Manages a CloudFormation StackSet Instance. Instances are managed in the account and region of the StackSet after the target account permissions have been configured. Additional information about StackSets can be found in the AWS CloudFormation User Guide.
resource "aws_cloudformation_stack_set_instance" "example" {
account_id = "123456789012"
region = "us-east-1"
stack_set_name = aws_cloudformation_stack_set.example.name
}
data "aws_iam_policy_document" "AWSCloudFormationStackSetExecutionRole_assume_role_policy" {
statement {
actions = ["sts:AssumeRole"]
effect = "Allow"
principals {
identifiers = [aws_iam_role.AWSCloudFormationStackSetAdministrationRole.arn]
type = "AWS"
}
}
}
resource "aws_iam_role" "AWSCloudFormationStackSetExecutionRole" {
assume_role_policy = data.aws_iam_policy_document.AWSCloudFormationStackSetExecutionRole_assume_role_policy.json
name = "AWSCloudFormationStackSetExecutionRole"
}
# Documentation: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html
# Additional IAM permissions necessary depend on the resources defined in the StackSet template
data "aws_iam_policy_document" "AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy" {
statement {
actions = [
"cloudformation:*",
"s3:*",
"sns:*",
]
effect = "Allow"
resources = ["*"]
}
}
resource "aws_iam_role_policy" "AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy" {
name = "MinimumExecutionPolicy"
policy = data.aws_iam_policy_document.AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy.json
role = aws_iam_role.AWSCloudFormationStackSetExecutionRole.name
}
resource "aws_cloudformation_stack_set_instance" "example" {
deployment_targets {
organizational_unit_ids = [aws_organizations_organization.example.roots[0].id]
}
region = "us-east-1"
stack_set_name = aws_cloudformation_stack_set.example.name
}
This resource supports the following arguments:
stack_set_name
- (Required) Name of the StackSet.account_id
- (Optional) Target AWS Account ID to create a Stack based on the StackSet. Defaults to current account.deployment_targets
- (Optional) The AWS Organizations accounts to which StackSets deploys. StackSets doesn't deploy stack instances to the organization management account, even if the organization management account is in your organization or in an OU in your organization. Drift detection is not possible for this argument. See deployment_targets below.parameter_overrides
- (Optional) Key-value map of input parameters to override from the StackSet for this Instance.region
- (Optional) Target AWS Region to create a Stack based on the StackSet. Defaults to current region.retain_stack
- (Optional) During Terraform resource destroy, remove Instance from StackSet while keeping the Stack and its associated resources. Must be enabled in Terraform state _before_ destroy operation to take effect. You cannot reassociate a retained Stack or add an existing, saved Stack to a new StackSet. Defaults to false
.call_as
- (Optional) Specifies whether you are acting as an account administrator in the organization's management account or as a delegated administrator in a member account. Valid values: SELF
(default), DELEGATED_ADMIN
.operation_preferences
- (Optional) Preferences for how AWS CloudFormation performs a stack set operation.deployment_targets
Argument ReferenceThe deployment_targets
configuration block supports the following arguments:
organizational_unit_ids
- (Optional) The organization root ID or organizational unit (OU) IDs to which StackSets deploys.operation_preferences
Argument ReferenceThe operation_preferences
configuration block supports the following arguments:
failure_tolerance_count
- (Optional) The number of accounts, per Region, for which this operation can fail before AWS CloudFormation stops the operation in that Region.failure_tolerance_percentage
- (Optional) The percentage of accounts, per Region, for which this stack operation can fail before AWS CloudFormation stops the operation in that Region.max_concurrent_count
- (Optional) The maximum number of accounts in which to perform this operation at one time.max_concurrent_percentage
- (Optional) The maximum percentage of accounts in which to perform this operation at one time.region_concurrency_type
- (Optional) The concurrency type of deploying StackSets operations in Regions, could be in parallel or one Region at a time. Valid values are SEQUENTIAL
and PARALLEL
.region_order
- (Optional) The order of the Regions in where you want to perform the stack operation.This resource exports the following attributes in addition to the arguments above:
id
- Unique identifier for the resource. If deployment_targets
is set, this is a comma-delimited string combining stack set name, organizational unit IDs (/
-delimited), and region (ie. mystack,ou-123/ou-456,us-east-1
). Otherwise, this is a comma-delimited string combining stack set name, AWS account ID, and region (ie. mystack,123456789012,us-east-1
).organizational_unit_id
- The organization root ID or organizational unit (OU) ID in which the stack is deployed.stack_id
- Stack identifier.stack_instance_summaries
- List of stack instances created from an organizational unit deployment target. This will only be populated when deployment_targets
is set. See stack_instance_summaries
.stack_instance_summaries
Attribute Referenceaccount_id
- AWS account ID in which the stack is deployed.organizational_unit_id
- Organizational unit ID in which the stack is deployed.stack_id
- Stack identifier.create
- (Default 30m
)update
- (Default 30m
)delete
- (Default 30m
)In Terraform v1.5.0 and later, use an import
block to import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (,
). For example:
import {
to = aws_cloudformation_stack_set_instance.example
id = "example,123456789012,us-east-1"
}
Import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (/
) separated list of organizational unit IDs, and target AWS Region separated by commas (,
). For example:
import {
to = aws_cloudformation_stack_set_instance.example
id = "example,ou-sdas-123123123/ou-sdas-789789789,us-east-1"
}
Import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (/
) separated list of organizational unit IDs, target AWS Region and call_as
value separated by commas (,
). For example:
import {
to = aws_cloudformation_stack_set_instance.example
id = "example,ou-sdas-123123123/ou-sdas-789789789,us-east-1,DELEGATED_ADMIN"
}
Using terraform import
, import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (,
). For example:
% terraform import aws_cloudformation_stack_set_instance.example example,123456789012,us-east-1
Using terraform import
, import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (/
) separated list of organizational unit IDs, and target AWS Region separated by commas (,
). For example:
% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1
Using terraform import
, import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (/
) separated list of organizational unit IDs, target AWS Region and call_as
value separated by commas (,
). For example:
% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1,DELEGATED_ADMIN