Skip to main content

atmos aws cloudformation stackset create

Create a CloudFormation StackSet (CreateStackSet) from the resolved kind: aws/stackset provision target's accounts/regions/ permission_model/role settings, plus the component's own template/parameters/capabilities/tags. When the target declares both accounts and regions, stackset create also creates the initial stack instances (CreateStackInstances) across that account/region matrix and waits for the operation to finish — the only verb that creates instances.

Experimental
atmos aws cloudformation stackset create --help

Usage​

atmos aws cloudformation stackset create <component> --stack <stack> [options]
atmos aws cloudformation stackset create vpc -s plat-ue2-dev

Skip the interactive confirmation prompt:

atmos aws cloudformation stackset create vpc -s plat-ue2-dev --auto-approve

Disambiguate when the component declares more than one kind: aws/stackset target:

atmos aws cloudformation stackset create vpc -s plat-ue2-dev --target multi-account

Create StackSets for all or affected components in dependency order:

atmos aws cloudformation stackset create --all -s plat-ue2-dev
atmos aws cloudformation stackset create --affected --base origin/main

Flags​

--stack, -s (required for a single component)
Atmos stack. With --all, --affected, --tags, or --labels, this is an optional stack filter; omit it to select components across stacks.
--target (optional)
The kind: aws/stackset provision target to use. Required when more than one is declared.
--auto-approve (optional)
Skip the interactive confirmation prompt. Without it, stackset create prompts for confirmation on a TTY before creating the StackSet.
--all (optional)
Process all aws/cloudformation components in dependency order.
--affected (optional)
Process affected aws/cloudformation components and their dependencies. Compares the working tree against a base: see --base and the Git flags below.
--include-dependents (optional)
With --affected, include dependent aws/cloudformation components.
--base (optional)
Git base ref or SHA to compare against for affected detection: --base=origin/main. A value that looks like a commit SHA is treated as --sha, anything else as --ref. Used with --affected.
--tags (optional)
Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.
--labels (optional)
Filter by labels (repeatable and/or comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.
--ci (optional)
Enable native CI integration (requires ci.enabled): writes the job summary and output variables for the operation. Also enabled by the CI and ATMOS_CI environment variables.
--ref (optional)
Git ref to compare against for affected detection. Used with --affected.
--sha (optional)
Git SHA to compare against for affected detection. Used with --affected.
--repo-path (optional)
Path to an already cloned target repository to use as the affected baseline. Used with --affected.
--clone-target-ref (optional)
Clone the target ref instead of checking it out in the current repository for affected detection. Used with --affected.
--ssh-key (optional)
Path to the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
--ssh-key-password (optional)
Password for the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.

Behavior​

If the resolved target declares only accounts or only regions (not both), stackset create stops after creating the StackSet itself — no instances are created. To add instances to the existing StackSet later, use AWS CloudFormation directly through CreateStackInstances. Atmos currently has no separate command to add instances.

Instance targeting currently supports SELF_MANAGED permissions only. A SERVICE_MANAGED target with both accounts and regions is rejected before any AWS resources are created. Service-managed targets without both fields can still create an empty StackSet; manage their instances with AWS CloudFormation.

The CreateStackInstances operation is polled every 3 seconds until it reaches a terminal status (SUCCEEDED/FAILED/STOPPED), and the command times out after 30 minutes if it hasn't.

note

stackset create does not fire before/after hook events — only apply, diff, delete, drift detect, and drift describe do.

Quote every account ID as a 12-digit string, for example accounts: ["012345678901"]. Numeric values, mixed-type lists and malformed region names are rejected before creating or updating a StackSet. Static dry-run performs the same checks for known target values.