# atmos aws cloudformation changeset execute

Execute a previously-created, named changeset (`ExecuteChangeSet`) and stream
stack events until the operation reaches a terminal state — unlike
[`apply`](/cli/commands/aws/cloudformation/apply), which creates (or reuses)
and executes a changeset in one step, `changeset execute` acts on an
existing changeset by name, created earlier with
[`changeset create`](/cli/commands/aws/cloudformation/changeset/create).

> ⚠️ Experimental

## Usage

```shell
atmos aws cloudformation changeset execute <component> --stack <stack> --changeset-name <name> [options]
```

```shell
atmos aws cloudformation changeset execute vpc -s plat-ue2-dev --changeset-name vpc-2026-08-25
```

Skip the interactive confirmation prompt:

```shell
atmos aws cloudformation changeset execute vpc -s plat-ue2-dev --changeset-name vpc-2026-08-25 --auto-approve
```

## Flags

- **`--stack`, `-s` (required for a single component)**
  Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with 
  `--all`
  /
  `--affected`
  .
- **`--changeset-name` (required)**
  Name of the changeset to execute.
- **`--auto-approve` (optional)**
  Skip the interactive confirmation prompt. Without it, 
  `changeset execute`
   prompts for confirmation on a TTY before executing the changeset.

## Behavior

If the stack ends in a failed status after executing the changeset (e.g.
`UPDATE_ROLLBACK_COMPLETE`), `changeset execute` exits non-zero.

:::note
`changeset execute` does not fire `before`/`after` hook events — only
[`apply`](/cli/commands/aws/cloudformation/apply),
[`diff`](/cli/commands/aws/cloudformation/diff),
[`delete`](/cli/commands/aws/cloudformation/delete),
[`drift detect`](/cli/commands/aws/cloudformation/drift/detect), and
[`drift describe`](/cli/commands/aws/cloudformation/drift/describe) do.
:::

After a successful named CREATE or UPDATE, Atmos enables configured `termination_protection`,
matching apply. Failure to enable it fails the command even if the deployment completed.
Setting the field to false never disables existing protection; deletion requires the explicit
`--disable-termination-protection` flag.