CloudFormation engine

MiniStack ships its own CloudFormation engine — not a template-to-SDK translator. Templates are parsed, intrinsics are evaluated, and resources are provisioned by calling each service's internal create-path directly. This page is the reference for what the engine supports.

135 resource types 16 intrinsics change sets cross-stack exports

Stack lifecycle

Stacks move through the standard CloudFormation states. Operations are asynchronous, as on AWS: CreateStack / UpdateStack / DeleteStack return immediately with the stack in *_IN_PROGRESS, and provisioning completes on a background task — poll DescribeStacks (or use your SDK's waiters) for the terminal state.

Transition	States visited
Create	`CREATE_IN_PROGRESS` → `CREATE_COMPLETE` / `CREATE_FAILED` / `ROLLBACK_COMPLETE`
Update	`UPDATE_IN_PROGRESS` → `UPDATE_COMPLETE` / `UPDATE_FAILED` / `UPDATE_ROLLBACK_COMPLETE`
Delete	`DELETE_IN_PROGRESS` → `DELETE_COMPLETE` / `DELETE_FAILED`

Resources are provisioned in dependency order (parameters → conditions → resources by DependsOn / Ref / Fn::GetAtt edges). On failure, provisioned resources are rolled back in reverse order.

Stack events are emitted per resource transition and retrievable via DescribeStackEvents.

Intrinsics

All 16 CloudFormation intrinsics plus the standard pseudo-parameters are supported. Evaluation is recursive and order-independent within a template.

Intrinsic	Notes
`Ref`	Parameters → default/override; resources → physical ID.
`Fn::GetAtt`	Scalar `Resource.Attribute` or list form. Split on first dot for nested attrs.
`Fn::Sub`	`${Var}` and `${Resource.Attr}` substitution, including explicit variable map.
`Fn::Join`	Delimiter + list.
`Fn::Split`	Delimiter split into a list.
`Fn::Select`	Zero-indexed element from a list.
`Fn::FindInMap`	Three-level Mappings lookup.
`Fn::If` / `Fn::Equals` / `Fn::And` / `Fn::Or` / `Fn::Not`	Full conditional evaluation. Resources/outputs can be gated by a `Condition`.
`Fn::Base64`	UTF-8 → base64.
`Fn::Cidr`	CIDR subnet calculator.
`Fn::GetAZs`	Returns three pseudo-AZs per region (`a`, `b`, `c`).
`Fn::ImportValue`	Cross-stack import (by `Outputs[].Export.Name`).
`Fn::GetStackOutput`	MiniStack extension (not an AWS intrinsic): cross-stack output lookup emitted by `aws-cdk-local`.

Pseudo-parameters

AWS::Region — from the caller's SigV4 scope; not a server-wide value.
AWS::AccountId — from the request's account.
AWS::StackName, AWS::StackId — from the stack being provisioned.
AWS::Partition — hardcoded to aws.
AWS::URLSuffix — hardcoded to amazonaws.com.
AWS::NotificationARNs — resolves to an empty list; SNS notifications are not dispatched.
AWS::NoValue — drops properties at substitution time.

Resource types

135 resource types across 41 AWS services. Each type has a provisioner in ministack/services/cloudformation/provisioners.py that knows how to call the target service's internal create/update/delete.

Compute & containers

AWS::Lambda::Function AWS::Lambda::Version AWS::Lambda::Alias AWS::Lambda::Permission AWS::Lambda::LayerVersion AWS::Lambda::EventSourceMapping AWS::Lambda::EventInvokeConfig AWS::Lambda::Url AWS::Lambda::LayerVersionPermission AWS::ECS::Cluster AWS::ECS::TaskDefinition AWS::ECS::Service AWS::EC2::LaunchTemplate AWS::EKS::Cluster AWS::EKS::Nodegroup AWS::AutoScaling::AutoScalingGroup AWS::AutoScaling::LaunchConfiguration AWS::AutoScaling::ScalingPolicy AWS::AutoScaling::LifecycleHook AWS::AutoScaling::ScheduledAction

Networking

AWS::EC2::VPC AWS::EC2::Subnet AWS::EC2::SecurityGroup AWS::EC2::InternetGateway AWS::EC2::VPCGatewayAttachment AWS::EC2::RouteTable AWS::EC2::Route AWS::EC2::SubnetRouteTableAssociation AWS::EC2::VPCEndpoint AWS::ElasticLoadBalancingV2::LoadBalancer AWS::ElasticLoadBalancingV2::Listener AWS::ElasticLoadBalancingV2::ListenerRule AWS::ElasticLoadBalancingV2::TargetGroup AWS::Route53::HostedZone AWS::Route53::RecordSet AWS::CloudFront::Distribution AWS::CloudFront::KeyValueStore AWS::CloudFront::CloudFrontOriginAccessIdentity AWS::CertificateManager::Certificate

