stack_sets

Creates, updates, deletes or gets a stack_set resource or lists stack_sets in a region

Overview

Name	stack_sets
Type	Resource
Description	StackSet as a resource provides one-click experience for provisioning a StackSet and StackInstances
Id	awscc.cloudformation.stack_sets

Fields

get (all properties)

Name	Datatype	Description
stack_set_name	string	The name to associate with the stack set. The name must be unique in the Region where you create your stack set.
stack_set_id	string	The ID of the stack set that you're creating.
administration_role_arn	string	The Amazon Resource Number (ARN) of the IAM role to use to create this stack set. Specify an IAM role only if you are using customized administrator roles to control which users or groups can manage specific stack sets within the same administrator account.
▶auto_deployment	object	Describes whether StackSets automatically deploys to AWS Organizations accounts that are added to the target organization or organizational unit (OU). Specify only if PermissionModel is SERVICE_MANAGED.
capabilities	array	In some cases, you must explicitly acknowledge that your stack set template contains certain capabilities in order for AWS CloudFormation to create the stack set and related stack instances.
description	string	A description of the stack set. You can use the description to identify the stack set's purpose or other important information.
execution_role_name	string	The name of the IAM execution role to use to create the stack set. If you do not specify an execution role, AWS CloudFormation uses the AWSCloudFormationStackSetExecutionRole role for the stack set operation.
▶operation_preferences	object	The user-specified preferences for how AWS CloudFormation performs a stack set operation.
▶stack_instances_group	array	A group of stack instances with parameters in some specific accounts and regions.
▶parameters	array	The input parameters for the stack set template.
permission_model	string	Describes how the IAM roles required for stack set operations are created. By default, SELF-MANAGED is specified.
▶tags	array	The key-value pairs to associate with this stack set and the stacks created from it. AWS CloudFormation also propagates these tags to supported resources that are created in the stacks. A maximum number of 50 tags can be specified.
template_body	string	The structure that contains the template body, with a minimum length of 1 byte and a maximum length of 51,200 bytes.
template_url	string	Location of file containing the template body. The URL must point to a template (max size: 460,800 bytes) that is located in an Amazon S3 bucket.
call_as	string	Specifies the AWS account that you are acting from. By default, SELF is specified. For self-managed permissions, specify SELF; for service-managed permissions, if you are signed in to the organization's management account, specify SELF. If you are signed in to a delegated administrator account, specify DELEGATED_ADMIN.
▶managed_execution	object	Describes whether StackSets performs non-conflicting operations concurrently and queues conflicting operations.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
stack_set_id	string	The ID of the stack set that you're creating.
region	string	AWS region.

For more information, see AWS::CloudFormation::StackSet.

Methods

Name	Resource	Accessible by	Required Params
create_resource	stack_sets	INSERT	StackSetName, PermissionModel, region
delete_resource	stack_sets	DELETE	Identifier, region
update_resource	stack_sets	UPDATE	Identifier, PatchDocument, region
list_resources	stack_sets_list_only	SELECT	region
get_resource	stack_sets	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual stack_set.

SELECT
  region,
  stack_set_name,
  stack_set_id,
  administration_role_arn,
  auto_deployment,
  capabilities,
  description,
  execution_role_name,
  operation_preferences,
  stack_instances_group,
  parameters,
  permission_model,
  tags,
  template_body,
  template_url,
  call_as,
  managed_execution
FROM awscc.cloudformation.stack_sets
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ stack_set_id }}';

list (identifiers only)

Lists all stack_sets in a region.

