Product
Introducing Ruby Support in Socket
Socket is launching Ruby support for all users. Enhance your Rails projects with AI-powered security scans for vulnerabilities and supply chain threats. Now in Beta!
@aws-cdk/aws-cloudformation
Advanced tools
This is a developer preview (public beta) module. Releases might lack important features and might have future breaking changes.
This API is still under active development and subject to non-backward compatible changes or removal in any future version. Use of the API is not recommended in production environments. Experimental APIs are not subject to the Semantic Versioning model.
This module is part of the AWS Cloud Development Kit project.
Custom Resources are CloudFormation resources that are implemented by arbitrary user code. They can do arbitrary lookups or modifications during a CloudFormation synthesis run.
You will typically use Lambda to implement a Construct implemented as a
Custom Resource (though SNS topics can be used as well). Your Lambda function
will be sent a CREATE
, UPDATE
or DELETE
message, depending on the
CloudFormation life cycle, and can return any number of output values which
will be available as attributes of your Construct. In turn, those can
be used as input to other Constructs in your model.
In general, consumers of your Construct will not need to care whether it is implemented in term of other CloudFormation resources or as a custom resource.
Note: when implementing your Custom Resource using a Lambda, use
a SingletonLambda
so that even if your custom resource is instantiated
multiple times, the Lambda will only get uploaded once.
Sample of a Custom Resource that copies files into an S3 bucket during deployment
(implementation of actual copy.py
operation elided).
interface CopyOperationProps {
sourceBucket: IBucket;
targetBucket: IBucket;
}
class CopyOperation extends Construct {
constructor(parent: Construct, name: string, props: DemoResourceProps) {
super(parent, name);
const lambdaProvider = new SingletonLambda(this, 'Provider', {
uuid: 'f7d4f730-4ee1-11e8-9c2d-fa7ae01bbebc',
code: new LambdaInlineCode(resources['copy.py']),
handler: 'index.handler',
timeout: 60,
runtime: LambdaRuntime.Python3,
});
new CustomResource(this, 'Resource', {
provider: CustomResourceProvider.lambda(provider),
properties: {
sourceBucketArn: props.sourceBucket.bucketArn,
targetBucketArn: props.targetBucket.bucketArn,
}
});
}
}
More examples are in the example
directory, including an example of how to use
the cfnresponse
module that is provided for you by CloudFormation.
See the following section of the docs on details to write Custom Resources:
Sometimes a single API call can fill the gap in the CloudFormation coverage. In
this case you can use the AwsCustomResource
construct. This construct creates
a custom resource that can be customized to make specific API calls for the
CREATE
, UPDATE
and DELETE
events. Additionally, data returned by the API
call can be extracted and used in other constructs/resources (creating a real
CloudFormation dependency using Fn::GetAtt
under the hood).
The physical id of the custom resource can be specified or derived from the data returned by the API call.
The AwsCustomResource
uses the AWS SDK for JavaScript. Services, actions and
parameters can be found in the API documentation.
Path to data must be specified using a dot notation, e.g. to get the string value
of the Title
attribute for the first item returned by dynamodb.query
it should
be Items.0.Title.S
.
Verify a domain with SES:
const verifyDomainIdentity = new AwsCustomResource(this, 'VerifyDomainIdentity', {
onCreate: {
service: 'SES',
action: 'verifyDomainIdentity',
parameters: {
Domain: 'example.com'
},
physicalResourceIdPath: 'VerificationToken' // Use the token returned by the call as physical id
}
});
new route53.TxtRecord(zone, 'SESVerificationRecord', {
recordName: `_amazonses.example.com`,
recordValue: verifyDomainIdentity.getData('VerificationToken')
});
Get the latest version of a secure SSM parameter:
const getParameter = new AwsCustomResource(this, 'GetParameter', {
onUpdate: { // will also be called for a CREATE event
service: 'SSM',
action: 'getParameter',
parameters: {
Name: 'my-parameter',
WithDecryption: true
},
physicalResourceId: Date.now().toString() // Update physical id to always fetch the latest version
}
});
// Use the value in another construct with
getParameter.getData('Parameter.Value')
IAM policy statements required to make the API calls are derived from the calls
and allow by default the actions to be made on all resources (*
). You can
restrict the permissions by specifying your own list of statements with the
policyStatements
prop.
Chained API calls can be achieved by creating dependencies:
const awsCustom1 = new AwsCustomResource(this, 'API1', {
onCreate: {
service: '...',
action: '...',
physicalResourceId: '...'
}
});
const awsCustom2 = new AwsCustomResource(this, 'API2', {
onCreate: {
service: '...',
action: '...'
parameters: {
text: awsCustom1.getData('Items.0.text')
},
physicalResourceId: '...'
