback I expect the new launch template to be deleted and the latest version to be the version which was latest previous to deployment
### Observed Behavior
Latest launch template does not get deleted by CloudFormation upon rollback
### Test Cases
Launch a very simple cloudformation template with a dead simple launch template and asg. Let that succeed. Now update the launch template such that CFN will create a new one (say with a new valid AMI) and also update the ASG to ensure the cfn stack fails (add "exit 1" in the userdata somewhere). Upon rollback your launch template's latest version should be 1. It will instead be 2.
### Other Details
_No response_
Contributor guide
Research direction
Start with the minimal CloudFormation template in the issue, using an Auto Scaling group and AWS::EC2::LaunchTemplate, then reproduce an update that fails through userdata. Verify that rollback removes the newly created launch template version and restores the previously latest version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100