AWS CloudFormation is an infrastructure-as-code service that lets you model, provision, and manage AWS resources by treating infrastructure as code. CloudFormation uses templates to describe the resources you need and their dependencies, so you can launch and configure them together as a stack.
With the CloudFormation integration, you can:
- Describe Stacks: List all stacks in a region or get detailed information about a specific stack, including its status, outputs, tags, and drift information
- List Stack Resources: Enumerate every resource in a stack with its logical ID, physical ID, type, status, and drift status
- Describe Stack Events: View the full event history for a stack to understand what happened during create, update, or delete operations
- Detect Stack Drift: Initiate drift detection to check whether any resources in a stack have been modified outside of CloudFormation
- Drift Detection Status: Poll the results of a drift detection operation to see which resources have drifted and how many
- Get Template: Retrieve the original template body (JSON or YAML) used to create or update a stack
- Validate Template: Check a CloudFormation template for syntax errors, required capabilities, parameters, and declared transforms before deploying
In Zoen, the CloudFormation integration enables your agents to monitor infrastructure state, detect configuration drift, audit stack resources, and validate templates as part of automated SRE and DevOps workflows. This is especially powerful when combined with CloudWatch for observability and SNS for alerting, creating end-to-end infrastructure monitoring pipelines.
Integrate AWS CloudFormation into workflows. Create, update, and delete stacks, preview changes with change sets, describe stacks, list resources, detect drift, view stack events, and retrieve or validate templates. Requires AWS access key and secret access key.
List and describe CloudFormation stacks
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | No | Stack name or ID to describe (omit to list all stacks) |
| Parameter | Type | Description |
|---|
stacks | array | List of CloudFormation stacks with status, outputs, and tags |
Create a new CloudFormation stack from a template
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | Yes | Name for the new stack (must be unique in the Region) |
templateBody | string | Yes | The CloudFormation template body (JSON or YAML) |
parameters | json | No | Template input parameters (e.g., [{"parameterKey": "InstanceType", "parameterValue": "t3.micro"}]) |
capabilities | string | No | Comma-separated capabilities to acknowledge (CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND) required when the template creates IAM resources or uses macros |
tags | json | No | Tags to apply to the stack and its resources (e.g., [{"key": "env", "value": "prod"}]) |
onFailure | string | No | Action to take on creation failure: ROLLBACK (default), DELETE, or DO_NOTHING |
timeoutInMinutes | number | No | Amount of time before the stack creation times out and rolls back |
| Parameter | Type | Description |
|---|
stackId | string | The unique ID of the created stack |
Update an existing CloudFormation stack with a new or previous template
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | Yes | Name or ID of the stack to update |
templateBody | string | No | The new CloudFormation template body (JSON or YAML). Required unless usePreviousTemplate is true |
usePreviousTemplate | boolean | No | Reuse the template currently associated with the stack instead of providing templateBody |
parameters | json | No | Template input parameters (e.g., [{"parameterKey": "InstanceType", "parameterValue": "t3.micro"}]) |
capabilities | string | No | Comma-separated capabilities to acknowledge (CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND) |
tags | json | No | Tags to apply to the stack and its resources (e.g., [{"key": "env", "value": "prod"}]) |
| Parameter | Type | Description |
|---|
stackId | string | The unique ID of the updated stack |
Delete a CloudFormation stack and its resources
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | Yes | Name or ID of the stack to delete |
retainResources | string | No | Comma-separated logical resource IDs to retain instead of deleting (only applies to stacks in DELETE_FAILED state) |
| Parameter | Type | Description |
|---|
message | string | Operation status message |
Cancel an in-progress stack update and roll back to the last known stable state
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | Yes | Name or ID of the stack whose update should be cancelled |
| Parameter | Type | Description |
|---|
message | string | Operation status message |
Preview the changes a stack create or update would make before applying them
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | Yes | Name of the stack to create or update (new name for CREATE type, existing name for UPDATE) |
changeSetName | string | Yes | Name for the new change set |
templateBody | string | No | The CloudFormation template body (JSON or YAML). Required unless usePreviousTemplate is true |
usePreviousTemplate | boolean | No | Reuse the template currently associated with the stack (UPDATE change sets only) |
parameters | json | No | Template input parameters (e.g., [{"parameterKey": "InstanceType", "parameterValue": "t3.micro"}]) |
capabilities | string | No | Comma-separated capabilities to acknowledge (CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND) |
changeSetType | string | No | CREATE (default, new stack), UPDATE (existing stack), or IMPORT (import existing resources) |
