DevOps-Security-Agent-Skills/infrastructure/cloud-aws/cloudformation/references/cfn-syntax.md

CloudFormation Syntax Reference

Template Structure

AWSTemplateFormatVersion: '2010-09-09'
Description: My CloudFormation Template

Parameters:
  Environment:
    Type: String
    AllowedValues: [dev, staging, prod]

Mappings:
  RegionMap:
    us-east-1:
      AMI: ami-12345678

Conditions:
  IsProd: !Equals [!Ref Environment, prod]

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${AWS::StackName}-bucket'

Outputs:
  BucketName:
    Value: !Ref MyBucket
    Export:
      Name: !Sub '${AWS::StackName}-bucket'

Intrinsic Functions

# Reference
!Ref MyResource

# GetAtt
!GetAtt MyResource.Arn

# Sub (string substitution)
!Sub '${AWS::StackName}-resource'
!Sub 
  - 'arn:aws:s3:::${Bucket}/*'
  - Bucket: !Ref MyBucket

# Join
!Join ['-', [!Ref Environment, app]]

# Select
!Select [0, !GetAZs '']

# Split
!Split [',', 'a,b,c']

# If
!If [IsProd, 3, 1]

# ImportValue
!ImportValue ExportedValue

Common Patterns

Cross-Stack References

# Stack A - Export
Outputs:
  VpcId:
    Value: !Ref VPC
    Export:
      Name: SharedVPC

# Stack B - Import
Resources:
  Subnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !ImportValue SharedVPC

Nested Stacks

Resources:
  VPCStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/bucket/vpc.yaml
      Parameters:
        Environment: !Ref Environment

DependsOn

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    DependsOn: MySecurityGroup

CLI Commands

# Create stack
aws cloudformation create-stack \
  --stack-name mystack \
  --template-body file://template.yaml \
  --parameters ParameterKey=Environment,ParameterValue=prod

# Update stack
aws cloudformation update-stack \
  --stack-name mystack \
  --template-body file://template.yaml

# Delete stack
aws cloudformation delete-stack --stack-name mystack

# Validate template
aws cloudformation validate-template --template-body file://template.yaml