How to refer to elements inside the manifest.yml

[fade2black]

I am creating an addon (inside the environments folder) which has the following piece of script creating a security group:

  SGPostgresDb:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: sg-pgdb
      GroupDescription: Allows only postgres traffic
      VpcId: !Ref ?????????
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 0.0.0.0/0

But I need to somehow refer to the VPC ID. How could I go about it?
In general, how can I refer to the elements specified inside the manifest.yml? For example, besides the VPC, the copilot creates internet gateway, subnets, route table...., so when we create other resources we might need to refer to VPC or a subnet created by the copilot by copilot env deploy command.

[huanjani]

Hi, @fade2black!
I saw your post on SO first, so I replied there: https://stackoverflow.com/questions/75772269/how-can-i-refer-specify-vpc-from-aws-copilot-addon-file
Let us know if you have any more questions!

[huanjani]

Maybe this page will help: https://aws.github.io/copilot-cli/docs/manifest/overview/.
Copilot takes on the work of writing CloudFormation templates for you by converting the manifest files into CloudFormation templates. So the manifest file itself is not CloudFormation, but you can change your Copilot-generated CloudFormation template by changing your Copilot manifest. To see the results of the transformation, look at the template of your stack in the CloudFormation console.

Luckily, if you're writing env addons, it means you are comfortable enough with CloudFormation and can leverage those Outputs from the existing CloudFormation templates! In the CloudFormation console, you can check out the all the outputs, parameters, etc.

[fade2black]

Unfortunately this https://aws.github.io/copilot-cli/docs/manifest/overview/ has nothing to do with my question.
First of all, are you sure you understand my question?

Let me explain it in other words:

1. We create a copilot project.
2. We have a manifest.yml file which we don't touch.

name: staging
type: Environment
observability:
  container_insights: false

3. We create an addon from where I create a Security group. But I need he VPC id created by the the copilot.
   addons/temaplte.yml

SGPostgresDb:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: sg-pgdb
      GroupDescription: Allows only postgres traffic
      VpcId: ?????????
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 0.0.0.0/0

What should I replace ????????? with?

[huanjani]

Fn::ImportValue: !Sub ${AWS::StackName}-VpcId
or
Fn::ImportValue: !Sub ${App}-${Env}-VpcId

[fade2black]

Great! Thank you! !Sub ${App}-${Env}-VpcId seems to work.
So, VpcId is exported, isn't? Didn't know. It is in the list (Output section) which you post on my SO question.
Is this list what Copilot exports upon creating an environment/service? Any chance to put them in the AWS Copilot docs? For example:

Upon creating an environment the following parameters are exported:

• ${AWS::StackName}-VpcId - The Id of a VPC created by the copilot
• PublicSubnets
• PrivateSubnets
• ...
  Later they can be referred from an addon as following:

  VpcId:
    Fn::ImportValue: !Sub ${App}-${Env}-VpcId

This would be much more helpful than asking questions and waiting for an answer for 5 days.
But I'm still not able to access individual subnet ids, only list of subnets as you described in the SO. Its is a bit impractical. For example, specific PublicSubnet1 and PublicSubnets2 would be more helpful instead of PublicSubnets. Right? 🙂
Update: resolved.

[fade2black]

This also brings in another problem I guess: dependency. I played around with it for a while, it fails to create a SGPostgresDb.

I noticed, that if I first create the env without the addon, and later deploy the env together with my addon, it works perfect.
However, if I run copilot env deploy from scratch together with addon it fails with an error message: No export named myapp-staging-VpcId found. Rollback requested by user.
I guess it is because the addon (child) stack is created first or in parallel while VpcId is not ready yet, and so it fails to find it. Typically we address dependancy like the following:

AWSTemplateFormatVersion: 2010-09-09
Resources:
 ChildStack01:
   Type: 'AWS::CloudFormation::Stack'
   Properties:
     TemplateURL: 'https://s3.amazonaws.com/cloudformation-templates-us-east-1/VPC.template'
     TimeoutInMinutes: '60'
 ChildStack02:
   Type: 'AWS::CloudFormation::Stack'
   DependsOn: ChildStack01
   Properties:
     TemplateURL: 'https://s3.amazonaws.com/cloudformation-templates-us-east-1/Subnet.template'
     TimeoutInMinutes: '60'

However, how do we provide dependency logic in the Copilot? Basically, the addons resources depend on VPC, Rts, subnets,..etc.

UPDATE: Never mind. Resolved.