aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
StackSets: Requirement for ParameterOverrides to propagate to NEW Stack instances when AutoDeployment is enabled.
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::CloudFormation::StackSet
### Resource name
_No response_
### Description
Deploying a Stackset with ParameterOverrides and AutoDeployment enabled to existing accounts, works well . However, when new account instances are created, ParameterOverrides are not used on the target accounts. Instead, the default parameter values are used.
Can this behavior be changed to work as expected?
**Replication steps:**
1. Create Template1.yml with Environment parameter and (for example) an IAM Role, that references the parameter.
2. Upload Template1.yml to s3 in the master organization account from where you will deploy the stackset. Take note of the bucket url.
3. Create Template2.yml
4. Update the TemplateURL to the s3 bucket url from step 2
5. Update the OrganizationalUnitIds to reflect 2 existing OU's.
6. Before creating the stackset from Template2.yml, ensure the OU's provided contains at least 1 account each.
7. From the master account, open Cloudformation stacks, then create a new stack by providing Template2.yml. During deployment, this stack will create the stackset.
9. Once completed, login to the targeted accounts and verify that the 2 roles were created with dev and prod respectively.
10. Finally, create a new account inside the OU's
11. Notice now that the role do not not include either dev or prod. However, it is created with the default value of UNDEFINED.
**Expected Behavior:**
It was expected that the new account instance would also use the ParameterOverrides value, however the default value is used.
**Template1.yml:**
```
AWSTemplateFormatVersion: 2010-09-09
Parameters:
Environment:
Type: String
Description: "Description of the environment."
Default: UNDEFINED
Resources:
StackSetResourceRole:
Type: AWS::IAM::Role
Properties:
Description: !Sub
- 'ROLE-${Env}'
- Env: !Ref Environment
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service: lambda.amazonaws.com
Action: sts:AssumeRole
```
**Template2.yml:**
```
Parameters:
Environment:
Type: String
Description: "Description of the environment."
Default: UNDEFINED
Resources:
CFNResourceWithParms:
Type: AWS::CloudFormation::StackSet
Properties:
AutoDeployment:
Enabled: true
RetainStacksOnAccountRemoval: false
PermissionModel: SERVICE_MANAGED
StackSetName: CFNResourceWithParms
Capabilities:
- 'CAPABILITY_IAM'
TemplateURL: https://xxx-yyyy-bucket-us-east-1.s3.amazonaws.com/Template1.yml # example bucket
StackInstancesGroup:
-
ParameterOverrides:
- { ParameterKey: "Environment", ParameterValue: "prod" }
DeploymentTargets:
OrganizationalUnitIds:
- ou-xxx-xxx # example ou
Regions:
- us-east-1
-
ParameterOverrides:
- { ParameterKey: "Environment", ParameterValue: "dev" }
DeploymentTargets:
OrganizationalUnitIds:
- ou-yyy-yyy # example ou
Regions:
- us-east-1
```
**Work-around:**
As a work-around, update-stack-instances corrects the needed values in the target account instance.
```
aws cloudformation update-stack-instances --stack-set-name stacksetname --parameter-overrides ParameterKey=Environment,ParameterValue=prod --operation-preferences FailureToleranceCount=0,MaxConcurrentCount=1 --accounts "NEW_ACCOUNT_ID" --regions "us-east-1"
```
References:
------------
[1] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stackinstances-override.html#stackinstances-override-cli
ps: creating request on behalf of customer.
### Other Details
_No response_
Contributor guide
Research direction
Start with the reported StackSet reproduction using Template1.yml and Template2.yml, then read the linked AWS parameter-override documentation and compare the behavior with the update-stack-instances workaround. Done would mean determining whether ParameterOverrides are applied when AutoDeployment creates new account instances and documenting or implementing the supported behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100