atmos aws cloudformation changeset execute

Execute a previously-created, named changeset (ExecuteChangeSet) and stream stack events until the operation reaches a terminal state — unlike apply, which creates (or reuses) and executes a changeset in one step, changeset execute acts on an existing changeset by name, created earlier with changeset create.

Experimental

atmos aws cloudformation changeset execute --help

Usage

atmos aws cloudformation changeset execute <component> --stack <stack> --changeset-name <name> [options]

atmos aws cloudformation changeset execute vpc -s plat-ue2-dev --changeset-name vpc-2026-08-25

Skip the interactive confirmation prompt:

atmos aws cloudformation changeset execute vpc -s plat-ue2-dev --changeset-name vpc-2026-08-25 --auto-approve

Flags

--stack, -s (required for a single component)

Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with --all/--affected.

--changeset-name (required)

Name of the changeset to execute.

--auto-approve (optional)

Skip the interactive confirmation prompt. Without it, changeset execute prompts for confirmation on a TTY before executing the changeset.

--all (optional)

Process all aws/cloudformation components in dependency order.

--affected (optional)

Process affected aws/cloudformation components and their dependencies. Compares the working tree against a base: see --base and the Git flags below.

--include-dependents (optional)

With --affected, include dependent aws/cloudformation components.

--base (optional)

Git base ref or SHA to compare against for affected detection: --base=origin/main. A value that looks like a commit SHA is treated as --sha, anything else as --ref. Used with --affected.

--tags (optional)

Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.

--labels (optional)

Filter by labels (repeatable and/or comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.

--ci (optional)

Enable native CI integration (requires ci.enabled): writes the job summary and output variables for the operation. Also enabled by the CI and ATMOS_CI environment variables.

--ref (optional)

Git ref to compare against for affected detection. Used with --affected.

--sha (optional)

Git SHA to compare against for affected detection. Used with --affected.

--repo-path (optional)

Path to an already cloned target repository to use as the affected baseline. Used with --affected.

--clone-target-ref (optional)

Clone the target ref instead of checking it out in the current repository for affected detection. Used with --affected.

--ssh-key (optional)

Path to the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.

--ssh-key-password (optional)

Password for the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.

Behavior

If the stack ends in a failed status after executing the changeset (e.g. UPDATE_ROLLBACK_COMPLETE), changeset execute exits non-zero.

note

changeset execute does not fire before/after hook events — only apply, diff, delete, drift detect, and drift describe do.

After a successful named CREATE or UPDATE, Atmos enables configured termination_protection, matching apply. Failure to enable it fails the command even if the deployment completed. Setting the field to false never disables existing protection; deletion requires the explicit --disable-termination-protection flag.