Parent Template with Nested Stack

Resources:
  NetworkStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/bucket/network.yaml
      Parameters:
        VpcCidr: 10.0.0.0/16
        
  ApplicationStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      TemplateURL: https://s3.amazonaws.com/bucket/application.yaml
      Parameters:
        VpcId: !GetAtt NetworkStack.Outputs.VpcId
        SubnetIds: !GetAtt NetworkStack.Outputs.SubnetIds
        
Outputs:
  ApplicationUrl:
    Description: URL for the application
    Value: !GetAtt ApplicationStack.Outputs.LoadBalancerUrl

Creating a Stack Set with AWS CLI

# Create a stack set
aws cloudformation create-stack-set \
  --stack-set-name SecurityBaseline \
  --template-body file://security.yaml \
  --description "Security baseline for all accounts" \
  --permission-model SERVICE_MANAGED \
  --auto-deployment Enabled=true,RetainStacksOnAccountRemoval=false

# Add stack instances (deploy to accounts)
aws cloudformation create-stack-instances \
  --stack-set-name SecurityBaseline \
  --accounts 123456789012 098765432109 \
  --regions us-east-1 us-west-2 eu-west-1 \
  --operation-preferences MaxConcurrentCount=3,FailureToleranceCount=1

Use cases for StackSets include:

• Deploying security baseline configurations across accounts
• Creating consistent network resources in multiple regions
• Setting up cross-account IAM roles for centralized management
• Implementing organization-wide compliance controls

Lambda-backed Custom Resource

Resources:
  # Lambda function that will handle the custom resource
  CustomResourceFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.9
      Role: !GetAtt LambdaExecutionRole.Arn
      Handler: index.handler
      Code:
        ZipFile: |
          import json
          import cfnresponse
          import boto3
          import urllib.request
          
          def handler(event, context):
              responseData = {}
              
              try:
                  if event['RequestType'] == 'Create' or event['RequestType'] == 'Update':
                      # Example: Get the external IP address of the deployment environment
                      external_ip = urllib.request.urlopen('https://api.ipify.org').read().decode('utf8')
                      responseData['ExternalIp'] = external_ip
                      
                      # Example: Create a custom resource configuration
                      client = boto3.client('ssm')
                      client.put_parameter(
                          Name='/app/config/deployment-ip',
                          Value=external_ip,
                          Type='String',
                          Overwrite=True
                      )
                  
                  elif event['RequestType'] == 'Delete':
                      # Cleanup when stack is deleted
                      client = boto3.client('ssm')
                      client.delete_parameter(
                          Name='/app/config/deployment-ip'
                      )
                      
                  cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
              except Exception as e:
                  print(str(e))
                  cfnresponse.send(event, context, cfnresponse.FAILED, {'Error': str(e)})
  
  # IAM role for the function
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: AllowSSMParameterModification
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - ssm:PutParameter
                  - ssm:DeleteParameter
                Resource: '*'
  
  # The custom resource itself
  DeploymentConfiguration:
    Type: Custom::DeploymentConfig
    Properties:
      ServiceToken: !GetAtt CustomResourceFunction.Arn
      # Any properties you want to pass to your Lambda function
      Environment: !Ref Environment
      
Outputs:
  DeploymentIp:
    Description: External IP used for this deployment
    Value: !GetAtt DeploymentConfiguration.ExternalIp

Using Dynamic References

Resources:
  MyDatabase:
    Type: AWS::RDS::DBInstance
    Properties:
      Engine: mysql
      DBName: mydatabase
      DBInstanceClass: db.t3.small
      AllocatedStorage: 20
      # Reference a database password stored in Secrets Manager
      MasterUsername: admin
      MasterUserPassword: '{{resolve:secretsmanager:MyDatabaseSecret:SecretString:password}}'
      
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t2.micro
      # Reference an AMI ID stored in Parameter Store
      ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}'
      
  MyConfig:
    Type: AWS::AppConfig::ConfigurationProfile
    Properties:
      Name: MyAppConfig
      ApplicationId: !Ref MyAppConfigApplication
      # Reference a Parameter Store parameter with a specific version
      LocationUri: !Sub 'ssm-parameter://${AppConfigParam}:3'