AWS CloudFormation 2026-08-31

Apply this documentation scope to processed templates, providers, effective deployment identities, and resources in every target account/Region. CloudFormation is continuously delivered, without customer-selected runtimes. AWSTemplateFormatVersion: '2010-09-09' selects syntax, never service/provider/transform versions.

Deployment authority

• Treat template, parameter, nested-stack, macro, module, custom-resource, hook, role, pipeline writes as deployment authority.
• Deploy reviewed immutable root templates, nested TemplateURL, AWS::Include, provider code. Use supported S3 versions or immutable keys; deny consumer overwrites, retain rollback artifacts.
• Bind approval to artifacts, parameters, change sets, accounts, Regions, roles, capabilities, notification destinations, failure options. Use short-lived credentials; separate production accounts/roles/artifacts/secrets from development.
• Protect Git sync repositories, branches, templates, deployment files, CodeConnections, sync config. Watched-file commits can deploy automatically; require review before deployment-branch commits.

IAM and roles

• Give explicit service roles only needed create/update/delete/rollback actions. Otherwise CloudFormation derives sessions from caller credentials. Attached roles can be replaced, never removed.
• Restrict stack operators as carefully as role passers: later operators use attached roles without iam:PassRole. Prevent identities/templates modifying their own role policies, trust, boundaries.
• Limit iam:PassRole to approved ARNs/services with iam:PassedToService.