CloudFormation

AWS CloudFormation is an infrastructure-as-code service that lets you model, provision, and manage AWS resources by treating infrastructure as code. CloudFormation uses templates to describe the resources you need and their dependencies, so you can launch and configure them together as a stack.

With the CloudFormation integration, you can:

  • Describe Stacks: List all stacks in a region or get detailed information about a specific stack, including its status, outputs, tags, and drift information
  • List Stack Resources: Enumerate every resource in a stack with its logical ID, physical ID, type, status, and drift status
  • Describe Stack Events: View the full event history for a stack to understand what happened during create, update, or delete operations
  • Detect Stack Drift: Initiate drift detection to check whether any resources in a stack have been modified outside of CloudFormation
  • Drift Detection Status: Poll the results of a drift detection operation to see which resources have drifted and how many
  • Get Template: Retrieve the original template body (JSON or YAML) used to create or update a stack
  • Validate Template: Check a CloudFormation template for syntax errors, required capabilities, parameters, and declared transforms before deploying

In Zoen, the CloudFormation integration enables your agents to monitor infrastructure state, detect configuration drift, audit stack resources, and validate templates as part of automated SRE and DevOps workflows. This is especially powerful when combined with CloudWatch for observability and SNS for alerting, creating end-to-end infrastructure monitoring pipelines.

Usage Instructions

Integrate AWS CloudFormation into workflows. Create, update, and delete stacks, preview changes with change sets, describe stacks, list resources, detect drift, view stack events, and retrieve or validate templates. Requires AWS access key and secret access key.

Actions

cloudformation_describe_stacks

List and describe CloudFormation stacks

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringNoStack name or ID to describe (omit to list all stacks)

Output

ParameterTypeDescription
stacksarrayList of CloudFormation stacks with status, outputs, and tags

cloudformation_create_stack

Create a new CloudFormation stack from a template

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringYesName for the new stack (must be unique in the Region)
templateBodystringYesThe CloudFormation template body (JSON or YAML)
parametersjsonNoTemplate input parameters (e.g., [{"parameterKey": "InstanceType", "parameterValue": "t3.micro"}])
capabilitiesstringNoComma-separated capabilities to acknowledge (CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND) required when the template creates IAM resources or uses macros
tagsjsonNoTags to apply to the stack and its resources (e.g., [{"key": "env", "value": "prod"}])
onFailurestringNoAction to take on creation failure: ROLLBACK (default), DELETE, or DO_NOTHING
timeoutInMinutesnumberNoAmount of time before the stack creation times out and rolls back

Output

ParameterTypeDescription
stackIdstringThe unique ID of the created stack

cloudformation_update_stack

Update an existing CloudFormation stack with a new or previous template

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringYesName or ID of the stack to update
templateBodystringNoThe new CloudFormation template body (JSON or YAML). Required unless usePreviousTemplate is true
usePreviousTemplatebooleanNoReuse the template currently associated with the stack instead of providing templateBody
parametersjsonNoTemplate input parameters (e.g., [{"parameterKey": "InstanceType", "parameterValue": "t3.micro"}])
capabilitiesstringNoComma-separated capabilities to acknowledge (CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND)
tagsjsonNoTags to apply to the stack and its resources (e.g., [{"key": "env", "value": "prod"}])

Output

ParameterTypeDescription
stackIdstringThe unique ID of the updated stack

cloudformation_delete_stack

Delete a CloudFormation stack and its resources

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringYesName or ID of the stack to delete
retainResourcesstringNoComma-separated logical resource IDs to retain instead of deleting (only applies to stacks in DELETE_FAILED state)

Output

ParameterTypeDescription
messagestringOperation status message

cloudformation_cancel_update_stack

Cancel an in-progress stack update and roll back to the last known stable state

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringYesName or ID of the stack whose update should be cancelled

Output

ParameterTypeDescription
messagestringOperation status message

cloudformation_create_change_set

Preview the changes a stack create or update would make before applying them

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringYesName of the stack to create or update (new name for CREATE type, existing name for UPDATE)
changeSetNamestringYesName for the new change set
templateBodystringNoThe CloudFormation template body (JSON or YAML). Required unless usePreviousTemplate is true
usePreviousTemplatebooleanNoReuse the template currently associated with the stack (UPDATE change sets only)
parametersjsonNoTemplate input parameters (e.g., [{"parameterKey": "InstanceType", "parameterValue": "t3.micro"}])
capabilitiesstringNoComma-separated capabilities to acknowledge (CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND)
changeSetTypestringNoCREATE (default, new stack), UPDATE (existing stack), or IMPORT (import existing resources)
descriptionstringNoDescription of the change set for reference

