The following feed describes important changes in each release of the AWS CloudFormation User Guide after May 2018
Use the secretsmanager dynamic reference to retrieve entire secrets or secret values that are stored in AWS Secrets Manager for use in your templates. Secrets can be database credentials, passwords, third-party API keys, and even arbitrary text. Using the secretsmanager dynamic reference guarantees that neither Secrets Manager nor CloudFormation logs Read more…
To modify a replication group’s shards by adding or removing shards, rather than replacing the entire AWS::ElastiCache::ReplicationGroup resource, use the UseOnlineResharding update policy.
Use macros to to perform custom processing on templates, from simple actions like find-and-replace operations to extensive transformations of entire templates.
You can use a VPC endpoint to create a private connection between your VPC and AWS CloudFormation without requiring access over the Internet, through a NAT instance, a VPN connection, or AWS Direct Connect.
Use new dynamic references to specify values that are stored and managed in other services, including Systems Manager Parameter Store SecureString type parameters, in your stack templates.
Use the optional Accounts and Regions parameters to specify the accounts and regions in which to update stack instances during a stack set update operation.
Use customized execution roles in target accounts to control the stack resources that users or groups can include in their stack sets.
For Amazon S3 buckets that AWS CloudFormation creates to store uploaded stack templates, server-side encryption is now enabled by default, thereby encrypting all objects stored in those buckets.
AWS CloudFormation now offers new endpoints which use FIPS 140-2 validated cryptographic modules in the following public US regions: US-East-1, US-East-2, US-West-1, and US-West-2.