CLI로 만든 VPC를 CloudFormation으로 다시 만들기 (2) — 전체 네트워크

시리즈 CLI로 만든 VPC를 CloudFormation으로 다시 만들기

1 템플릿 기초 — Lab 1~4 2 전체 네트워크 — Lab 5 3 EC2 배포와 삭제 — Lab 6 + Cleanup

L1 L2 L3 L4 L5 L6 Lab 1–4 완료 · Lab 5 진행 중 · Lab 6 예정

Lab 1: VPC 하나만 ← 템플릿 기본 구조

Lab 2: VPC + Subnet ← Parameters, !Ref

Lab 3: 환경별 분기 ← Mappings, !FindInMap

Lab 4: 결과 출력 ← Outputs, Export

Lab 5: 전체 네트워크 ← Intrinsic Functions, DependsOn ← 이번 글

Lab 6: EC2 + 웹서버 ← Cross Stack, User Data

1편에서 배운 개념들을 총동원해서 전체 네트워크를 한 파일로 만든다. CLI로 만든 VPC를 CloudFormation 템플릿으로 옮기는 것이 목표다.

주요 Intrinsic Functions

함수	용도	예시
!Ref	파라미터 값 또는 리소스 ID	!Ref VPC
!GetAtt	리소스의 속성값	!GetAtt EIP.AllocationId
!Sub	문자열 변수 치환	!Sub ${AWS::StackName}-vpc
!Join	문자열 이어붙이기	!Join ['-', [a, b]] → a-b

DependsOn

CloudFormation은 리소스를 병렬로 만든다. !Ref나 !GetAtt으로 참조하면 자동으로 순서가 정해지지만, 명시적 참조가 없는 경우 DependsOn으로 순서를 지정해야 한다.

PublicRoute:
  Type: AWS::EC2::Route
  DependsOn: IGWAttachment   # IGW가 VPC에 붙은 후에 Route 생성
  Properties:
    RouteTableId: !Ref PublicRT
    DestinationCidrBlock: 0.0.0.0/0
    GatewayId: !Ref IGW

만들 리소스

VPC (10.0.0.0/16)

├─ PublicSubnet1 (10.0.0.0/24, AZ-a)

├─ PublicSubnet2 (10.0.1.0/24, AZ-c)

├─ PrivateSubnet1 (10.0.2.0/24, AZ-a)

├─ PrivateSubnet2 (10.0.3.0/24, AZ-c)

├─ IGW + Attachment

├─ PublicRT (0.0.0.0/0 → IGW)

├─ PrivateRT (0.0.0.0/0 → NAT GW)

├─ NAT GW + EIP

└─ RT ↔ Subnet Associations (4개)

실습: 직접 작성해보기

lab05-network.yaml — 아래 뼈대에서 TODO 부분을 채워넣자:

AWSTemplateFormatVersion: "2010-09-09"
Description: Lab 5 - Full Network

Resources:
  # ── VPC ──
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: TutorialVPC

  # ── Subnets (4개) ──
  # TODO: PublicSubnet1, PublicSubnet2, PrivateSubnet1, PrivateSubnet2
  # 힌트: VpcId는 !Ref VPC, AZ는 ap-northeast-2a / ap-northeast-2c

  # ── Internet Gateway ──
  # TODO: IGW 생성 + VPCGatewayAttachment

  # ── Public Route Table ──
  # TODO: PublicRT 생성, Route (0.0.0.0/0 → IGW), Subnet Association 2개
  # 힌트: Route에 DependsOn: IGWAttachment 필요

  # ── NAT Gateway ──
  # TODO: EIP 생성, NatGW 생성 (PublicSubnet1에)
  # 힌트: AllocationId는 !GetAtt EIP.AllocationId

  # ── Private Route Table ──
  # TODO: PrivateRT 생성, Route (0.0.0.0/0 → NatGW), Subnet Association 2개

Outputs:
  VpcId:
    Value: !Ref VPC
    Export:
      Name: !Sub ${AWS::StackName}-VpcId
  PublicSubnet1Id:
    Value: !Ref PublicSubnet1
    Export:
      Name: !Sub ${AWS::StackName}-PublicSubnet1Id
  PrivateSubnet1Id:
    Value: !Ref PrivateSubnet1
    Export:
      Name: !Sub ${AWS::StackName}-PrivateSubnet1Id

직접 채워보자!

CLI에서 이미 한 번 만들어봤으니 어떤 리소스가 필요한지 알고 있다. TODO를 채워넣고 배포해보자. 막히면 아래 정답을 확인.

정답 보기

AWSTemplateFormatVersion: "2010-09-09"
Description: Lab 5 - Full Network

Resources:
  # ── VPC ──
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: TutorialVPC

  # ── Subnets (4개) ──
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.0.0/24
      AvailabilityZone: ap-northeast-2a
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: TutorialPublicSubnet1

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: ap-northeast-2c
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: TutorialPublicSubnet2

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: ap-northeast-2a
      Tags:
        - Key: Name
          Value: TutorialPrivateSubnet1

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.3.0/24
      AvailabilityZone: ap-northeast-2c
      Tags:
        - Key: Name
          Value: TutorialPrivateSubnet2

  # ── Internet Gateway ──
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: TutorialIGW

  AttachInternetGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  # ── Public Route Table ──
  PublicRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: TutorialPublicRT

  RoutePublicRT:
    Type: AWS::EC2::Route
    DependsOn: AttachInternetGateway
    Properties:
      RouteTableId: !Ref PublicRT
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  AssociatePublicRTWithPublicSubnet1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRT

  AssociatePublicRTWithPublicSubnet2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRT

  # ── NAT Gateway ──
  NatGatewayEIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc

  NATGateway:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatGatewayEIP.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: TutorialNATGateway

  # ── Private Route Table ──
  PrivateRT:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: TutorialPrivateRT

  RoutePrivateRT:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRT
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NATGateway

  AssociatePrivateRTWithPrivateSubnet1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRT

  AssociatePrivateRTWithPrivateSubnet2:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRT

Outputs:
  VpcId:
    Value: !Ref VPC
    Export:
      Name: !Sub ${AWS::StackName}-VpcId
  PublicSubnet1Id:
    Value: !Ref PublicSubnet1
    Export:
      Name: !Sub ${AWS::StackName}-PublicSubnet1Id
  PrivateSubnet1Id:
    Value: !Ref PrivateSubnet1
    Export:
      Name: !Sub ${AWS::StackName}-PrivateSubnet1Id

배포

aws cloudformation create-stack \
  --stack-name lab05 \
  --template-body file://lab05-network.yaml \
  --profile qa

# 진행 상태 확인
aws cloudformation describe-stack-events \
  --stack-name lab05 \
  --query 'StackEvents[0:5].[ResourceType,ResourceStatus]' \
  --output table \
  --profile qa

배운 것

!GetAtt, DependsOn, 리소스 간 참조 체인, Export로 스택 간 공유