[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6F4PDCG3FH9DG5KBFNN25N2":3,"skill-same:01M6F4PDCG3FH9DG5KBFNN25N2":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":32,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":63,"install":64,"resources":77},"01M6F4PDCG3FH9DG5KBFNN25N2","cloudformation",null,"Deploy AWS resources with CloudFormation templates. Create stacks, use nested stacks, and implement drift detection. Use when deploying AWS-native IaC.","boisenoise\u002Fskills-collections","boisenoise","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F193180?v=4","01M6CDBDQK6BDN55ZMA6B6PKBM","01M6CDBDVSJ3JPTBYN26FZ7TZK",12,"MIT","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-cloudformation\u002FSKILL.md",[],[5,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"drift","2026","when","drift detection","with","relevant","helper","native","resources","scripts","critical","os","platform","security","main","community","nested","agent-skills","iac","only","use","access","devops-security","license","create","implement","2026-11-10 10:12:30",false,"---\nname: cloudformation\ndescription: Deploy AWS resources with CloudFormation templates. Create stacks, use\n  nested stacks, and implement drift detection. Use when deploying AWS-native IaC.\ncategory: devops\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant OS\u002Fplatform tooling and privileged access where\n  noted. Docs-only; helper scripts and templates not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# CloudFormation\n\nDeploy AWS infrastructure with native CloudFormation templates, change sets, nested stacks, and drift detection.\n\n## When to Use This Skill\n\n- Deploying AWS resources using AWS-native Infrastructure as Code\n- Creating repeatable, parameterized infrastructure templates\n- Managing multi-environment deployments (dev, staging, prod) with the same template\n- Implementing safe deployments with change sets and rollback protection\n- Detecting and remediating configuration drift\n- Organizing large infrastructure into nested stacks\n- Exporting\u002Fimporting values between stacks\n\n## Prerequisites\n\n- AWS CLI v2 installed and configured\n- Least-privilege CloudFormation actions and a reviewed execution role\u002Fresource permissions scoped to the intended stacks\n- (Optional) `cfn-lint` installed for template validation (`pip install cfn-lint`)\n- S3 bucket for storing templates larger than 51,200 bytes\n\n## Template Structure\n\n```yaml\nAWSTemplateFormatVersion: '2010-09-09'\nDescription: Production web application infrastructure\n\nMetadata:\n  AWS::CloudFormation::Interface:\n    ParameterGroups:\n      - Label: { default: \"Environment\" }\n        Parameters: [Environment, InstanceType]\n      - Label: { default: \"Network\" }\n        Parameters: [VpcId, SubnetIds]\n\nParameters:\n  Environment:\n    Type: String\n    AllowedValues: [dev, staging, prod]\n    Default: dev\n\n  InstanceType:\n    Type: String\n    Default: t3.micro\n    AllowedValues: [t3.micro, t3.small, t3.medium, t3.large]\n\n  AmiId:\n    Type: AWS::EC2::Image::Id\n    Description: Verified region-specific image with the application\u002Fbootstrap prerequisites\n\n  VpcId:\n    Type: AWS::EC2::VPC::Id\n    Description: VPC to deploy into\n\n  SubnetIds:\n    Type: List\u003CAWS::EC2::Subnet::Id>\n    Description: Subnets for the application\n\nConditions:\n  IsProd: !Equals [!Ref Environment, prod]\n  CreateReadReplica: !Equals [!Ref Environment, prod]\n\nResources:\n  SecurityGroup:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: !Sub '${Environment}-web-sg'\n      VpcId: !Ref VpcId\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 443\n          ToPort: 