So let's learn how we can prevent updates to stack resources, and that will be using stack policies.
So let's look at this tech policy, Yamal.
This is a confirmation template and we have three parameters.
We have the VP side.
We have the for S.H. decider for HP.
And so that's three parameters in here.
Then we have resources.
We have two security groups that we create.
The first one is called SSL Security Group, and the second one is called Critical Security Group.
So the first one is four point twenty two and the second one is four point eighty.
And so in here, I want to create these templates so that we can update this as a such security group,
but we cannot update this critical security group.
And for this, we'll use a stack policy.
So as tech policy is looks like an IBM policy, it's adjacent file and we have statements in it and
we can say, well, we can allow for updates.
So we say allow updates on anything.
So any resource, any principle.
But we can deny the updates on the resource, logical name, critical security group.
So this is saying that we will deny any updates done through this critical security group.
And likewise, you have another statement here that will be unused.
But we could say that we deny updates to anything that has the condition of the resource type being
a database instance.
So if we had a database instance in this template of type artist database instance, then we could not
update it because we have this Dinni in this tech policy.
So let's have a look in practice about how that works.
Will create a stack and upload a template file.
And I'll choose policies that Yamal click on next and I'll call it the demo stack.
Policy will keep all the Panetoz as default and enter the website and click on next.
Next, I have this tech policy in advanced options and I could enter a tax policy by pasting the Jason
that was going to upload the file because it's going to be a little bit quicker.
OK, and I have now uploaded my stack policy.
I'll click on next and then I will see that in here there is a tech policy representing a tech policy
URL that is right here.
So perfect.
Let's click on Create Stack.
So our stack is in progress and we will create two such security groups.
OK, so now my security group have been created, and if I go to my stock info, I can see that everything
is correct, OK, if I scroll down in my stock info, we can see that there is a tech policy that has
been created and this is a tech policy that was defined from before.
So now let's try to update our stock.
So we'll update our stock.
We'll use the current templates.
Click on Next and I will try to update the Seiter S.H. So one nine two one six eight zero one 32.
OK Wynans I'll click on next.
And then in Stackpole this year we can see that we still have our Jason policy in here.
So Perfect's click on next and then we can see this tech policy is still here.
Excellent.
And then click on Update Stack.
So here this worked and the update is in progress and so we have to wait.
But the search security group is going to be updated.
And so the reason it was updated is that because this tech policy did allow for this.
But now let's update this tech again.
And this time I'm going to update the Seiter ADP Bluck.
So I'm going to copy the exact same thing in the Seiter HTP.
Click on next and then click on next scroll all the way down and click on Update Stack.
So here we go.
Update is in progress for our Demos tech policy.
But if I refresh now, it says that the update has failed and the reason for the failure is that the
action is denied by this tech policy.
So this statement did start for this logical resource, does not accept this security group to be updated.
And so this is where we get updates, rollback in progress, and then we'll back to a normal states.
So here the stack policy at the very bottom was protecting and said any updates against this logical
resource?
I need to be critical.
Secuity group should be denied.
And like any of us, for everything else, Denyer has precedence over allow.
So you can say, OK, how can I even update my security group then?
Well, the way you can do it is by doing the exact same thing.
So we'll update the site or ADP.
But in your STAC policy in here, you should enter a new stack policy and that's going to be temporary.
It's going to be reverted afterwards.
But if you delete this Dinni statements in here and go back, click on next and then click on updates,
we've made the conscious choice to change this tech policy for this update and to update our SSA, our
critical security group.
And as you can see, our critical security group is being updated.
Now, the update is complete.
Let's go back to our tech info and we'll scroll down.
And we can see here in this tech policy that, yes, this technology has not changed.
It's still the same as before.
So when we update this tech policy during the updates, it is just to revert.
It's just for that one.
Specific updates, OK?
And so that's the power of policy.
And we can do a lot of things with them.
But the idea is to protect cloud formation resources from being updated intentionally or by mistake.
Sorry.
And so as such, we can have Dinni statements.
But if we really, really, really wanted to update some resources, we could modify this type policy
at update time to perform the required updates.
So do you recommend you check out that link, prevent updates to stack resources and it shows you a
lot of examples around the kind of policies you can define as just for your own knowledge.
But from the perspective, you need to know at a high level what stack policies are and how they're
use and what how they work.
All right.
So that's it.
I will see you in the next lecture.