CloudFormation engine

MiniStack ships its own CloudFormation engine — not a template-to-SDK translator. Templates are parsed, intrinsics are evaluated, and resources are provisioned by calling each service's internal create-path directly. This page is the reference for what the engine supports.

178 resource types 16 intrinsics change sets cross-stack exports

Stack lifecycle

Stacks move through the standard CloudFormation states. Operations are asynchronous, as on AWS: CreateStack / UpdateStack / DeleteStack return immediately with the stack in *_IN_PROGRESS, and provisioning completes on a background task — poll DescribeStacks (or use your SDK's waiters) for the terminal state.

Transition	States visited
Create	`CREATE_IN_PROGRESS` → `CREATE_COMPLETE` / `CREATE_FAILED` / `ROLLBACK_COMPLETE`
Update	`UPDATE_IN_PROGRESS` → `UPDATE_COMPLETE` / `UPDATE_FAILED` / `UPDATE_ROLLBACK_COMPLETE`
Delete	`DELETE_IN_PROGRESS` → `DELETE_COMPLETE` / `DELETE_FAILED`

Resources are provisioned in dependency order (parameters → conditions → resources by DependsOn / Ref / Fn::GetAtt edges). On failure, provisioned resources are rolled back in reverse order.

Stack events are emitted per resource transition and retrievable via DescribeStackEvents.

A stack left CREATE_FAILED or UPDATE_FAILED with rollback disabled is rolled back later with RollbackStack. ContinueUpdateRollback and CancelUpdateStack are supported.

Intrinsics

All 16 CloudFormation intrinsics plus the standard pseudo-parameters are supported. Evaluation is recursive and order-independent within a template.

Intrinsic	Notes
`Ref`	Parameters → default/override; resources → physical ID.
`Fn::GetAtt`	Scalar `Resource.Attribute` or list form. Split on first dot for nested attrs.
`Fn::Sub`	`${Var}` and `${Resource.Attr}` substitution, including explicit variable map.
`Fn::Join`	Delimiter + list.
`Fn::Split`	Delimiter split into a list.
`Fn::Select`	Zero-indexed element from a list.
`Fn::FindInMap`	Three-level Mappings lookup.
`Fn::If` / `Fn::Equals` / `Fn::And` / `Fn::Or` / `Fn::Not`	Full conditional evaluation. Resources/outputs can be gated by a `Condition`.
`Fn::Base64`	UTF-8 → base64.
`Fn::Cidr`	CIDR subnet calculator.
`Fn::GetAZs`	Returns three pseudo-AZs per region (`a`, `b`, `c`).
`Fn::ImportValue`	Cross-stack import (by `Outputs[].Export.Name`).
`Fn::GetStackOutput`	MiniStack extension (not an AWS intrinsic): cross-stack output lookup emitted by `aws-cdk-local`.

Pseudo-parameters

AWS::Region — from the caller's SigV4 scope; not a server-wide value.
AWS::AccountId — from the request's account.
AWS::StackName, AWS::StackId — from the stack being provisioned.
AWS::Partition — hardcoded to aws.
AWS::URLSuffix — hardcoded to amazonaws.com.
AWS::NotificationARNs — resolves to an empty list; SNS notifications are not dispatched.
AWS::NoValue — drops properties at substitution time.

Resource types

178 resource types across 47 AWS services. Each type has a provisioner in ministack/services/cloudformation/provisioners.py that knows how to call the target service's internal create/update/delete.

Compute & containers

AWS::Lambda::Function AWS::Lambda::Version AWS::Lambda::Alias AWS::Lambda::Permission AWS::Lambda::LayerVersion AWS::Lambda::EventSourceMapping AWS::Lambda::EventInvokeConfig AWS::Lambda::Url AWS::Lambda::LayerVersionPermission AWS::ECS::Cluster AWS::ECS::TaskDefinition AWS::ECS::Service AWS::EC2::LaunchTemplate AWS::EKS::Cluster AWS::EKS::Nodegroup AWS::AutoScaling::AutoScalingGroup AWS::AutoScaling::LaunchConfiguration AWS::AutoScaling::ScalingPolicy AWS::AutoScaling::LifecycleHook AWS::AutoScaling::ScheduledAction