443\n          CidrIp: 0.0.0.0\u002F0\n      Tags:\n        - Key: Name\n          Value: !Sub '${Environment}-web-sg'\n\n  LaunchTemplate:\n    Type: AWS::EC2::LaunchTemplate\n    Properties:\n      LaunchTemplateName: !Sub '${Environment}-web'\n      LaunchTemplateData:\n        ImageId: !Ref AmiId\n        InstanceType: !Ref InstanceType\n        MetadataOptions:\n          HttpTokens: required\n        SecurityGroupIds:\n          - !Ref SecurityGroup\n\n  AutoScalingGroup:\n    Type: AWS::AutoScaling::AutoScalingGroup\n    Properties:\n      AutoScalingGroupName: !Sub '${Environment}-web-asg'\n      LaunchTemplate:\n        LaunchTemplateId: !Ref LaunchTemplate\n        Version: !GetAtt LaunchTemplate.LatestVersionNumber\n      MinSize: !If [IsProd, 2, 1]\n      MaxSize: !If [IsProd, 10, 3]\n      DesiredCapacity: !If [IsProd, 4, 1]\n      VPCZoneIdentifier: !Ref SubnetIds\n      TargetGroupARNs:\n        - !Ref TargetGroup\n      HealthCheckType: ELB\n      HealthCheckGracePeriod: 300\n      Tags:\n        - Key: Name\n          Value: !Sub '${Environment}-web'\n          PropagateAtLaunch: true\n    UpdatePolicy:\n      AutoScalingRollingUpdate:\n        MinInstancesInService: !If [IsProd, 2, 0]\n        MaxBatchSize: 1\n        PauseTime: PT5M\n        WaitOnResourceSignals: false # scaffold has no cfn-signal sender\n        SuspendProcesses:\n          - HealthCheck\n          - ReplaceUnhealthy\n          - AZRebalance\n          - AlarmNotification\n          - ScheduledActions\n\n  TargetGroup:\n    Type: AWS::ElasticLoadBalancingV2::TargetGroup\n    Properties:\n      Name: !Sub '${Environment}-web-tg'\n      Port: 8080\n      Protocol: HTTP\n      VpcId: !Ref VpcId\n      TargetType: instance\n      HealthCheckPath: \u002Fhealth\n      HealthCheckIntervalSeconds: 30\n      HealthyThresholdCount: 2\n      UnhealthyThresholdCount: 3\n\nOutputs:\n  SecurityGroupId:\n    Description: Web security group ID\n    Value: !Ref SecurityGroup\n    Export:\n      Name: !Sub '${Environment}-WebSecurityGroup'\n\n  AutoScalingGroupName:\n    Description: ASG name\n    Value: !Ref AutoScalingGroup\n    Export:\n      Name: !Sub '${Environment}-WebASG'\n```\n\nThe template is an infrastructure scaffold, not a deployable production application: supply a verified region-specific AmiId and bootstrap\u002Flistener, an actual load balancer\u002Flistener and an ingress rule from its security group to target port8080. No cfn-signal sender is bundled, so resource-signal waiting is disabled; implement\u002Ftest signals before enabling it. The nested child templates below are also external prerequisites.\n\n## Stack Operations\n\n```bash\n# Validate a template\naws cloudformation validate-template --template-body file:\u002F\u002Ftemplate.yaml\n\n# Lint with cfn-lint (catches more issues)\ncfn-lint template.yaml\n\n# Create a stack\naws cloudformation create-stack \\\n  --stack-name production-web \\\n  --template-body file:\u002F\u002Ftemplate.yaml \\\n  --parameters \\\n    ParameterKey=Environment,ParameterValue=prod \\\n    ParameterKey=AmiId,ParameterValue=\"$VERIFIED_AMI_ID\" \\\n    ParameterKey=VpcId,ParameterValue=vpc-abc123 \\\n    ParameterKey=SubnetIds,ParameterValue=\"subnet-aaa\\\\,subnet-bbb\" \\\n  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \\\n  --tags Key=Environment,Value=production Key=Team,Value=platform \\\n  --enable-termination-protection \\\n  --on-failure ROLLBACK\n\n# Wait for stack creation\naws cloudformation wait stack-create-complete --stack-name production-web\n\n# Describe stack status and outputs\naws cloudformation describe-stacks \\\n  --stack-name production-web \\\n  --query \"Stacks[0].