# CloudFormation Configuration

Configure the directory containing CloudFormation components in `atmos.yaml`.
Define each component's template and deployment settings in its stack manifest.

> ⚠️ Experimental

## Configuration

**File:** `atmos.yaml`

```yaml
components:
  aws/cloudformation:
    # Base path to native aws/cloudformation component directories (where local
    # templates live). Defaults to components/cloudformation.
    base_path: components/cloudformation
    source:
      ttl: 1h
```

## Configuration Reference

- **`base_path`**

  Base directory for native `aws/cloudformation` components. A component's
  `path:` (and, when set, `stack_policy.file:`) resolve relative to its
  component directory under this base path. Defaults to
  components/cloudformation.
- **`source.ttl`**
  Default cache duration for remote CloudFormation sources, such as 
  `1h`
  ,

  `7d`
  , or 
  `0s`
   (refresh each invocation). Unset by default. A component's

  `source.ttl`
   overrides it. See

  [source caching](/stacks/components/aws-cloudformation#caching-and-refresh)
  .

Configure templates, parameters, sources, and delivery targets in
[stack manifests](/stacks/components/aws-cloudformation).

## Region Resolution

CloudFormation API calls need an AWS region. Atmos resolves it in this order,
most specific wins:

1. `settings.aws_cloudformation.region` on the component
2. The active identity's region
3. The AWS SDK's default credential/region chain (`AWS_REGION`, shared config)

```yaml
components:
  aws/cloudformation:
    vpc:
      settings:
        aws_cloudformation:
          region: us-west-2
      # ...
```

### Component Environment Variables

Set `settings.aws_cloudformation.region` to choose the component's region.
Entries for `AWS_REGION` or `AWS_DEFAULT_REGION` in the component's `env` block
do not select it. Atmos warns when those entries conflict with the resolved region.

### Account Selection

The account is the active identity's account. A [delivery target's auth block](/stacks/components/aws-cloudformation#target-authentication)
can select a different identity for that destination; an explicit CLI identity
still takes precedence.

See the [`atmos aws cloudformation`](/cli/commands/aws/cloudformation)
command reference and the
[CloudFormation stack configuration](/stacks/components/aws-cloudformation) for
component-level fields.