Networking

AWS::EC2::VPC AWS::EC2::Subnet AWS::EC2::SecurityGroup AWS::EC2::InternetGateway AWS::EC2::VPCGatewayAttachment AWS::EC2::RouteTable AWS::EC2::Route AWS::EC2::SubnetRouteTableAssociation AWS::EC2::VPCEndpoint AWS::ElasticLoadBalancingV2::LoadBalancer AWS::ElasticLoadBalancingV2::Listener AWS::ElasticLoadBalancingV2::ListenerRule AWS::ElasticLoadBalancingV2::TargetGroup AWS::Route53::HostedZone AWS::Route53::RecordSet AWS::CloudFront::Distribution AWS::CloudFront::KeyValueStore AWS::CloudFront::CloudFrontOriginAccessIdentity AWS::CloudFront::OriginAccessControl AWS::CloudFront::CachePolicy AWS::CloudFront::OriginRequestPolicy AWS::CloudFront::ResponseHeadersPolicy AWS::CloudFront::Function AWS::CertificateManager::Certificate AWS::ServiceDiscovery::HttpNamespace AWS::ServiceDiscovery::PrivateDnsNamespace AWS::ServiceDiscovery::PublicDnsNamespace AWS::ServiceDiscovery::Service AWS::ServiceDiscovery::Instance

Storage & data

AWS::S3::Bucket AWS::S3::BucketPolicy AWS::S3::MultiRegionAccessPoint AWS::S3Tables::TableBucket AWS::S3Tables::Namespace AWS::S3Tables::Table AWS::DynamoDB::Table AWS::DynamoDB::GlobalTable AWS::RDS::DBCluster AWS::RDS::DBInstance AWS::RDS::DBSubnetGroup AWS::RDS::DBParameterGroup AWS::RDS::DBClusterParameterGroup AWS::Kinesis::Stream AWS::KinesisFirehose::DeliveryStream AWS::ECR::Repository AWS::OpenSearchService::Domain AWS::EFS::FileSystem AWS::EFS::MountTarget AWS::EFS::AccessPoint AWS::ElastiCache::CacheCluster AWS::ElastiCache::ReplicationGroup AWS::ElastiCache::SubnetGroup AWS::ElastiCache::ParameterGroup AWS::ElastiCache::User AWS::ElastiCache::UserGroup AWS::Glue::Database AWS::Glue::Table AWS::Glue::Partition AWS::Glue::Connection AWS::Glue::Crawler AWS::Glue::Job AWS::Glue::Trigger

Messaging & events

AWS::SQS::Queue AWS::SQS::QueuePolicy AWS::SNS::Topic AWS::SNS::Subscription AWS::SNS::TopicPolicy AWS::Events::EventBus AWS::Events::Rule AWS::StepFunctions::StateMachine AWS::Pipes::Pipe AWS::Scheduler::Schedule AWS::Scheduler::ScheduleGroup AWS::IoT::TopicRule AWS::IoT::Policy AWS::IoT::ThingType AWS::IoT::CACertificate AWS::IoT::ProvisioningTemplate AWS::IoT::ThingGroup AWS::IoT::Thing AWS::IoT::Certificate AWS::IoT::ThingPrincipalAttachment AWS::IoT::PolicyPrincipalAttachment AWS::IoT::JobTemplate AWS::IoT::DomainConfiguration

APIs

AWS::ApiGateway::RestApi AWS::ApiGateway::Resource AWS::ApiGateway::Method AWS::ApiGateway::Model AWS::ApiGateway::Deployment AWS::ApiGateway::Stage AWS::ApiGateway::Authorizer AWS::ApiGateway::Account AWS::ApiGateway::GatewayResponse AWS::ApiGateway::DomainName AWS::ApiGateway::BasePathMapping AWS::ApiGateway::DocumentationPart AWS::ApiGateway::DocumentationVersion AWS::ApiGateway::RequestValidator AWS::ApiGateway::ApiKey AWS::ApiGateway::UsagePlan AWS::ApiGateway::UsagePlanKey AWS::ApiGatewayV2::Api AWS::ApiGatewayV2::Stage AWS::ApiGatewayV2::Integration AWS::ApiGatewayV2::Route AWS::ApiGatewayV2::Authorizer AWS::ApiGatewayV2::DomainName AWS::ApiGatewayV2::ApiMapping AWS::AppSync::GraphQLApi AWS::AppSync::GraphQLSchema AWS::AppSync::DataSource AWS::AppSync::FunctionConfiguration AWS::AppSync::Resolver AWS::AppSync::ApiKey