{Status:StackStatus,Outputs:Outputs}\" \\\n  --output table\n\n# List stack resources\naws cloudformation list-stack-resources --stack-name production-web \\\n  --query \"StackResourceSummaries[].{Logical:LogicalResourceId,Physical:PhysicalResourceId,Type:ResourceType,Status:ResourceStatus}\" \\\n  --output table\n\n# Delete a stack\naws cloudformation delete-stack --stack-name dev-web\naws cloudformation wait stack-delete-complete --stack-name dev-web\n```\n\n## Change Sets (Safe Updates)\n\n```bash\n# Create a change set to preview changes before applying\naws cloudformation create-change-set \\\n  --stack-name production-web \\\n  --change-set-name update-instance-type \\\n  --template-body file:\u002F\u002Ftemplate.yaml \\\n  --parameters \\\n    ParameterKey=Environment,ParameterValue=prod \\\n    ParameterKey=InstanceType,ParameterValue=t3.large \\\n    ParameterKey=VpcId,UsePreviousValue=true \\\n    ParameterKey=SubnetIds,UsePreviousValue=true \\\n    ParameterKey=AmiId,UsePreviousValue=true \\\n  --capabilities CAPABILITY_IAM\n\n# Describe the change set to review planned changes\naws cloudformation describe-change-set \\\n  --stack-name production-web \\\n  --change-set-name update-instance-type \\\n  --query \"Changes[].{Action:ResourceChange.Action,Resource:ResourceChange.LogicalResourceId,Type:ResourceChange.ResourceType,Replacement:ResourceChange.Replacement}\" \\\n  --output table\n\n# Execute the change set (apply changes)\naws cloudformation execute-change-set \\\n  --stack-name production-web \\\n  --change-set-name update-instance-type\n\n# Wait for update\naws cloudformation wait stack-update-complete --stack-name production-web\n\n# Delete a change set without applying\naws cloudformation delete-change-set \\\n  --stack-name production-web \\\n  --change-set-name update-instance-type\n```\n\n## Drift Detection\n\n```bash\n# Start drift detection\nDRIFT_ID=$(aws cloudformation detect-stack-drift \\\n  --stack-name production-web \\\n  --query 'StackDriftDetectionId' --output text)\n\n# Check drift detection status\naws cloudformation describe-stack-drift-detection-status \\\n  --stack-drift-detection-id $DRIFT_ID\n\n# View drifted resources\naws cloudformation describe-stack-resource-drifts \\\n  --stack-name production-web \\\n  --stack-resource-drift-status-filters MODIFIED DELETED \\\n  --query \"StackResourceDrifts[].{Resource:LogicalResourceId,Status:StackResourceDriftStatus,Differences:PropertyDifferences}\" \\\n  --output table\n\n# Detect drift on a specific resource\naws cloudformation detect-stack-resource-drift \\\n  --stack-name production-web \\\n  --logical-resource-id SecurityGroup\n```\n\n## Nested Stacks\n\nParent template:\n\n```yaml\nAWSTemplateFormatVersion: '2010-09-09'\nDescription: Parent stack - full application\n\nParameters:\n  Environment:\n    Type: String\n    AllowedValues: [dev, staging, prod]\n\nResources:\n  NetworkStack:\n    Type: AWS::CloudFormation::Stack\n    Properties:\n      TemplateURL: https:\u002F\u002Fs3.amazonaws.com\u002Fmy-cfn-templates\u002Fnetwork.yaml\n      Parameters:\n        Environment: !Ref Environment\n        VpcCidr: \"10.0.0.0\u002F16\"\n      Tags:\n        - Key: Environment\n          Value: !Ref Environment\n\n  DatabaseStack:\n    Type: AWS::CloudFormation::Stack\n    DependsOn: NetworkStack\n    Properties:\n      TemplateURL: https:\u002F\u002Fs3.amazonaws.com\u002Fmy-cfn-templates\u002Fdatabase.yaml\n      Parameters:\n        Environment: !Ref Environment\n        VpcId: !GetAtt NetworkStack.Outputs.VpcId\n        SubnetIds: !GetAtt NetworkStack.Outputs.PrivateSubnetIds\n\n  AppStack:\n    Type: AWS::CloudFormation::Stack\n    DependsOn: [NetworkStack, DatabaseStack]\n    Properties:\n      