description | string | No | Description of the change set for reference |
| Parameter | Type | Description |
|---|
changeSetId | string | The unique ID of the created change set |
stackId | string | The unique ID of the target stack |
View the resource changes a change set would make and its execution status
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
changeSetName | string | Yes | Name or ARN of the change set to describe |
stackName | string | No | Name or ID of the stack the change set belongs to (required if changeSetName is not an ARN) |
| Parameter | Type | Description |
|---|
changeSetName | string | Name of the change set |
changeSetId | string | The unique ID of the change set |
stackId | string | The unique ID of the target stack |
stackName | string | Name of the target stack |
description | string | Description of the change set |
executionStatus | string | Whether the change set can be executed (AVAILABLE, UNAVAILABLE, EXECUTE_IN_PROGRESS, EXECUTE_COMPLETE, EXECUTE_FAILED, OBSOLETE) |
status | string | Current status of the change set (CREATE_PENDING, CREATE_IN_PROGRESS, CREATE_COMPLETE, DELETE_COMPLETE, FAILED) |
statusReason | string | Reason for the current status, particularly if failed |
creationTime | number | Timestamp the change set was created |
capabilities | array | Capabilities required to execute the change set |
changes | array | List of resource changes (action, logical/physical resource ID, resource type, replacement) |
Apply a previously created and reviewed change set to its stack
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
changeSetName | string | Yes | Name or ARN of the change set to execute |
stackName | string | No | Name or ID of the stack the change set belongs to (required if changeSetName is not an ARN) |
| Parameter | Type | Description |
|---|
message | string | Operation status message |
List all resources in a CloudFormation stack
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | Yes | Stack name or ID |
| Parameter | Type | Description |
|---|
resources | array | List of stack resources with type, status, and drift information |
Initiate drift detection on a CloudFormation stack
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | Yes | Stack name or ID to detect drift on |
| Parameter | Type | Description |
|---|
stackDriftDetectionId | string | ID to use with Describe Stack Drift Detection Status to check results |
Check the status of a stack drift detection operation
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackDriftDetectionId | string | Yes | The drift detection ID returned by Detect Stack Drift |
| Parameter | Type | Description |
|---|
stackId | string | The stack ID |
stackDriftDetectionId | string | The drift detection ID |
stackDriftStatus | string | Drift status (DRIFTED, IN_SYNC, NOT_CHECKED) |
detectionStatus | string | Detection status (DETECTION_IN_PROGRESS, DETECTION_COMPLETE, DETECTION_FAILED) |
detectionStatusReason | string | Reason if detection failed |
driftedStackResourceCount | number | Number of resources that have drifted |
timestamp | number | Timestamp of the detection |
Get the event history for a CloudFormation stack
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | Yes | Stack name or ID |
limit | number | No | Maximum number of events to return (default: 50) |
| Parameter | Type | Description |
|---|
events | array | List of stack events with resource status and timestamps |
Retrieve the template body for a CloudFormation stack
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
stackName | string | Yes | Stack name or ID |
templateStage | string | No | Which template version to retrieve: Processed (default, with transforms applied) or Original (as submitted) |
| Parameter | Type | Description |
|---|
templateBody | string | The template body as a JSON or YAML string |
stagesAvailable | array | Available template stages |
Get a summary of a template or deployed stack: resource types, required capabilities, and parameters, without full validation
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
templateBody | string | No | The CloudFormation template body (JSON or YAML). Required if stackName is not provided |
stackName | string | No | Name or ID of a deployed stack to summarize instead of a template body |
| Parameter | Type | Description |
|---|
description | string | Template description |
parameters | array | Template parameters with types, defaults, and descriptions |
capabilities | array | Required capabilities (e.g., CAPABILITY_IAM) |
capabilitiesReason | string | Reason capabilities are required |
resourceTypes | array | AWS resource types declared in the template (e.g., AWS::S3::Bucket) |
version | string | Template format version |
declaredTransforms | array | Transforms used in the template (e.g., AWS::Serverless-2016-10-31) |
Validate a CloudFormation template for syntax and structural correctness
| Parameter | Type | Required | Description |
|---|
awsRegion | string | Yes | AWS region (e.g., us-east-1) |
awsAccessKeyId | string | Yes | AWS access key ID |
awsSecretAccessKey | string | Yes | AWS secret access key |
templateBody | string | Yes | The CloudFormation template body (JSON or YAML) |
| Parameter | Type | Description |
|---|
description | string | Template description |
parameters | array | Template parameters with defaults and descriptions |
capabilities | array | Required capabilities (e.g., CAPABILITY_IAM) |
capabilitiesReason | string | Reason capabilities are required |
declaredTransforms | array | Transforms used in the template (e.g., AWS::Serverless-2016-10-31) |