Security, identity, logging & config

AWS::IAM::Role AWS::IAM::Policy AWS::IAM::ManagedPolicy AWS::IAM::InstanceProfile AWS::KMS::Key AWS::KMS::Alias AWS::Signer::SigningProfile AWS::Signer::ProfilePermission AWS::SecretsManager::Secret AWS::SecretsManager::SecretTargetAttachment AWS::Cognito::UserPool AWS::Cognito::UserPoolClient AWS::Cognito::UserPoolDomain AWS::Cognito::UserPoolGroup AWS::Cognito::UserPoolResourceServer AWS::Cognito::IdentityPool AWS::Cognito::IdentityPoolRoleAttachment AWS::Cognito::IdentityPoolPrincipalTag AWS::Logs::LogGroup AWS::Logs::SubscriptionFilter AWS::Logs::ResourcePolicy AWS::CloudWatch::Alarm AWS::CloudWatch::Dashboard AWS::WAFv2::WebACL AWS::SES::EmailIdentity AWS::SES::ConfigurationSet AWS::SES::ConfigurationSetEventDestination AWS::CodeBuild::Project AWS::SSM::Parameter AWS::AppConfig::Application AWS::AppConfig::Environment AWS::AppConfig::ConfigurationProfile AWS::AppConfig::HostedConfigurationVersion AWS::AppConfig::DeploymentStrategy AWS::AppConfig::Deployment AWS::Backup::BackupPlan AWS::Backup::BackupVault

Utility

AWS::CloudFormation::Stack AWS::CloudFormation::CustomResource AWS::CloudFormation::WaitCondition AWS::CloudFormation::WaitConditionHandle AWS::CDK::Metadata AWS::Location::Tracker

Nested stacks are supported: AWS::CloudFormation::Stack fetches the child template from TemplateURL and provisions it in-process. Any resource type not in this list fails stack creation with UnsupportedResource. File an issue if you need one added — many are a few hours of work.

Change sets

CreateChangeSet, DescribeChangeSet, ExecuteChangeSet, DeleteChangeSet, and ListChangeSets are fully wired. The engine diffs the current stack against the proposed template and emits a set of ResourceChange entries — your IaC tool can preview before applying.

Outputs & exports

Outputs are computed after all resources settle. Outputs[].Export.Name publishes a value into a global export table that downstream stacks import with Fn::ImportValue. ListExports and ListImports work as expected.

Gaps

Stack policies are stored, not enforced. SetStackPolicy / GetStackPolicy round-trip the policy, but an update is not checked against it.
Drift detection covers a subset of types. Properties are compared for AWS::SQS::Queue, AWS::SSM::Parameter, AWS::SNS::Topic, AWS::Lambda::Function, AWS::IAM::Role, AWS::DynamoDB::Table, AWS::S3::Bucket, AWS::Logs::LogGroup and AWS::SecretsManager::Secret; AWS::Kinesis::Stream, AWS::ECR::Repository, AWS::StepFunctions::StateMachine, AWS::Events::Rule and AWS::SNS::Subscription are checked for existence only. Every other type is NOT_CHECKED.
StackSets are not implemented. No *StackSet / *StackInstances operations.
SNS notifications are not dispatched. CreateStack's NotificationARNs parameter is ignored, and the pseudo-parameter resolves to an empty list.
Third-party resource types / modules — not supported. (Custom::* resources are supported and invoke their Lambda-backed handler.)

Inspecting unsupported resources: when a stack fails with UnsupportedResource, the event includes the type name. Cross-reference against the lists above to know if it's a gap or a typo.