TemplateURL: https:\u002F\u002Fs3.amazonaws.com\u002Fmy-cfn-templates\u002Fapp.yaml\n      Parameters:\n        Environment: !Ref Environment\n        VpcId: !GetAtt NetworkStack.Outputs.VpcId\n        SubnetIds: !GetAtt NetworkStack.Outputs.PrivateSubnetIds\n        DbEndpoint: !GetAtt DatabaseStack.Outputs.Endpoint\n\nOutputs:\n  VpcId:\n    Value: !GetAtt NetworkStack.Outputs.VpcId\n  AppUrl:\n    Value: !GetAtt AppStack.Outputs.LoadBalancerDNS\n```\n\n```bash\n# Package nested templates (uploads local references to S3)\naws cloudformation package \\\n  --template-file parent.yaml \\\n  --s3-bucket my-cfn-templates \\\n  --output-template-file packaged.yaml\n\n# Deploy the packaged template\naws cloudformation deploy \\\n  --template-file packaged.yaml \\\n  --stack-name production-app \\\n  --parameter-overrides Environment=prod \\\n  --capabilities CAPABILITY_IAM CAPABILITY_AUTO_EXPAND \\\n  --tags Environment=production\n```\n\n## Intrinsic Functions Reference\n\n```yaml\n# Ref - reference a parameter or resource\nSecurityGroupId: !Ref SecurityGroup\n\n# GetAtt - get an attribute of a resource\nSecurityGroupId: !GetAtt SecurityGroup.GroupId\n\n# Sub - string substitution\nBucketName: !Sub '${Environment}-${AWS::AccountId}-data'\n\n# Join - concatenate strings\nPolicyArn: !Join ['', ['arn:aws:iam::', !Ref 'AWS::AccountId', ':policy\u002FMyPolicy']]\n\n# Select - pick from a list\nFirstSubnet: !Select [0, !Ref SubnetIds]\n\n# Split - split a string\nFirstPart: !Select [0, !Split ['-', !Ref 'AWS::StackName']]\n\n# If - conditional value\nInstanceSize: !If [IsProd, t3.large, t3.micro]\n\n# Equals - condition definition\nConditions:\n  IsProd: !Equals [!Ref Environment, prod]\n\n# ImportValue - cross-stack reference\nVpcId: !ImportValue production-VpcId\n\n# Cidr - generate CIDR blocks\nSubnets: !Cidr [!GetAtt VPC.CidrBlock, 6, 8]\n\n# GetAZs - list availability zones\nAZ: !Select [0, !GetAZs '']\n```\n\n## Stack Policy (Prevent Accidental Replacements)\n\n```bash\n# Apply a stack policy that prevents replacement of the database\naws cloudformation set-stack-policy \\\n  --stack-name production-web \\\n  --stack-policy-body '{\n    \"Statement\": [\n      {\n        \"Effect\": \"Allow\",\n        \"Action\": \"Update:*\",\n        \"Principal\": \"*\",\n        \"Resource\": \"*\"\n      },\n      {\n        \"Effect\": \"Deny\",\n        \"Action\": \"Update:Replace\",\n        \"Principal\": \"*\",\n        \"Resource\": \"LogicalResourceId\u002FDatabase\"\n      },\n      {\n        \"Effect\": \"Deny\",\n        \"Action\": \"Update:Delete\",\n        \"Principal\": \"*\",\n        \"Resource\": \"LogicalResourceId\u002FDatabase\"\n      }\n    ]\n  }'\n```\n\n## Stack Events and Debugging\n\n```bash\n# View stack events (most recent first)\naws cloudformation describe-stack-events \\\n  --stack-name production-web \\\n  --query \"StackEvents[?ResourceStatus=='CREATE_FAILED' || ResourceStatus=='UPDATE_FAILED'].{Time:Timestamp,Resource:LogicalResourceId,Status:ResourceStatus,Reason:ResourceStatusReason}\" \\\n  --output table\n\n# Continue a rollback that is stuck\naws cloudformation continue-update-rollback \\\n  --stack-name production-web \\\n  --resources-to-skip SecurityGroup\n\n# Cancel an in-progress update\naws cloudformation cancel-update-stack --stack-name production-web\n\n# Get template from an existing stack\naws cloudformation get-template \\\n  --stack-name production-web \\\n  --template-stage Processed \\\n  --query TemplateBody \\\n  --output text > current-template.yaml\n```\n\n## Troubleshooting\n\n| Problem | Cause | Fix |\n|---|---|---|\n| CREATE_FAILED on IAM resource | Missing CAPABILITY_IAM | Add `--capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM` |\n| Stack stuck in UPDATE_ROLLBACK_FAILED | Resource cannot be rolled back | Diagnose and repair the failing resource first. Skipping requires an explicit recovery plan because skipped resources may remain inconsistent |\n| Nested stack fails | Template URL wrong or S3 access denied | Use `aws cloudformation package` to upload; check bucket policy |\n| Circular dependency error | Two resources reference each other | Refactor references\u002Fownership to remove the cycle; adding DependsOn does not remove an existing dependency cycle |\n| Drift detected | Manual changes made outside CloudFormation | Review drift and supported properties; a no-op template update may not reconcile drift. Use an approved explicit remediation\u002Fchange set. |\n| Change set shows no changes | Template and parameters identical | Verify the diff; check if the change is parameter-only |\n| Template validation error | YAML syntax or invalid resource property | Run `cfn-lint`; check property names against docs |\n| Export name already exists | Another stack uses the same export name | Use unique export names with `!Sub '${AWS::StackName}-Name'` |\n| Delete fails - resource in use | Dependent resource outside the stack | Remove the dependency first; check for SG references |\n\n## Related Skills\n\n- terraform-aws (`terraform-aws`) - Alternative IaC with Terraform\n- aws-iam (`aws-iam`) - IAM resources in templates\n- aws-vpc (`aws-vpc`) - Network infrastructure templates\n- aws-ec2 (`aws-ec2`) - Compute resources in templates\n- aws-s3 (`aws-s3`) - Storage resources in templates\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n","# CloudFormation\n\nDeploy AWS infrastructure with native CloudFormation templates, change sets, nested stacks, and drift detection.\n\n## When to Use This Skill\n\n- Deploying AWS resources using AWS-native Infrastructure as Code\n- Creating repeatable, parameterized infrastructure templates\n- Managing multi-environment deployments (dev, staging, prod) with the same template\n- Implementing safe deployments with change sets and rollback protection\n- Detecting and remediating configuration drift\n- Organizing large infrastructure into nested stacks\n- Exporting\u002Fimporting values between stacks\n\n## Prerequisites\n\n- AWS CLI v2 installed and configured\n- Least-privilege CloudFormation actions and a reviewed execution role\u002Fresource permissions scoped to the intended stacks\n- (Optional) `cfn-lint` installed for template validation (`pip install cfn-lint`)\n- S3 bucket for storing templates larger than 51,200 bytes\n\n## Template Structure\n\n```yaml\nAWSTemplateFormatVersion: '2010-09-09'\nDescription: Production web application infrastructure\n\nMetadata:\n  AWS::CloudFormation::Interface:\n    ParameterGroups:\n      - Label: { default: \"Environment\" }\n        Parameters: [Environment, InstanceType]\n      - Label: { default: \"Network\" }\n        Parameters: [VpcId, SubnetIds]\n\nParameters:\n  Environment:\n    Type: String\n    AllowedValues: [dev, staging, prod]\n    Default: dev\n\n  InstanceType:\n    Type: String\n    Default: t3.micro\n    AllowedValues: [t3.micro, t3.small, t3.medium, t3.large]\n\n  AmiId:\n    Type: AWS::EC2::Image::Id\n    Description: Verified region-specific image with the application\u002Fbootstrap prerequisites\n\n  VpcId:\n    Type: AWS::EC2::VPC::Id\n    Description: VPC to deploy into\n\n  SubnetIds:\n    Type: List\u003CAWS::EC2::Subnet::Id>\n    Description: Subnets for the application\n\nConditions:\n  IsProd: !Equals [!Ref Environment, prod]\n  CreateReadReplica: !Equals [!Ref Environment, prod]\n\nResources:\n  SecurityGroup:\n    Type: