Skip to main content

atmos aws cloudformation changeset execute

Execute a named changeset and stream events until the operation finishes. Create the changeset first with changeset create.

Experimental
CloudFormation Configuration

Configure templates, parameters, and delivery targets for your component.

atmos aws cloudformation changeset execute --help

Usage​

atmos aws cloudformation changeset execute <component> --stack <stack> --changeset-name <name> [options]

Examples​

atmos aws cloudformation changeset execute vpc -s plat-ue2-dev --changeset-name vpc-2026-08-25

Skip the interactive confirmation prompt:

atmos aws cloudformation changeset execute vpc -s plat-ue2-dev --changeset-name vpc-2026-08-25 --auto-approve

Arguments​

component (required unless selecting multiple components)
CloudFormation component name in the Atmos stack.

Flags​

--stack, -s (required for a single component)
Atmos stack. With bulk selection flags, limits the selected components to this stack.
--changeset-name (required)
Name of the changeset to execute.
--auto-approve (optional)
Skip the interactive confirmation prompt. Without it, changeset execute prompts for confirmation on a TTY before executing the changeset.
--all (optional)
Process all aws/cloudformation components. Deployment runs dependencies first; deletion runs consumers first.
--affected (optional)
Process affected aws/cloudformation components and their dependencies. Compares the working tree against a base: see --base and the Git flags below.
--include-dependents (optional)
With --affected, include dependent aws/cloudformation components.
--base (optional)
Git base ref or SHA to compare against for affected detection: --base=origin/main. A value that looks like a commit SHA is treated as --sha, anything else as --ref. Used with --affected.
--tags (optional)
Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.
--labels (optional)
Filter by labels (repeatable and/or comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.
--ci (optional)
Enable CI integration for supported operations when ci.enabled is configured. Summary and output-variable publishing use their respective CI settings. Also enabled by CI and ATMOS_CI.
--ref (optional)
Git ref to compare against for affected detection. Used with --affected.
--sha (optional)
Git SHA to compare against for affected detection. Used with --affected.
--repo-path (optional)
Path to an already cloned target repository to use as the affected baseline. Used with --affected.
--clone-target-ref (optional)
Clone the target ref instead of checking it out in the current repository for affected detection. Used with --affected.
--ssh-key (optional)
Path to the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
--ssh-key-password (optional)
Password for the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
--skip-hooks (optional)
Skip lifecycle hooks for this invocation. --skip-hooks with no value skips every hook; --skip-hooks=name1,name2 skips only the named hooks. Equivalent to the ATMOS_SKIP_HOOKS environment variable.

Behavior​

If the stack ends in a failed status after executing the changeset (e.g. UPDATE_ROLLBACK_COMPLETE), changeset execute exits non-zero.

This command fires the before.aws/cloudformation.changeset-execute and after.aws/cloudformation.changeset-execute lifecycle hooks. These events are separate from apply, so a hook listed only for before.aws/cloudformation.apply does not run here.

To run an existing hook around the execution, add the event to the hook's events list:

hooks:
  notify-deploy:
    events:
      - after.aws/cloudformation.apply
      - after.aws/cloudformation.changeset-execute

After a successful named CREATE or UPDATE, Atmos enables configured termination_protection, matching apply. Failure to enable it fails the command even if the deployment completed. Setting the field to false never disables existing protection; deletion requires the explicit --disable-termination-protection flag.