SELECT
  region,
  stack_set_id
FROM awscc.cloudformation.stack_sets_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new stack_set resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.cloudformation.stack_sets (
  StackSetName,
  PermissionModel,
  region
)
SELECT
  '{{ stack_set_name }}',
  '{{ permission_model }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.cloudformation.stack_sets (
  StackSetName,
  AdministrationRoleARN,
  AutoDeployment,
  Capabilities,
  Description,
  ExecutionRoleName,
  OperationPreferences,
  StackInstancesGroup,
  Parameters,
  PermissionModel,
  Tags,
  TemplateBody,
  TemplateURL,
  CallAs,
  ManagedExecution,
  region
)
SELECT
  '{{ stack_set_name }}',
  '{{ administration_role_arn }}',
  '{{ auto_deployment }}',
  '{{ capabilities }}',
  '{{ description }}',
  '{{ execution_role_name }}',
  '{{ operation_preferences }}',
  '{{ stack_instances_group }}',
  '{{ parameters }}',
  '{{ permission_model }}',
  '{{ tags }}',
  '{{ template_body }}',
  '{{ template_url }}',
  '{{ call_as }}',
  '{{ managed_execution }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: stack_set
    props:
      - name: stack_set_name
        value: '{{ stack_set_name }}'
      - name: administration_role_arn
        value: '{{ administration_role_arn }}'
      - name: auto_deployment
        value:
          enabled: '{{ enabled }}'
          retain_stacks_on_account_removal: '{{ retain_stacks_on_account_removal }}'
      - name: capabilities
        value:
          - '{{ capabilities[0] }}'
      - name: description
        value: '{{ description }}'
      - name: execution_role_name
        value: '{{ execution_role_name }}'
      - name: operation_preferences
        value:
          failure_tolerance_count: '{{ failure_tolerance_count }}'
          failure_tolerance_percentage: '{{ failure_tolerance_percentage }}'
          max_concurrent_count: '{{ max_concurrent_count }}'
          max_concurrent_percentage: '{{ max_concurrent_percentage }}'
          region_order:
            - '{{ region_order[0] }}'
          region_concurrency_type: '{{ region_concurrency_type }}'
          concurrency_mode: '{{ concurrency_mode }}'
      - name: stack_instances_group
        value:
          - deployment_targets:
              accounts:
                - '{{ accounts[0] }}'
              accounts_url: '{{ accounts_url }}'
              organizational_unit_ids:
                - '{{ organizational_unit_ids[0] }}'
              account_filter_type: '{{ account_filter_type }}'
            regions:
              - null
            parameter_overrides:
              - parameter_key: '{{ parameter_key }}'
                parameter_value: '{{ parameter_value }}'
      - name: parameters
        value:
          - null
      - name: permission_model
        value: '{{ permission_model }}'
      - name: tags
        value:
          - key: '{{ key }}'
            value: '{{ value }}'
      - name: template_body
        value: '{{ template_body }}'
      - name: template_url
        value: '{{ template_url }}'
      - name: call_as
        value: '{{ call_as }}'
      - name: managed_execution
        value:
          active: '{{ active }}'

UPDATE example

Use the following StackQL query and manifest file to update a stack_set resource, using stack-deploy.

/*+ update */
UPDATE awscc.cloudformation.stack_sets
SET PatchDocument = string('{{ {
    "AdministrationRoleARN": administration_role_arn,
    "AutoDeployment": auto_deployment,
    "Capabilities": capabilities,
    "Description": description,
    "ExecutionRoleName": execution_role_name,
    "OperationPreferences": operation_preferences,
    "StackInstancesGroup": stack_instances_group,
    "Parameters": parameters,
    "Tags": tags,
    "TemplateBody": template_body,
    "TemplateURL": template_url,
    "CallAs": call_as,
    "ManagedExecution": managed_execution
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ stack_set_id }}';

DELETE example

/*+ delete */
DELETE FROM awscc.cloudformation.stack_sets
WHERE
  Identifier = '{{ stack_set_id }}' AND
  region = 'us-east-1';

Permissions

To operate on the stack_sets resource, the following permissions are required:

Create

cloudformation:GetTemplateSummary,
cloudformation:CreateStackSet,
cloudformation:CreateStackInstances,
cloudformation:DescribeStackSetOperation,
cloudformation:ListStackSetOperationResults,
cloudformation:TagResource,
iam:PassRole

Read

cloudformation:DescribeStackSet,
cloudformation:ListStackInstances,
cloudformation:DescribeStackInstance

Update

cloudformation:GetTemplateSummary,
cloudformation:UpdateStackSet,
cloudformation:CreateStackInstances,
cloudformation:DeleteStackInstances,
cloudformation:UpdateStackInstances,
cloudformation:DescribeStackSet,
cloudformation:DescribeStackSetOperation,
cloudformation:ListStackSetOperationResults,
cloudformation:TagResource,
cloudformation:UntagResource,
iam:PassRole

Delete

cloudformation:DeleteStackSet,
cloudformation:DeleteStackInstances,
cloudformation:DescribeStackSet,
cloudformation:DescribeStackSetOperation,
cloudformation:ListStackSetOperationResults,
cloudformation:UntagResource

List

cloudformation:ListStackSets,
cloudformation:DescribeStackSet,
cloudformation:ListStackInstances,
cloudformation:DescribeStackInstance