Instructor: So let's quickly talk
about CloudFormation Rollbacks.
It's very important to know they work
in case they appear on the exam.
If the stack creation fail safe,
you put a stack and the stack creation fails
by default everything will rollback,
that means it will get deleted.
And so we can look at the log to understand what happened.
When you create the stack you also have the option
to disable the rollback
in order to troubleshoot what happened
and get a little bit more insight into what was created.
If you update a stack, it was already created and successful
and now you update it,
if the update fails the stack will automatically rollback
to the previous known working state
which is the green state you just wanted to update.
And you get the ability in the log
to see what happened thanks to error messages.
This lecture is all about showing you how rollback works.
Okay, in this example we are going
to show how rollbacks work,
but first lets go ahead and create the stack
and we'll use a template that will upload
and we'll first use the "0-just-EC2" template
to get started with the basis that we know works.
And I'll call the stack "FailureDemo",
I will click on next
and then next
and finally I will create my stack.
This will create an EC2 instance
and then I will wait for the stack to be completed
in the create state.
My stack has now been created
and I'm going to update it
and I'm going to replace the current template,
upload a new template
and this time I will choose the "trigger-failure.yaml".
This file should trigger a failure
and I will show you why in a second.
I will just say "hello world",
as my security group description,
click on next
and then click on next,
and finally click on update stack.
First we just see the change set
and as we'll see in a second the change set
is exactly the same as before.
We have an ElasticIP, security groups
and the EC2 Instance should be replaced
but I've included something in my template
that will trigger a failure.
We are in updating progress
but lets go see in the template what the problem is.
If I go to "2-trigger-failure.yaml"
and I scroll down here
in my image ID I say the AMI is 123456
and this AMI in this region us-east-1 does not exist
and therefore it will throw a CloudFormation error.
What I wanna show you is what happens in CloudFormation
when this error happens.
If you refresh this
and we go and have a look at the update,
the update is in progress
so the SSH security groups were created,
these were new SSH security groups then CloudFormation tried
to update MyInstance but then it failed
and it gave me a reason
that the AMI ID 00123456 does not exist
because it was not found and that makes sense.
Therefore there was an update rollback in progress
and my EC2 instance has been rolled back.
Now if I refresh this again,
we are in the more state so lets go ahead
and see what happens.
We are in the updates, rollback in progress,
and then anything that was created before,
so the SSH security groups that were created
during this update are also being rolled back.
As we can see the SSH security group
and the server security group are being "delete in progress"
then they're in "delete complete"
and then the stack is in "update rollback complete".
In this instance when there is a rollback happening
anything created during the update,
if there is any error anywhere else
we'll just rollback everything else to where it was
from before, so it's good to know.
Now lets try to create the stack
and this time I will create the stack with new resources
and I will use an upload template
and it will right away create this two trigger failure.
I will just say "FailureDemo2"
and here I will just say "hello".
I will click on next
and so this will trigger a failure right away.
And I can see that a stack creation option,
I will see that there is a rollback on failure option
and right now it is enabled.
That means that if there is a creation failure
the entire stack should be rolled back
but if we wanna troubleshoot it
we should set it as disable and then the stack will be stuck
and we can troubleshoot based on the resources
that have been already created.
If we leave it disabled nothing will be rolled back,
but if we leave it all enabled
everything will be rolled back.
We'll just create this one, we'll just say "enabled",
click on next
and then click on create stack.
And this goes ahead and creates my "FailureDemo2"
which should right away give me an error.
I should wait a little bit,
my security groups are being created,
the create is in progress.
But very soon I get MyInstance, create failed,
and it says this AMI ID does not exist
and therefore my security groups are going to be rolled back
so let's have a look.
My instance is being deleted
and then right after my security groups
are also being deleted.
Now my stack is in rollback complete state
and if I look at the reosurces there is nothing,
everything has been deleted
and so I cannot troubleshoot.
If I wanted to troubleshoot I would have
to change the setting that we just changed before
and say rollback on failure disabled.
Now the cool thing we can see is that we have two stacks,
one is in update rollback complete
and one is in rollback complete.
The one stack that has been created in that state
we cannot update it,
the only thing we can do is delete it.
So we'll just go ahead and delete it.
Whereas the one that is in update rollback complete
is still working so I could go again
and update it if we have a fixed CloudFormation template
or I can go again and delete it
and this is what I will be doing.
That's it for this lecture,
I hope you liked it and I will see you in the next lecture.