» Resource: aws_cloudformation_stack_set

Manages a CloudFormation StackSet. StackSets allow CloudFormation templates to be easily deployed across multiple accounts and regions via StackSet Instances (aws_cloudformation_stack_set_instance resource). Additional information about StackSets can be found in the AWS CloudFormation User Guide.

» Example Usage

data "aws_iam_policy_document" "AWSCloudFormationStackSetAdministrationRole_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]
    effect  = "Allow"

    principals {
      identifiers = ["cloudformation.amazonaws.com"]
      type        = "Service"

resource "aws_iam_role" "AWSCloudFormationStackSetAdministrationRole" {
  assume_role_policy = "${data.aws_iam_policy_document.AWSCloudFormationStackSetAdministrationRole_assume_role_policy.json}"
  name               = "AWSCloudFormationStackSetAdministrationRole"

resource "aws_cloudformation_stack_set" "example" {
  administration_role_arn = "${aws_iam_role.AWSCloudFormationStackSetAdministrationRole.arn}"
  name                    = "example"

  parameters = {
    VPCCidr = ""

  template_body = <<TEMPLATE
  "Parameters" : {
    "VPCCidr" : {
      "Type" : "String",
      "Default" : "",
      "Description" : "Enter the CIDR block for the VPC. Default is"
  "Resources" : {
    "myVpc": {
      "Type" : "AWS::EC2::VPC",
      "Properties" : {
        "CidrBlock" : { "Ref" : "VPCCidr" },
        "Tags" : [
          {"Key": "Name", "Value": "Primary_CF_VPC"}

data "aws_iam_policy_document" "AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy" {
  statement {
    actions   = ["sts:AssumeRole"]
    effect    = "Allow"
    resources = ["arn:aws:iam::*:role/${aws_cloudformation_stack_set.example.execution_role_name}"]

resource "aws_iam_role_policy" "AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy" {
  name   = "ExecutionPolicy"
  policy = "${data.aws_iam_policy_document.AWSCloudFormationStackSetAdministrationRole_ExecutionPolicy.json}"
  role   = "${aws_iam_role.AWSCloudFormationStackSetAdministrationRole.name}"

» Argument Reference

The following arguments are supported:

  • administration_role_arn - (Required) Amazon Resource Number (ARN) of the IAM Role in the administrator account.
  • name - (Required) Name of the StackSet. The name must be unique in the region where you create your StackSet. The name can contain only alphanumeric characters (case-sensitive) and hyphens. It must start with an alphabetic character and cannot be longer than 128 characters.
  • capabilities - (Optional) A list of capabilities. Valid values: CAPABILITY_IAM, CAPABILITY_NAMED_IAM, CAPABILITY_AUTO_EXPAND.
  • description - (Optional) Description of the StackSet.
  • execution_role_name - (Optional) Name of the IAM Role in all target accounts for StackSet operations. Defaults to AWSCloudFormationStackSetExecutionRole.
  • parameters - (Optional) Key-value map of input parameters for the StackSet template. All template parameters, including those with a Default, must be configured or ignored with lifecycle configuration block ignore_changes argument. All NoEcho template parameters must be ignored with the lifecycle configuration block ignore_changes argument.
  • tags - (Optional) Key-value map of tags to associate with this StackSet and the Stacks created from it. AWS CloudFormation also propagates these tags to supported resources that are created in the Stacks. A maximum number of 50 tags can be specified.
  • template_body - (Optional) String containing the CloudFormation template body. Maximum size: 51,200 bytes. Conflicts with template_url.
  • template_url - (Optional) String containing the location of a file containing the CloudFormation template body. The URL must point to a template that is located in an Amazon S3 bucket. Maximum location file size: 460,800 bytes. Conflicts with template_body.

» Attributes Reference

In addition to all arguments above, the following attributes are exported:

  • arn - Amazon Resource Name (ARN) of the StackSet.
  • id - Name of the StackSet.
  • stack_set_id - Unique identifier of the StackSet.

» Timeouts

aws_cloudformation_stack_set provides the following Timeouts configuration options:

  • update - (Default 30m) How long to wait for a StackSet to be updated.

» Import

CloudFormation StackSets can be imported using the name, e.g.

$ terraform import aws_cloudformation_stack.example example