Scenario
I have a Cloudformation (cfn) template that can conditionally build or omit specific resources. The stack requires a RADIUS service (specifics are unimportant) and the template can either build one for the user or can accept an IP Address of a pre-existing service. I use 2 parameters to allow the user to specify how the template works:
Parameters: DeployFreeRadius: Description: Will build a freeradius server and use as workspaces MFA. allowed values - yes, no Default: "yes" Type: String AllowedValues: ["yes","no"] ExistingRadiusIp: Description: If you have an existing RADIUS server, input the IP. Only Specify if DeployFreeRadius == no Type: String AllowedPattern: '(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})|^(?![\s\S])' ConstraintDescription: Must be a valid IP address or empty The Problem
What happens if if a user says "no" to deploying RADIUS but also doesn't provide an IP? Or, what happens when they say "yes" and also provide an IP? Bad stuff, I'm sure.
Luckily, I discovered an undocumented cloudformation feature, constraint rules. The feature was built specifically for Service Catalog to quickly fail a stack build when a user provides untenable param values. Below are the "rules" I wrote to prevent the undesirable scenarios detailed in the previous paragraph.
Rules: # Fail when any assertion returns false # Check if instructed do not deploy RADIUS and provides no RADIUS svr ip NoDeployAndNoExistingProvided: RuleCondition: !Equals - !Ref DeploySampleRADIUS - "no" Assertions: - AssertDescription: You must either Deploy RADIUS or specify a RADIUS Server IP Assert: !Not - !Equals - !Ref ExistingRADIUSIp - "" # Check if instructed to deploy RADIUS and provides also provides RADIUS svr ip DeployButAlsoExistingProvided: RuleCondition: !Equals - !Ref DeploySampleRADIUS - "yes" Assertions: - AssertDescription: You must either Deploy RADIUS or specify a RADIUS Server IP Assert: !Equals - !Ref ExistingRADIUSIp - "" Conclusion
If your user provides the incorrect parameter values, the stack build fails almost instantly. Here's an example of what the error looks like:
Update: A coworker shared that this feature actually has been documented!
Top comments (0)