Skip to main content

atmos aws cloudformation apply

Create or update the CloudFormation stack for a component: create a changeset, show the predicted changes, ask for confirmation, and execute it. After a successful apply, Atmos renders the stack's Outputs — the same view output renders on demand.

Atmos applies the component's stack_policy (if set) after CREATE and no-op applies. An UPDATE that changes resources retains the existing stack policy.

Experimental
atmos aws cloudformation apply --help

Usage​

atmos aws cloudformation apply <component> --stack <stack> [options]
atmos aws cloudformation apply vpc -s plat-ue2-dev

Skip the interactive confirmation prompt:

atmos aws cloudformation apply vpc -s plat-ue2-dev --auto-approve

Apply all or affected components in dependency order:

atmos aws cloudformation apply --all -s plat-ue2-dev
atmos aws cloudformation apply --affected --base origin/main

Apply components filtered by tags or labels (composes with --all/--affected to narrow the selected set further):

atmos aws cloudformation apply --all --tags production,tier-1
atmos aws cloudformation apply --affected --labels cost-center=platform

How apply runs​

A direct stack deploy runs in this order, so you approve changes you have seen:

  1. Atmos creates the changeset.
  2. It prints the predicted changes (one line per added, modified, or replaced resource) on stderr.
  3. If the changeset would change nothing, Atmos deletes it, prints No changes, and still runs the follow-up steps (stack policy, termination protection, Outputs). Nothing is executed and no changeset is left behind.
  4. Otherwise it asks for confirmation, unless --auto-approve is set.
  5. If you decline, Atmos deletes the changeset and exits with a "user aborted" error; the stack is untouched.
  6. If you confirm, Atmos executes the changeset and streams the stack events until the stack reaches a final status.

Without --auto-approve and without a terminal on stdin (for example in CI), apply fails before creating anything, with a hint to pass --auto-approve. This is a "confirmation required" error, not a user abort.

For a stack that does not exist yet, CloudFormation registers an empty REVIEW_IN_PROGRESS stack as soon as the first changeset is created. When Atmos itself created that stack during this run and then abandons the changeset (declined prompt, a failed changeset, or a changeset that cannot be executed), it deletes the empty stack as well, after confirming it is still REVIEW_IN_PROGRESS. A stack that already existed is never deleted.

A stack in ROLLBACK_COMPLETE cannot be updated: its first create failed and CloudFormation only accepts a delete. apply fails before creating a changeset, explains this, and hints at the recovery: run atmos aws cloudformation delete for the component, then apply again. Atmos does not delete the stack for you.

Other provision targets​

apply asks no stack-change question when no stack changes:

  • A kind: aws/s3 target (selected with --target or provision.default) only uploads the template. On success Atmos prints the s3:// location and the https:// TemplateURL, and records both in the run summary (package_s3_uri, package_url).
  • An external target such as kind: git prints the file it delivered and the target it went to.
  • A kind: aws/stackset target is not an apply target. apply --target <name> fails with a hint to run atmos aws cloudformation stackset create <component> -s <stack> --target <name> (or stackset update).

Flags​

--stack, -s (required for a single component)
Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with --all/--affected.
--target (optional)
Provision target to deliver to. Defaults to provision.default, otherwise the implicit direct-deploy target.
--auto-approve (optional)
Skip the interactive confirmation prompt. Without it, apply shows the predicted changes and then prompts for confirmation on a TTY before executing the changeset. Without a TTY, apply fails unless this flag is set.
--all (optional)
Process all aws/cloudformation components in dependency order.
--affected (optional)
Process affected aws/cloudformation components and their dependencies. Compares the working tree against a base: see --base and the Git flags below.
--include-dependents (optional)
With --affected, include dependent aws/cloudformation components.
--base (optional)
Git base ref or SHA to compare against for affected detection: --base=origin/main. A value that looks like a commit SHA is treated as --sha, anything else as --ref. Used with --affected.
--tags (optional)
Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.
--labels (optional)
Filter by labels (repeatable and/or comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.
--ci (optional)
Enable native CI integration (requires ci.enabled): writes the job summary and output variables for the operation. Also enabled by the CI and ATMOS_CI environment variables.
--ref (optional)
Git ref to compare against for affected detection. Used with --affected.
--sha (optional)
Git SHA to compare against for affected detection. Used with --affected.
--repo-path (optional)
Path to an already cloned target repository to use as the affected baseline. Used with --affected.
--clone-target-ref (optional)
Clone the target ref instead of checking it out in the current repository for affected detection. Used with --affected.
--ssh-key (optional)
Path to the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
--ssh-key-password (optional)
Password for the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
--skip-hooks (optional)
Skip lifecycle hooks for this invocation. --skip-hooks with no value skips every hook; --skip-hooks=name1,name2 skips only the named hooks. Equivalent to the ATMOS_SKIP_HOOKS environment variable.
note

atmos aws cloudformation deploy is an alias for apply that defaults --auto-approve to true. Both fire the before.aws/cloudformation.apply/after.aws/cloudformation.apply hook events.