AWS::EC2::SecurityGroup\n    Properties:\n      GroupDescription: !Sub '${Environment}-web-sg'\n      VpcId: !Ref VpcId\n      SecurityGroupIngress:\n        - IpProtocol: tcp\n          FromPort: 443\n          ToPort: 443\n          CidrIp: 0.0.0.0\u002F0\n      Tags:\n        - Key: Name\n          Value: !Sub '${Environment}-web-sg'\n\n  LaunchTemplate:\n    Type: AWS::EC2::LaunchTemplate\n    Properties:\n      LaunchTemplateName: !Sub '${Environment}-web'\n      LaunchTemplateData:\n        ImageId: !Ref AmiId\n        InstanceType: !Ref InstanceType\n        MetadataOptions:\n          HttpTokens: required\n        SecurityGroupIds:\n          - !Ref SecurityGroup\n\n  AutoScalingGroup:\n    Type: AWS::AutoScaling::AutoScalingGroup\n    Properties:\n      AutoScalingGroupName: !Sub '${Environment}-web-asg'\n      LaunchTemplate:\n        LaunchTemplateId: !Ref LaunchTemplate\n        Version: !GetAtt LaunchTemplate.LatestVersionNumber\n      MinSize: !If [IsProd, 2, 1]\n      MaxSize: !If [IsProd, 10, 3]\n      DesiredCapacity: !If [IsProd, 4, 1]\n      VPCZoneIdentifier: !Ref SubnetIds\n      TargetGroupARNs:\n        - !Ref TargetGroup\n      HealthCheckType: ELB\n      HealthCheckGracePeriod: 300\n      Tags:\n        - Key: Name\n          Value: !Sub '${Environment}-web'\n          PropagateAtLaunch: true\n    UpdatePolicy:\n      AutoScalingRollingUpdate:\n        MinInstancesInService: !If [IsProd, 2, 0]\n        MaxBatchSize: 1\n        PauseTime: PT5M\n        WaitOnResourceSignals: false # scaffold has no cfn-signal sender\n        SuspendProcesses:\n          - HealthCheck\n          - ReplaceUnhealthy\n          - AZRebalance\n          - AlarmNotification\n          - ScheduledActions\n\n  TargetGroup:\n    Type: AWS::ElasticLoadBalancingV2::TargetGroup\n    Properties:\n      Name: !Sub '${Environment}-web-tg'\n      Port: 8080\n      Protocol: HTTP\n      VpcId: !Ref VpcId\n      TargetType: instance\n      HealthCheckPath: \u002Fhealth\n      HealthCheckIntervalSeconds: 30\n      HealthyThresholdCount: 2\n      UnhealthyThresholdCount: 3\n\nOutputs:\n  SecurityGroupId:\n    Description: Web security group ID\n    Value: !Ref SecurityGroup\n    Export:\n      Name: !Sub '${Environment}-WebSecurityGroup'\n\n  AutoScalingGroupName:\n    Description: ASG name\n    Value: !Ref AutoScalingGroup\n    Export:\n      Name: !Sub '${Environment}-WebASG'\n```\n\nThe template is an infrastructure scaffold, not a deployable production application: supply a verified region-specific AmiId and bootstrap\u002Flistener, an actual load balancer\u002Flistener and an ingress rule from its security group to target port8080. No cfn-signal sender is bundled, so resource-signal waiting is disabled; implement\u002Ftest signals before enabling it. The nested child templates below are also external prerequisites.\n\n## Stack Operations\n\n```bash\n# Validate a template\naws cloudformation validate-template --template-body file:\u002F\u002Ftemplate.yaml\n\n# Lint with cfn-lint (catches more issues)\ncfn-lint template.yaml\n\n# Create a stack\naws cloudformation create-stack \\\n  --stack-name production-web \\\n  --template-body file:\u002F\u002Ftemplate.yaml \\\n  --parameters \\\n    ParameterKey=Environment,ParameterValue=prod \\\n    ParameterKey=AmiId,ParameterValue=\"$VERIFIED_AMI_ID\" \\\n    ParameterKey=VpcId,ParameterValue=vpc-abc123 \\\n    ParameterKey=SubnetIds,ParameterValue=\"subnet-aaa\\\\,subnet-bbb\" \\\n  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \\\n  --tags Key=Environment,Value=production Key=Team,Value=platform \\\n  --enable-termination-protection \\\n  --on-failure ROLLBACK\n\n# Wait for stack creation\naws cloudformation wait stack-create-complete --stack-name production-web\n\n# Describe stack status and outputs\naws cloudformation describe-stacks \\\n  --stack-name production-web \\\n  --query \"Stacks[0].