Skip to main content

atmos aws cloudformation apply

Create or update a CloudFormation stack. Atmos shows the proposed changes, asks for confirmation, and streams deployment events. A successful deployment ends with the stack outputs.

Experimental
CloudFormation Configuration

Configure templates, parameters, and delivery targets for your component.

atmos aws cloudformation apply --help

Usage​

atmos aws cloudformation apply <component> --stack <stack> [options]

Examples​

atmos aws cloudformation apply vpc -s plat-ue2-dev

Skip the interactive confirmation prompt:

atmos aws cloudformation apply vpc -s plat-ue2-dev --auto-approve

Apply all or affected components in dependency order:

atmos aws cloudformation apply --all -s plat-ue2-dev
atmos aws cloudformation apply --affected --base origin/main

Apply components selected by tags or labels:

atmos aws cloudformation apply --all --tags production,tier-1
atmos aws cloudformation apply --affected --labels cost-center=platform

Arguments​

component (required unless selecting multiple components)
CloudFormation component name in the Atmos stack.

Flags​

--stack, -s (required for a single component)
Atmos stack. With bulk selection flags, limits the selected components to this stack.
--target (optional)
Provision target to deliver to. Defaults to provision.default, otherwise the implicit direct-deploy target.
--auto-approve (optional)
Skip the interactive confirmation prompt. Without it, apply shows the predicted changes and then prompts for confirmation on a TTY before executing the changeset. Without a TTY, apply fails unless this flag is set.
--all (optional)
Process all aws/cloudformation components. Deployment runs dependencies first; deletion runs consumers first.
--affected (optional)
Process affected aws/cloudformation components and their dependencies. Compares the working tree against a base: see --base and the Git flags below.
--include-dependents (optional)
With --affected, include dependent aws/cloudformation components.
--base (optional)
Git base ref or SHA to compare against for affected detection: --base=origin/main. A value that looks like a commit SHA is treated as --sha, anything else as --ref. Used with --affected.
--tags (optional)
Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.
--labels (optional)
Filter by labels (repeatable and/or comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.
--ci (optional)
Enable CI integration for supported operations when ci.enabled is configured. Summary and output-variable publishing use their respective CI settings. Also enabled by CI and ATMOS_CI.
--ref (optional)
Git ref to compare against for affected detection. Used with --affected.
--sha (optional)
Git SHA to compare against for affected detection. Used with --affected.
--repo-path (optional)
Path to an already cloned target repository to use as the affected baseline. Used with --affected.
--clone-target-ref (optional)
Clone the target ref instead of checking it out in the current repository for affected detection. Used with --affected.
--ssh-key (optional)
Path to the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
--ssh-key-password (optional)
Password for the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
--skip-hooks (optional)
Skip lifecycle hooks for this invocation. --skip-hooks with no value skips every hook; --skip-hooks=name1,name2 skips only the named hooks. Equivalent to the ATMOS_SKIP_HOOKS environment variable.
note

atmos aws cloudformation deploy is an alias for apply that defaults --auto-approve to true. Both fire the before.aws/cloudformation.apply/after.aws/cloudformation.apply hook events.

How apply runs​

For direct deployment, Atmos:

  1. Creates a changeset and prints the proposed changes on stderr.
  2. Asks for confirmation, unless --auto-approve is set.
  3. Installs the configured stack policy before an update.
  4. Executes the changeset and streams stack events until completion.
  5. Applies post-deployment settings and displays stack outputs.

No Changes​

For an empty changeset, Atmos prints No changes and deletes the changeset. It still applies the stack policy and configured termination protection, then shows outputs. A new stack receives its policy after creation succeeds.

Confirmation and Cleanup​

In a non-interactive session, pass --auto-approve. Without it, the command fails before creating a changeset.

Declining confirmation deletes the changeset and returns a user-aborted error. If this invocation created an empty REVIEW_IN_PROGRESS stack, Atmos also removes it when abandoning the changeset, provided it is still in that state. Existing stacks are preserved.

Failed Stack Creation​

A stack in ROLLBACK_COMPLETE cannot be updated. Delete that failed stack with delete, then apply again. Atmos does not delete it automatically.

Other provision targets​

Publish-only targets do not prompt for a stack change:

  • An S3 target uploads the template and reports its S3 URI and HTTPS URL. The run summary records package_s3_uri and package_url.
  • A Git target reports the delivered file and destination.

Use the stackset commands for StackSet targets. See Delivery Targets.

Try it out​

Copy the example into a new directory and make it your own:

atmos init examples/cloudformation
cd cloudformation

Requires Docker or Podman, Python 3, and network access for the emulator image. Run against the local AWS emulator; the final commands clean up. No AWS account is needed.

atmos config set aliases.cft "aws cloudformation"
atmos emulator up aws -s local
atmos cft apply demo -s local --auto-approve
atmos cft delete demo -s local --auto-approve
atmos emulator down aws -s local
Explore the example →Initialization and repository settings