# atmos aws cloudformation apply

Create or update the CloudFormation stack for a component: create a changeset,
show the predicted changes, ask for confirmation, and execute it. After a
successful apply, Atmos renders the stack's Outputs — the same view
[`output`](/cli/commands/aws/cloudformation/output) renders on demand.

Atmos applies the component's `stack_policy` (if set) after CREATE and no-op
applies. An UPDATE that changes resources retains the existing stack policy.

> ⚠️ Experimental

## Usage

```shell
atmos aws cloudformation apply <component> --stack <stack> [options]
```

```shell
atmos aws cloudformation apply vpc -s plat-ue2-dev
```

Skip the interactive confirmation prompt:

```shell
atmos aws cloudformation apply vpc -s plat-ue2-dev --auto-approve
```

Apply all or affected components in dependency order:

```shell
atmos aws cloudformation apply --all -s plat-ue2-dev
atmos aws cloudformation apply --affected --base origin/main
```

Apply components filtered by tags or labels (composes with `--all`/`--affected` to narrow the selected set further):

```shell
atmos aws cloudformation apply --all --tags production,tier-1
atmos aws cloudformation apply --affected --labels cost-center=platform
```

## How apply runs

A direct stack deploy runs in this order, so you approve changes you have seen:

1. Atmos creates the changeset.
2. It prints the predicted changes (one line per added, modified, or replaced resource) on stderr.
3. If the changeset would change nothing, Atmos deletes it, prints `No changes`, and still runs the follow-up steps (stack policy, termination protection, Outputs). Nothing is executed and no changeset is left behind.
4. Otherwise it asks for confirmation, unless `--auto-approve` is set.
5. If you decline, Atmos deletes the changeset and exits with a "user aborted" error; the stack is untouched.
6. If you confirm, Atmos executes the changeset and streams the stack events until the stack reaches a final status.

Without `--auto-approve` and without a terminal on stdin (for example in CI), `apply` fails before creating anything, with a hint to pass `--auto-approve`. This is a "confirmation required" error, not a user abort.

For a stack that does not exist yet, CloudFormation registers an empty `REVIEW_IN_PROGRESS` stack as soon as the first changeset is created. When Atmos itself created that stack during this run and then abandons the changeset (declined prompt, a failed changeset, or a changeset that cannot be executed), it deletes the empty stack as well, after confirming it is still `REVIEW_IN_PROGRESS`. A stack that already existed is never deleted.

A stack in `ROLLBACK_COMPLETE` cannot be updated: its first create failed and CloudFormation only accepts a delete. `apply` fails before creating a changeset, explains this, and hints at the recovery: run [`atmos aws cloudformation delete`](/cli/commands/aws/cloudformation/delete) for the component, then apply again. Atmos does not delete the stack for you.

### Other provision targets

`apply` asks no stack-change question when no stack changes:

- A `kind: aws/s3` target (selected with `--target` or `provision.default`) only uploads the template. On success Atmos prints the `s3://` location and the `https://` TemplateURL, and records both in the run summary (`package_s3_uri`, `package_url`).
- An external target such as `kind: git` prints the file it delivered and the target it went to.
- A `kind: aws/stackset` target is not an apply target. `apply --target <name>` fails with a hint to run `atmos aws cloudformation stackset create <component> -s <stack> --target <name>` (or `stackset update`).

## Flags

- **`--stack`, `-s` (required for a single component)**
  Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with 
  `--all`
  /
  `--affected`
  .
- **`--target` (optional)**
  Provision target to deliver to. Defaults to 
  `provision.default`
  , otherwise the implicit direct-deploy target.
- **`--auto-approve` (optional)**
  Skip the interactive confirmation prompt. Without it, 
  `apply`
   shows the predicted changes and then prompts for confirmation on a TTY before executing the changeset. Without a TTY, 
  `apply`
   fails unless this flag is set.

:::note
[`atmos aws cloudformation deploy`](/cli/commands/aws/cloudformation/deploy) is an alias for `apply`
that defaults `--auto-approve` to `true`. Both fire the
`before.aws/cloudformation.apply`/`after.aws/cloudformation.apply` hook events.
:::