aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

Support StackPolicy for nested stacks

Open
#1,512 1 comment 4 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::CloudFormation::Stack

### Resource name

_No response_

### Description

Currently, if I have a CloudFormation stack that include a nested stack. For example:
```
NestedStack:
Type: AWS::CloudFormation::Stack
Properties:
TemplateURL: ./path/to/template.yaml
```
And there are Stack Policies applied to the Root Stack
```
{
"Statement" : [
{
"Effect" : "Deny",
"Action" : ["Update:Replace", "Update:Delete"],
"Principal": "*",
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"ResourceType" : [
"AWS::RDS::DBInstance"
]
}
}
},
{
"Effect" : "Allow",
"Action" : "Update:*",
"Principal": "*",
"Resource" : "*"
}
]
}
```
These policies are NOT applied to the nested stack. As your infrastructure grows, it's a best practice to use Nested Stacks, and in this case, having Stack Policies applied to the Root Stack makes them useless because all of the resources are in the nested stacks.
Can we have a way to set the Stack Policies for `AWS::CloudFormation::Stack` resource? Either using JSON or inherit from the root stack?

### Other Details

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-nested-stacks.html
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html

Contributor guide

Open the contributing guide

Research direction

Start by reading the linked AWS CloudFormation nested-stack and stack-policy documentation to confirm the requested behavior and available policy mechanisms. The issue names no repository files, tests, or entry points; done would require a defined way for AWS::CloudFormation::Stack resources to receive or inherit StackPolicy settings.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.