}
})
0.35.0 (2019-06-19)
cdk context
(#2870) (b8a1c8e), closes #2854name
in StageProps
to stageName
. (#2882) (be574a1)hwType
to hardwareType
(#2916) (1aa0589), closes #2896aws-sns-subscribers
(#2804) (9ef899c)AssetProps.packaging
has been removed and is now automatically discovered based on the file type.ZipDirectoryAsset
has been removed, use aws-s3-assets.Asset
.FileAsset
has been removed, use aws-s3-assets.Asset
.Code.directory
and Code.file
have been removed. Use Code.asset
.hardwareType
from hwType
.TableOptions.pitrEnabled
renamed to pointInTimeRecovery
.TableOptions.sseEnabled
renamed to serverSideEncryption
.TableOptions.ttlAttributeName
renamed to timeToLiveAttribute
.TableOptions.streamSpecification
renamed stream
.ContainerImage.fromAsset()
now takes only build directory
directly (no need to pass scope
or id
anymore).ISecret.secretJsonValue
renamed to secretValueFromJson
.ParameterStoreString
has been removed. Use StringParameter.fromStringParameterAttributes
.ParameterStoreSecureString
has been removed. Use StringParameter.fromSecureStringParameterAttributes
.ParameterOptions.name
was renamed to parameterName
.newStream
renamed to addStream
and doesn't need a scopenewSubscriptionFilter
renamed to addSubscriptionFilter
and doesn't need a scopenewMetricFilter
renamed to addMetricFilter
and doesn't need a scopeNewSubscriptionFilterProps
renamed to SubscriptionProps
NewLogStreamProps
renamed to LogStreamOptions
NewMetricFilterProps
renamed to MetricFilterOptions
JSONPattern
renamed to JsonPattern
MethodOptions.authorizerId
is now called authorizer
and accepts an IAuthorizer
which is a placeholder interface for the authorizer resource.restapi.executeApiArn
renamed to arnForExecuteApi
.restapi.latestDeployment
and deploymentStage
are now read-only.EventPattern.detail
is now a map.scheduleExpression: string
is now schedule: Schedule
.cdk.RemovalPolicy
to configure the resource's removal policy.applyRemovalPolicy
is now CfnResource.applyRemovalPolicy
.RemovalPolicy.Orphan
has been renamed to Retain
.RemovalPolicy.Forbid
has been removed, use Retain
.RepositoryProps.retain
is now removalPolicy
, and defaults to Retain
instead of remove since ECR is a stateful resourceKeyProps.retain
is now removalPolicy
LogGroupProps.retainLogGroup
is now removalPolicy
LogStreamProps.retainLogStream
is now removalPolicy
DatabaseClusterProps.deleteReplacePolicy
is now removalPolicy
DatabaseInstanceNewProps.deleteReplacePolicy
is now removalPolicy
attr
instead of the resource type. For example, in S3 bucket.bucketArn
is now bucket.attrArn
.propertyOverrides
has been removed from all "Cfn" resources, instead
users can now read/write resource properties directly on the resource class. For example, instead of lambda.propertyOverrides.runtime
just use lambda.runtime
.stageName
instead of name
Function.addLayer
to addLayers
and made it variadicIFunction.handler
propertyIVersion.versionArn
property (the value is at functionArn
)SingletonLayerVersion
LogRetention
PolicyStatement
no longer has a fluid API, and accepts a
props object to be able to set the important fields.ImportedResourcePrincipal
to UnknownPrincipal
.managedPolicyArns
renamed to managedPolicies
, takes
return value from ManagedPolicy.fromAwsManagedPolicyName()
.PolicyDocument.postProcess()
is now removed.PolicyDocument.addStatement()
renamed to addStatements
.PolicyStatement
is no longer IResolvable
, call .toStatementJson()
to retrieve the IAM policy statement JSON.AwsPrincipal
has been removed, use ArnPrincipal
instead.s3.StorageClass
is now an enum-like class instead of a regular
enum. This means that you need to call .value
in order to obtain it's value.s3.Coordinates
renamed to s3.Location
Artifact.s3Coordinates
renamed to Artifact.s3Location
.BuildSpec
object.lambda.Runtime.NodeJS*
are now lambda.Runtime.Nodejs*
Stack
APIstack.name
renamed to stack.stackName
stack.stackName
will return the concrete stack name. Use Aws.stackName
to indicate { Ref: "AWS::StackName" }.stack.account
and stack.region
will return the concrete account/region only if they are explicitly specified when the stack is defined (under the env
prop). Otherwise, they will return a token that resolves to the AWS::AccountId and AWS::Region intrinsic references. Use Context.getDefaultAccount()
and Context.getDefaultRegion()
to obtain the defaults passed through the toolkit in case those are needed. Use Token.isUnresolved(v)
to check if you have a concrete or intrinsic.stack.logicalId
has been removed. Use stack.getLogicalId()
stack.env
has been removed, use stack.account
, stack.region
and stack.environment
insteadstack.accountId
renamed to stack.account
(to allow treating account more abstractly)AvailabilityZoneProvider
can now be accessed through Context.getAvailabilityZones()
SSMParameterProvider
can now be accessed through Context.getSsmParameter()
parseArn
is now Arn.parse
arnFromComponents
is now arn.format
node.lock
and node.unlock
are now privatestack.requireRegion
and requireAccountId
have been removed. Use Token.unresolved(stack.region)
insteadstack.parentApp
have been removed. Use App.isApp(stack.node.root)
instead.stack.missingContext
is now privatestack.renameLogical
have been renamed to stack.renameLogicalId
IAddressingScheme
, HashedAddressingScheme
and LogicalIDs
are now internal. Override Stack.allocateLogicalId
to customize how logical IDs are allocated to resources.--rename
, and the stack
names are now immutable on the stack artifact.@aws-cdk/aws-sns-subscribers
package.roleName
in RoleProps
is now of type PhysicalName
bucketName
in BucketProps
is now of type PhysicalName
roleName
in RoleProps
is now of type PhysicalName
FAQs
The CDK Construct Library for AWS::CloudFormation
The npm package @aws-cdk/aws-cloudformation receives a total of 63,493 weekly downloads. As such, @aws-cdk/aws-cloudformation popularity was classified as popular.
We found that @aws-cdk/aws-cloudformation demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket is launching Ruby support for all users. Enhance your Rails projects with AI-powered security scans for vulnerabilities and supply chain threats. Now in Beta!
Product
Ensure open-source compliance with Socket’s License Enforcement Beta. Set up your License Policy and secure your software!
Product
We're launching a new set of license analysis and compliance features for analyzing, managing, and complying with licenses across a range of supported languages and ecosystems.