Build the same resource through the console, the CLI, an SDK and a CloudFormation template

Steps

1. A one-time check, done in the console because it is done once. In the AWS Management Console, read the Region shown at the top right. Open CloudShell from the toolbar and run echo $AWS_REGION: it prints the same Region's code. Every resource in this lab is made there.
2. Call AWS from the command line. CloudShell signs each request with your console sign-in, which is why you need no access key here; a CLI on your own computer would need one.

aws sts get-caller-identity --query Arn --output text
aws cloudformation list-stacks --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE --query 'length(StackSummaries)'

The second command counts the stacks that exist now. Note the number. 3. Describe the infrastructure as code. Write a template for one private S3 bucket; CloudFormation will give it a unique name, so you do not have to choose one:

cat > clf-lab12.yaml <<'EOF'
AWSTemplateFormatVersion: '2010-09-09'
Description: Lab 12 - one private bucket
Resources:
  LabBucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
EOF
aws cloudformation deploy --template-file clf-lab12.yaml --stack-name clf-lab12-stack

The deploy waits and ends with Successfully created/updated stack - clf-lab12-stack. 4. See the same stack through two other front ends. In the console, open CloudFormation, choose the stack clf-lab12-stack and its Resources tab: it lists LabBucket and the bucket's real name, which begins clf-lab12-stack-labbucket-. Then ask through the SDK, from Python code:

python3 -c 'import boto3; print(boto3.client("cloudformation").describe_stacks(StackName="clf-lab12-stack")["Stacks"][0]["StackStatus"])'

It prints CREATE_COMPLETE, the same answer the console shows, because both called the same CloudFormation API and IAM authorised both. 5. Change the template and preview the change before it happens. Rewrite the file with a second bucket, then ask for a change set without running it:

cat > clf-lab12.yaml <<'EOF'
AWSTemplateFormatVersion: '2010-09-09'
Description: Lab 12 - two private buckets
Resources:
  LabBucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
  NotesBucket:
    Type: AWS::S3::Bucket
    Properties:
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
EOF
aws cloudformation deploy --template-file clf-lab12.yaml --stack-name clf-lab12-stack --no-execute-changeset
CS=$(aws cloudformation list-change-sets --stack-name clf-lab12-stack --query 'Summaries[0].ChangeSetName' --output text)
aws cloudformation describe-change-set --stack-name clf-lab12-stack --change-set-name "$CS" --query 'Changes[].ResourceChange.[Action,LogicalResourceId]' --output text

The last command prints Add and NotesBucket: one resource will be added and LabBucket is untouched. Nothing has changed yet. This is the review step a console click does not have. 6. Apply the change set you just reviewed, and wait for it:

aws cloudformation execute-change-set --stack-name clf-lab12-stack --change-set-name "$CS"
aws cloudformation wait stack-update-complete --stack-name clf-lab12-stack

7. Make a check repeatable. Save two read-only CLI commands as a script and run it twice; it gives the same answer each time, which a sequence of console clicks cannot promise:

cat > clf-lab12-check.sh <<'EOF'
aws cloudformation describe-stacks --stack-name clf-lab12-stack --query 'Stacks[0].StackStatus' --output text
aws cloudformation describe-stack-resources --stack-name clf-lab12-stack --query 'StackResources[].LogicalResourceId' --output text
EOF
bash clf-lab12-check.sh
bash clf-lab12-check.sh

Both runs print UPDATE_COMPLETE and the two logical names. 8. Decide, in your own notes, which route fits each case: checking one setting once (console); stopping test instances every evening (a saved CLI script); an application that uploads files to S3 (an SDK); the same network in three accounts, reviewed before release (a CloudFormation template). Then name the deployment model for each: everything in AWS (cloud), everything in the company's own data centre (on-premises), or both connected together (hybrid).