Storage & data

AWS::S3::Bucket AWS::S3::BucketPolicy AWS::S3Tables::TableBucket AWS::S3Tables::Namespace AWS::S3Tables::Table AWS::DynamoDB::Table AWS::DynamoDB::GlobalTable AWS::RDS::DBCluster AWS::RDS::DBInstance AWS::Kinesis::Stream AWS::KinesisFirehose::DeliveryStream AWS::ECR::Repository AWS::OpenSearchService::Domain

Messaging & events

AWS::SQS::Queue AWS::SQS::QueuePolicy AWS::SNS::Topic AWS::SNS::Subscription AWS::SNS::TopicPolicy AWS::Events::EventBus AWS::Events::Rule AWS::StepFunctions::StateMachine AWS::Pipes::Pipe AWS::Scheduler::Schedule AWS::Scheduler::ScheduleGroup AWS::IoT::TopicRule AWS::IoT::Policy AWS::IoT::ThingType AWS::IoT::CACertificate AWS::IoT::ProvisioningTemplate

APIs

AWS::ApiGateway::RestApi AWS::ApiGateway::Resource AWS::ApiGateway::Method AWS::ApiGateway::Model AWS::ApiGateway::Deployment AWS::ApiGateway::Stage AWS::ApiGateway::Authorizer AWS::ApiGateway::Account AWS::ApiGateway::GatewayResponse AWS::ApiGateway::DomainName AWS::ApiGateway::BasePathMapping AWS::ApiGateway::DocumentationPart AWS::ApiGateway::DocumentationVersion AWS::ApiGateway::RequestValidator AWS::ApiGateway::ApiKey AWS::ApiGateway::UsagePlan AWS::ApiGateway::UsagePlanKey AWS::ApiGatewayV2::Api AWS::ApiGatewayV2::Stage AWS::ApiGatewayV2::Integration AWS::ApiGatewayV2::Route AWS::ApiGatewayV2::Authorizer AWS::AppSync::GraphQLApi AWS::AppSync::GraphQLSchema AWS::AppSync::DataSource AWS::AppSync::FunctionConfiguration AWS::AppSync::Resolver AWS::AppSync::ApiKey

Security, identity, logging & config

AWS::IAM::Role AWS::IAM::Policy AWS::IAM::ManagedPolicy AWS::IAM::InstanceProfile AWS::KMS::Key AWS::KMS::Alias AWS::SecretsManager::Secret AWS::Cognito::UserPool AWS::Cognito::UserPoolClient AWS::Cognito::UserPoolDomain AWS::Cognito::UserPoolGroup AWS::Cognito::UserPoolResourceServer AWS::Cognito::IdentityPool AWS::Cognito::IdentityPoolRoleAttachment AWS::Cognito::IdentityPoolPrincipalTag AWS::Logs::LogGroup AWS::Logs::SubscriptionFilter AWS::Logs::ResourcePolicy AWS::CloudWatch::Alarm AWS::CloudWatch::Dashboard AWS::WAFv2::WebACL AWS::SES::EmailIdentity AWS::SES::ConfigurationSet AWS::SES::ConfigurationSetEventDestination AWS::CodeBuild::Project AWS::SSM::Parameter AWS::AppConfig::Application AWS::AppConfig::Environment AWS::AppConfig::ConfigurationProfile AWS::AppConfig::HostedConfigurationVersion AWS::AppConfig::DeploymentStrategy AWS::AppConfig::Deployment AWS::Backup::BackupPlan AWS::Backup::BackupVault

Utility

AWS::CloudFormation::Stack AWS::CloudFormation::CustomResource AWS::CloudFormation::WaitCondition AWS::CloudFormation::WaitConditionHandle AWS::CDK::Metadata

Nested stacks are supported: AWS::CloudFormation::Stack fetches the child template from TemplateURL and provisions it in-process. Any resource type not in this list fails stack creation with UnsupportedResource. File an issue if you need one added — many are a few hours of work.

Change sets

CreateChangeSet, DescribeChangeSet, ExecuteChangeSet, DeleteChangeSet, and ListChangeSets are fully wired. The engine diffs the current stack against the proposed template and emits a set of ResourceChange entries — your IaC tool can preview before applying.

Outputs & exports

Outputs are computed after all resources settle. Outputs[].Export.Name publishes a value into a global export table that downstream stacks import with Fn::ImportValue. ListExports works as expected (ListImports is not implemented).

Gaps

Stack policies are not implemented. SetStackPolicy / GetStackPolicy return InvalidAction.
Termination protection is not implemented. UpdateTerminationProtection returns InvalidAction; DeleteStack always proceeds.
Drift detection is not implemented. DetectStackDrift and the other drift operations return InvalidAction.
StackSets are not implemented. No *StackSet / *StackInstances operations.
SNS notifications are not dispatched. CreateStack's NotificationARNs parameter is ignored, and the pseudo-parameter resolves to an empty list.
Third-party resource types / modules — not supported. (Custom::* resources are supported and invoke their Lambda-backed handler.)

Inspecting unsupported resources: when a stack fails with UnsupportedResource, the event includes the type name. Cross-reference against the lists above to know if it's a gap or a typo.