Feature: IncludeNestedStacks switch for "sam deploy" command

[tomasz-bres]

Hello

With "AWS::Serverless::Application" the SAM project can be divided into multiple templates.
However with the sam deploy command, the created changeset doesn't show an impact on resources within nested stacks.

Example:

CloudFormation stack changeset
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Operation                                         LogicalResourceId                                 ResourceType                                      Replacement                                     
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
* Modify                                          IoT                                               AWS::CloudFormation::Stack                        False                                           
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

It would be nice to have "IncludeNestedStacks" same way as it's available for CreateChangeSet command for Cloudformation.

[vicheey]

Hi,
Do you mind providing some step to reproduce the issue and some example project as well?

[tomasz-bres]

Hi

No nested stack example:
template.yaml file

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
  fwInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: fwInstanceRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - !Ref fwInstancePolicy

  fwInstancePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: fwInstancePolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - ec2:ModifyInstanceAttribute
            Resource: '*'

  fwInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: fwInstanceProfile
      Path: /
      Roles:
        - !Ref fwInstanceRole

and sam deploy output

CloudFormation stack changeset
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Operation                                                                                    LogicalResourceId                                                                            ResourceType                                                                                 Replacement                                                                                
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+ Add                                                                                        fwInstanceProfile                                                                            AWS::IAM::InstanceProfile                                                                    N/A                                                                                        
+ Add                                                                                        fwInstanceRole                                                                               AWS::IAM::Role                                                                               N/A                                                                                        
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

---

Nested stack example

fw.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
  fwInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: fwInstanceRole
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - sts:AssumeRole
      Path: /
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
        - !Ref fwInstancePolicy

  fwInstancePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      ManagedPolicyName: fwInstancePolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - ec2:ModifyInstanceAttribute
            Resource: '*'

  fwInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      InstanceProfileName: fwInstanceProfile
      Path: /
      Roles:
        - !Ref fwInstanceRole

template.yaml file

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
  Firewall:
    Type: AWS::Serverless::Application
    Properties:
      Location: fw.yaml

sam deploy output

CloudFormation stack changeset
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Operation                                                                                    LogicalResourceId                                                                            ResourceType                                                                                 Replacement                                                                                
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
+ Add                                                                                        Firewall                                                                                     AWS::CloudFormation::Stack                                                                   N/A                                                                                        
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Steps to reproduce:

1. perform sam init with any available SAM template
2. replace 'template.yaml' content with 'template.yaml' from "No nested stack example" section
3. perform sam build && sam deploy command
4. check output
5. create 'fw.template' file in the same location as 'template.yaml' file with content from "Nested stack example" section
6. replace template.yaml content with template.yaml content from "Nested stack example" section
7. perform sam build && sam deploy command
8. check output

Expectations:
sam deploy should show all changes in nested stacks defined with AWS::Serverless::Application resource.

To check expected output you can follow this steps:

9. execute sam package command and copy template URL from output
10. execute aws cloudformation create-change-set --stack-name test --change-set-name test2 --change-set-type CREATE --template-url <template URL from step 9> --include-nested-stacks --capabilities CAPABILITY_NAMED_IAM
11. check changeset output in AWS console or with aws cloudformation describe-change-set --change-set-name <change-set-arn from step 10> --output table

Possible solution:
File: https://github.com/aws/serverless-application-model/blob/develop/integration/helpers/deployer/deployer.py
Line: 136
There is a kwargs definition for changeset.
I think "IncludeNestedStacks" : True can be added to kwargs

BR
Tomasz Bres