Output

ParameterTypeDescription
changeSetIdstringThe unique ID of the created change set
stackIdstringThe unique ID of the target stack

cloudformation_describe_change_set

View the resource changes a change set would make and its execution status

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
changeSetNamestringYesName or ARN of the change set to describe
stackNamestringNoName or ID of the stack the change set belongs to (required if changeSetName is not an ARN)

Output

ParameterTypeDescription
changeSetNamestringName of the change set
changeSetIdstringThe unique ID of the change set
stackIdstringThe unique ID of the target stack
stackNamestringName of the target stack
descriptionstringDescription of the change set
executionStatusstringWhether the change set can be executed (AVAILABLE, UNAVAILABLE, EXECUTE_IN_PROGRESS, EXECUTE_COMPLETE, EXECUTE_FAILED, OBSOLETE)
statusstringCurrent status of the change set (CREATE_PENDING, CREATE_IN_PROGRESS, CREATE_COMPLETE, DELETE_COMPLETE, FAILED)
statusReasonstringReason for the current status, particularly if failed
creationTimenumberTimestamp the change set was created
capabilitiesarrayCapabilities required to execute the change set
changesarrayList of resource changes (action, logical/physical resource ID, resource type, replacement)

cloudformation_execute_change_set

Apply a previously created and reviewed change set to its stack

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
changeSetNamestringYesName or ARN of the change set to execute
stackNamestringNoName or ID of the stack the change set belongs to (required if changeSetName is not an ARN)

Output

ParameterTypeDescription
messagestringOperation status message

cloudformation_list_stack_resources

List all resources in a CloudFormation stack

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringYesStack name or ID

Output

ParameterTypeDescription
resourcesarrayList of stack resources with type, status, and drift information

cloudformation_detect_stack_drift

Initiate drift detection on a CloudFormation stack

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringYesStack name or ID to detect drift on

Output

ParameterTypeDescription
stackDriftDetectionIdstringID to use with Describe Stack Drift Detection Status to check results

cloudformation_describe_stack_drift_detection_status

Check the status of a stack drift detection operation

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackDriftDetectionIdstringYesThe drift detection ID returned by Detect Stack Drift

Output

ParameterTypeDescription
stackIdstringThe stack ID
stackDriftDetectionIdstringThe drift detection ID
stackDriftStatusstringDrift status (DRIFTED, IN_SYNC, NOT_CHECKED)
detectionStatusstringDetection status (DETECTION_IN_PROGRESS, DETECTION_COMPLETE, DETECTION_FAILED)
detectionStatusReasonstringReason if detection failed
driftedStackResourceCountnumberNumber of resources that have drifted
timestampnumberTimestamp of the detection

cloudformation_describe_stack_events

Get the event history for a CloudFormation stack

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringYesStack name or ID
limitnumberNoMaximum number of events to return (default: 50)

Output

ParameterTypeDescription
eventsarrayList of stack events with resource status and timestamps

cloudformation_get_template

Retrieve the template body for a CloudFormation stack

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
stackNamestringYesStack name or ID
templateStagestringNoWhich template version to retrieve: Processed (default, with transforms applied) or Original (as submitted)

Output

ParameterTypeDescription
templateBodystringThe template body as a JSON or YAML string
stagesAvailablearrayAvailable template stages

cloudformation_get_template_summary

Get a summary of a template or deployed stack: resource types, required capabilities, and parameters, without full validation

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
templateBodystringNoThe CloudFormation template body (JSON or YAML). Required if stackName is not provided
stackNamestringNoName or ID of a deployed stack to summarize instead of a template body

Output

ParameterTypeDescription
descriptionstringTemplate description
parametersarrayTemplate parameters with types, defaults, and descriptions
capabilitiesarrayRequired capabilities (e.g., CAPABILITY_IAM)
capabilitiesReasonstringReason capabilities are required
resourceTypesarrayAWS resource types declared in the template (e.g., AWS::S3::Bucket)
versionstringTemplate format version
declaredTransformsarrayTransforms used in the template (e.g., AWS::Serverless-2016-10-31)

cloudformation_validate_template

Validate a CloudFormation template for syntax and structural correctness

Input

ParameterTypeRequiredDescription
awsRegionstringYesAWS region (e.g., us-east-1)
awsAccessKeyIdstringYesAWS access key ID
awsSecretAccessKeystringYesAWS secret access key
templateBodystringYesThe CloudFormation template body (JSON or YAML)

Output

ParameterTypeDescription
descriptionstringTemplate description
parametersarrayTemplate parameters with defaults and descriptions
capabilitiesarrayRequired capabilities (e.g., CAPABILITY_IAM)
capabilitiesReasonstringReason capabilities are required
declaredTransformsarrayTransforms used in the template (e.g., AWS::Serverless-2016-10-31)

On this page