Deploys AWS CloudFormation Stacks.
- name: Deploy to AWS CloudFormation
uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: MyStack
template: myStack.yaml
parameter-overrides: "MyParam1=myValue,MyParam2=${{ secrets.MY_SECRET_VALUE }}"The action can be passed a CloudFormation Stack name and a template file. The template file can be a local file existing in the working directory, or a URL to template that exists in an Amazon S3 bucket. It will create the Stack if it does not exist, or create a Change Set to update the Stack. An update fails by default when the Change Set is empty. Setting no-fail-on-empty-changeset: "1" will override this behavior and not throw an error.
You can learn more about AWS CloudFormation
A few inputs are highlighted below. See action.yml for the full documentation for this action's inputs and outputs.
Key-value pairs for parameter Overides. This input can be in multiple formats. See all examples below.
- YAML Formatted String:
- uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: cloudformation-stack-name
template: https://s3.amazonaws.com/some-template.yaml
parameter-overrides: |
SystemTag: AWS_CF_GH_DEPLOY
Environment: prod
- YAML Formatted String with Key and Value grouping:
- uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: cloudformation-stack-name
template: https://s3.amazonaws.com/some-template.yaml
parameter-overrides: |
- ParameterKey: SystemTag
ParameterValue: AWS_CF_GH_DEPLOY
- ParameterKey: Environment
ParameterValue: prod
- Legacy String format
- name: Deploy Cloudformation
uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: ${{ env.ENVIRONMENT }}-${{ env.NAME }}
template: cloudformation.yaml
capabilities: CAPABILITY_NAMED_IAM
no-fail-on-empty-changeset: 1
parameter-overrides: >
Name=${{ env.NAME }},
Environment=${{ env.ENVIRONMENT }},
Bucket=${{ env.BUCKET }},
AppArtifact=${{ env.BEANSTALK_ARTIFACT }},
AccountAlias=${{ env.ACCOUNT }}
ASGMinSize=${{ env.ASG_MIN_SIZE }},
ASGMaxSize=${{ env.ASG_MIN_SIZE }},
DeleteCWLogs=${{ env.DELETE_CW_LOGS }},
EC2IAMRole=${{ env.IAM_ROLE }},
PrivateVPCId=${{ env.VPC_ID }},
PrivateVPCSubnets="${{ env.VPC_SUBNETS }}",
PrivateELBSubnets="${{ env.ELB_SUBNETS }}",
ProxyAPISecurityGroup=${{ env.PROXY_SECURITY_GROUP }}
Key-value pairs to associate with this stack. This input can be in multiple formats. See all examples below.
- YAML Formatted String:
- uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: cloudformation-stack-name
template: https://s3.amazonaws.com/some-template.yaml
tags: |
SystemTag: AWS_CF_GH_DEPLOY
Environment: prod
- YAML Formatted String with Key and Value grouping:
- uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: cloudformation-stack-name
template: https://s3.amazonaws.com/some-template.yaml
tags: |
- Key: SystemTag
Value: AWS_CF_GH_DEPLOY
- Key: Environment
Value: prod
- JSON Formatted String:
- uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: cloudformation-stack-name
template: https://s3.amazonaws.com/some-template.yaml
tags: |
{
"SystemTag": "AWS_CF_GH_DEPLOY",
"Environment": "prod"
}
- JSON Formatted String with Key and Value grouping:
- uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: cloudformation-stack-name
template: https://s3.amazonaws.com/some-template.yaml
tags: |
[
{"Key": "SystemTag", "Value": "AWS_CF_GH_DEPLOY"},
{"Key": "Environment", "Value": "prod"}
]
This action relies on the default behavior of the AWS SDK for Javascript to determine AWS credentials and region.
Use the chikin-4x/configure-aws-credentials action to configure the GitHub Actions environment with environment variables containing AWS credentials and your desired region.
- If you only need to change the region, you can supply that as a parameter:
- uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: cloudformation-stack-name
template: https://s3.amazonaws.com/some-template.yaml
region: us-west-2
We recommend following Amazon IAM best practices for the AWS credentials used in GitHub Actions workflows, including:
- Do not store credentials in your repository's code. You may use GitHub Actions secrets to store credentials and redact credentials from GitHub Actions workflow logs.
- Create an individual IAM user with an access key for use in GitHub Actions workflows, preferably one per repository. Do not use the AWS account root user access key.
- Grant least privilege to the credentials used in GitHub Actions workflows. Grant only the permissions required to perform the actions in your GitHub Actions workflows. See the Permissions section below for the permissions required by this action.
- Rotate the credentials used in GitHub Actions workflows regularly.
- Monitor the activity of the credentials used in GitHub Actions workflows.
This action requires the following minimum set of permissions:
We recommend to read AWS CloudFormation Security Best Practices
{
"Version":"2012-10-17",
"Statement":[{
"Effect":"Allow",
"Action":[
"cloudformation:*"
],
"Resource":"*"
},
{
"Effect":"Deny",
"Action":[
"cloudformation:DeleteStack"
],
"Resource":"arn:aws:cloudformation:us-east-1:123456789012:stack/MyProductionStack/*"
}]
}
The policy above prevents the stack to be deleted by a policy for production
You want to run your microservices with Amazon Elastic Kubernetes Services and leverage the best-practices to run the cluster? Using this GitHub Action you can customize and deploy the modular and scalable Amazon EKS architecture provided in an AWS Quick Start to your AWS Account. The following workflow enables you to create and update a Kubernetes cluster using a manual workflow trigger.
You only have to create an Amazon EC2 key pair to run this workflow.
name: Deploy Cluster
on:
workflow_dispatch:
inputs:
region:
description: 'AWS Region'
required: true
default: 'eu-west-1'
keypair:
description: 'SSH Key Pair'
required: true
jobs:
cluster:
name: Deploy stack to AWS
runs-on: ubuntu-latest
outputs:
env-name: ${{ steps.env-name.outputs.environment }}
steps:
- name: Deploy Amazon EKS Cluster
id: eks-cluster
uses: chikin-4x/aws-cloudformation-github-deploy@master
with:
name: cloudformation-stack-name
template: https://s3.amazonaws.com/some-template.yaml
no-fail-on-empty-changeset: "1"
parameter-overrides: >-
AvailabilityZones=${{ github.event.inputs.region }}a,
AvailabilityZones=${{ github.event.inputs.region }}c,
KeyPairName=${{ github.event.inputs.keypair }},
NumberOfAZs=2,
ProvisionBastionHost=Disabled,
EKSPublicAccessEndpoint=Enabled,
EKSPrivateAccessEndpoint=Enabled,
RemoteAccessCIDR=0.0.0.0/0
tags: |
SystemTag: AWS_CF_GH_DEPLOY
Environment: prod