Using the AWS CloudFormation registry

The CloudFormation registry lists the resources, both private and public (AWS), that are available for use in your CloudFormation account.

Private and public resource providers

Private resource providers are those resource providers that you have explicitly registered for use in your AWS account. These may be resource providers you've created yourself, as well as ones shared with you. You can use the CloudFormation CLI, an open-source tool for resource management, to create private resource providers. For more information, see the CloudFormation Command Line Interface User Guide.

Public resource providers are those provided by AWS to manage specific AWS service resources. While the registry lists AWS resources implemented using the open-source resource provider framework, all the resources included in the Resource and Property Types Reference are available for use in your CloudFormation account.

Registering resource providers in CloudFormation

To use private resource providers--either ones you develop yourself, or providers shared with you--you must first register them with CloudFormation, in the accounts and regions in which you want to use them. Once you're registered a resource provider, it will appear in the CloudFormation registry for that account and region, and you can use it in your stack templates.

You can register a resource provider using the register-type command of the AWS CLI, or using the submit command of the CloudFormation CLI. To register a resource provider using the CloudFormation CLI, see Registering Resource Providers in the CloudFormation CLI User Guide.

IAM permissions for registering a resource provider

As part of registering a resource provider, you specify an S3 bucket which contains the schema handler package. This package contains the schema, event handlers, and associated files for the resource provider you want to register. CloudFormation requires the following IAM permissions in order to access this S3 bucket and the schema handler package. (This is true whether you're either using the register-type command of the AWS CLI, or the submit command of the CloudFormation CLI.)

Make sure you grant the cloudformation.amazonaws.com service these permissions for the appropriate S3 bucket before you attempt to register the resource provider. For example:

  ArtifactCopyPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref ArtifactBucket
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: Allow CloudFormation to copy artifacts from the bucket
            Effect: Allow
            Principal:
              Service: cloudformation.amazonaws.com
            Action:
              - s3:ListBucket
              - s3:GetObject
            Resource:
              - !Sub "arn:${AWS::Partition}:s3:::${ArtifactBucket}"
              - !Sub "arn:${AWS::Partition}:s3:::${ArtifactBucket}/*"

For more information, see Actions, Resources, and Condition Keys for Amazon S3 in the AWS Identity and Access Management User Guide.

In addition, both the execution role and the logging role you specify when registering the resource provider must specify a trust relationship that allows the CloudFormation service principal to assume that role. For example:

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "resources.cloudformation.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  }

For more information, see Creating a Role to Delegate Permissions to an AWS Service in the AWS Identity and Access Management User Guide.

Specifying which version of a resource provider to use

Over time, you may register multiple versions of the same resource provider. You can specify which version of the resource provider you want to use for CloudFormation operations.

Viewing registered resource providers in CloudFormation

Once you've registered a resource provider in an account, you can view the details of that resource provider in the CloudFormation console. Private resource providers are displayed in the Private section of the CloudFormation registry.

Record resource types in AWS Config

You can specify that AWS Config automatically track your private resource types and record changes to those resources as configuration items. This enables you to view configuration history for these private resource types, as well as write Config rules to verify configuration best practices.

To have AWS Config automatically track your private resource types:

For more information on configuration items, see Configuration items in the AWS Config Developer Guide.