Lab complete!
Now that you have completed this lab, make sure to update your Well-Architected review if you have implemented these changes in your workload.
Click here to access the Well-Architected Tool
There might be situations where you want to deploy the same infrastructure in multiple AWS Regions and/or multiple AWS accounts to increase reliability of the workload or to improve performance by having the infrastructure geographically closer to your end users. You can use AWS CloudFormation StackSets to perform this as a single operation instead of switching regions or accounts to individually deploy each stack.
From an administrator account, you can define a CloudFormation template and use it to provision stacks in multiple target accounts, across multiple AWS Regions.
For this exercise we will assume you now know how to edit your CloudFormation template and update your CloudFormation stack with the updated template.
AWS CloudFormation StackSets requires specific permissions to be able to deploy stacks in multiple AWS accounts across multiple AWS Regions. It needs an administrator role that is used to perform StackSets operations, and an execution role to deploy the actual stacks in target accounts. These roles require specific naming conventions - AWSCloudFormationStackSetAdministrationRole for the administrator role, and AWSCloudFormationStackSetExecutionRole for the execution role. StackSets execution will fail if either of these roles are missing. The AWSCloudFormationStackSetAdministrationRole should be created in the account where you are creating the StackSet (The Administrator account - see the diagram above). The AWSCloudFormationStackSetExecutionRole should be created in each target account where you wish to deploy the stack. Learn more about granting self-managed permissions for CloudFormation StackSets. If you accounts are managed using AWS Organizations, you can enable trusted access and CloudFormation will take care of provisioning all the necessary roles across the accounts.
For this lab, we will walk through the process of creating a StackSet to deploy stacks across multiple regions in a single account (the same account where the StackSet is being created). For simplicity and ease of use, we will use CloudFormation to create the administrator and execution roles.
StackSetAdministratorRole
The stack will finish creating and the Status will be CREATE_COMPLETE in about 30 seconds.
Now that a StackSet administrator role has been created, we need to create the StackSet execution role.
StackSetExecutionRole
The stack will finish creating and the Status will be CREATE_COMPLETE in about 30 seconds.
Now that the necessary permissions have been created, the next step is to launch CloudFormation stacks across different AWS Regions using StackSets.
Go to the AWS CloudFormation StackSets console and click Create StackSet
Leave Prepare template setting as-is
Click Next
For Stack name use StackSetsLab
Ensure that the values for the following Parameters are as follows. You can use default values for the rest.
Click Next
For Configure StackSet options we recommend configuring tags, which are key-value pairs, that can help you identify your stacks and the resources they create. For example, enter Owner in the left column which is the key, and your email address in the right column which is the value.
For Permissions select Self-service permissions.
AWSCloudFormationStackSetExecutionRole
.Click Next
Under Accounts, select Deploy stacks in accounts under Deployment locations.
Under Account numbers enter the 12 digit AWS account ID for the account you are using for this lab. You can find this by clicking on the user/role drop down you have logged into the account with on the top right corner.
Under Specify regions select 2 regions you would like to deploy the stacks across. I have selected US East (N.Virginia) and US West (Oregon). You can select as many regions as you want to deploy stacks into, including the same region where the StackSet is being created.
Leave values for Deployment options as-is and click Next.
For Review
The operation takes about 3-4 minutes to complete and the stacks to be deployed in the selected Regions.
Go to the AWS CloudFormation StackSets console and click on the StackSet StackSetsLab.
Click on the Stack instances tab to see the AWS account and region stacks were deployed in.
Change the AWS Region you are on by clicking on the top right corner of the console and select one of the AWS Regions you specified for the StackSet. In my case, I will select US West (Oregon) us-west-2.
After switching regions, go to the AWS CloudFormation console
You should see a new CloudFormation stack that has been created with the prefix StackSet-StackSetsLab-.
Click on the stack name and then click on the Outputs tab.
Click on the Value for PublicServerDNS and observe the response.
Repeat the previous steps for another AWS Region that you specified when creating the StackSet. You will see that the webpage has changed to reflect the region the instance was launched in. Using StackSets, you have deployed your infrastructure to various AWS Regions in a single operation. This will greatly increase the speed of multi-region and multi-account deployments of your infrastructure and is controlled from a central location.
Troubleshooting
Now that you have completed this lab, make sure to update your Well-Architected review if you have implemented these changes in your workload.
Click here to access the Well-Architected Tool