Resource: aws_cloudformation_stack_set_instance

Manages a CloudFormation StackSet Instance. Instances are managed in the account and region of the StackSet after the target account permissions have been configured. Additional information about StackSets can be found in the AWS CloudFormation User Guide.

Example Usage

Basic Usage

resource "aws_cloudformation_stack_set_instance" "example" {
  account_id     = "123456789012"
  region         = "us-east-1"
  stack_set_name = aws_cloudformation_stack_set.example.name
}

Example IAM Setup in Target Account

data "aws_iam_policy_document" "AWSCloudFormationStackSetExecutionRole_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"

    principals {
      identifiers = [aws_iam_role.AWSCloudFormationStackSetAdministrationRole.arn]
      type        = "AWS"
    }
  }
}

resource "aws_iam_role" "AWSCloudFormationStackSetExecutionRole" {
  assume_role_policy = data.aws_iam_policy_document.AWSCloudFormationStackSetExecutionRole_assume_role_policy.json
  name               = "AWSCloudFormationStackSetExecutionRole"
}

# Documentation: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-prereqs.html
# Additional IAM permissions necessary depend on the resources defined in the StackSet template
data "aws_iam_policy_document" "AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy" {
  statement {
    actions = [
      "cloudformation:*",
      "s3:*",
      "sns:*",
    ]

    effect    = "Allow"
    resources = ["*"]
  }
}

resource "aws_iam_role_policy" "AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy" {
  name   = "MinimumExecutionPolicy"
  policy = data.aws_iam_policy_document.AWSCloudFormationStackSetExecutionRole_MinimumExecutionPolicy.json
  role   = aws_iam_role.AWSCloudFormationStackSetExecutionRole.name
}

Example Deployment across Organizations account

resource "aws_cloudformation_stack_set_instance" "example" {
  deployment_targets {
    organizational_unit_ids = [aws_organizations_organization.example.roots[0].id]
  }

  region         = "us-east-1"
  stack_set_name = aws_cloudformation_stack_set.example.name
}

Argument Reference

This resource supports the following arguments:

deployment_targets Argument Reference

The deployment_targets configuration block supports the following arguments:

operation_preferences Argument Reference

The operation_preferences configuration block supports the following arguments:

Attribute Reference

This resource exports the following attributes in addition to the arguments above:

stack_instance_summaries Attribute Reference

Timeouts

Configuration options:

Import

In Terraform v1.5.0 and later, use an import block to import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (,). For example:

import {
  to = aws_cloudformation_stack_set_instance.example
  id = "example,123456789012,us-east-1"
}

Import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (/) separated list of organizational unit IDs, and target AWS Region separated by commas (,). For example:

import {
  to = aws_cloudformation_stack_set_instance.example
  id = "example,ou-sdas-123123123/ou-sdas-789789789,us-east-1"
}

Import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (/) separated list of organizational unit IDs, target AWS Region and call_as value separated by commas (,). For example:

import {
  to = aws_cloudformation_stack_set_instance.example
  id = "example,ou-sdas-123123123/ou-sdas-789789789,us-east-1,DELEGATED_ADMIN"
}

Using terraform import, import CloudFormation StackSet Instances that target an AWS Account ID using the StackSet name, target AWS account ID, and target AWS Region separated by commas (,). For example:

% terraform import aws_cloudformation_stack_set_instance.example example,123456789012,us-east-1

Using terraform import, import CloudFormation StackSet Instances that target AWS Organizational Units using the StackSet name, a slash (/) separated list of organizational unit IDs, and target AWS Region separated by commas (,). For example:

% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1

Using terraform import, import CloudFormation StackSet Instances when acting a delegated administrator in a member account using the StackSet name, target AWS account ID or slash (/) separated list of organizational unit IDs, target AWS Region and call_as value separated by commas (,). For example:

% terraform import aws_cloudformation_stack_set_instance.example example,ou-sdas-123123123/ou-sdas-789789789,us-east-1,DELEGATED_ADMIN