{Status:StackStatus,Outputs:Outputs}\" \\\n  --output table\n\n# List stack resources\naws cloudformation list-stack-resources --stack-name production-web \\\n  --query \"StackResourceSummaries[].{Logical:LogicalResourceId,Physical:PhysicalResourceId,Type:ResourceType,Status:ResourceStatus}\" \\\n  --output table\n\n# Delete a stack\naws cloudformation delete-stack --stack-name dev-web\naws cloudformation wait stack-delete-complete --stack-name dev-web\n```\n\n## Change Sets (Safe Updates)\n\n```bash\n# Create a change set to preview changes before applying\naws cloudformation create-change-set \\\n  --stack-name production-web \\\n  --change-set-name update-instance-type \\\n  --template-body file:\u002F\u002Ftemplate.yaml \\\n  --parameters \\\n    ParameterKey=Environment,ParameterValue=prod \\\n    ParameterKey=InstanceType,ParameterValue=t3.large \\\n    ParameterKey=VpcId,UsePreviousValue=true \\\n    ParameterKey=SubnetIds,UsePreviousValue=true \\\n    ParameterKey=AmiId,UsePreviousValue=true \\\n  --capabilities CAPABILITY_IAM\n\n# Describe the change set to review planned changes\naws cloudformation describe-change-set \\\n  --stack-name production-web \\\n  --change-set-name update-instance-type \\\n  --query \"Changes[].{Action:ResourceChange.Action,Resource:ResourceChange.LogicalResourceId,Type:ResourceChange.ResourceType,Replacement:ResourceChange.Replacement}\" \\\n  --output table\n\n# Execute the change set (apply changes)\naws cloudformation execute-change-set \\\n  --stack-name production-web \\\n  --change-set-name update-instance-type\n\n# Wait for update\naws cloudformation wait stack-update-complete --stack-name production-web\n\n# Delete a change set without applying\naws cloudformation delete-change-set \\\n  --stack-name production-web \\\n  --change-set-name update-instance-type\n```\n\n## Drift Detection\n\n```bash\n# Start drift detection\nDRIFT_ID=$(aws cloudformation detect-stack-drift \\\n  --stack-name production-web \\\n  --query 'StackDriftDetectionId' --output text)\n\n# Check drift detection status\naws cloudformation describe-stack-drift-detection-status \\\n  --stack-drift-detection-id $DRIFT_ID\n\n# View drifted resources\naws cloudformation describe-stack-resource-drifts \\\n  --stack-name production-web \\\n  --stack-resource-drift-status-filters MODIFIED DELETED \\\n  --query \"StackResourceDrifts[].{Resource:LogicalResourceId,Status:StackResourceDriftStatus,Differences:PropertyDifferences}\" \\\n  --output table\n\n# Detect drift on a specific resource\naws cloudformation detect-stack-resource-drift \\\n  --stack-name production-web \\\n  --logical-resource-id SecurityGroup\n```\n\n## Nested Stacks\n\nParent template:\n\n```yaml\nAWSTemplateFormatVersion: '2010-09-09'\nDescription: Parent stack - full application\n\nParameters:\n  Environment:\n    Type: String\n    AllowedValues: [dev, staging, prod]\n\nResources:\n  NetworkStack:\n    Type: AWS::CloudFormation::Stack\n    Properties:\n      TemplateURL: https:\u002F\u002Fs3.amazonaws.com\u002Fmy-cfn-templates\u002Fnetwork.yaml\n      Parameters:\n        Environment: !Ref Environment\n        VpcCidr: \"10.0.0.0\u002F16\"\n      Tags:\n        - Key: Environment\n          Value: !Ref Environment\n\n  DatabaseStack:\n    Type: AWS::CloudFormation::Stack\n    DependsOn: NetworkStack\n    Properties:\n      TemplateURL: https:\u002F\u002Fs3.amazonaws.com\u002Fmy-cfn-templates\u002Fdatabase.yaml\n      Parameters:\n        Environment: !Ref Environment\n        VpcId: !GetAtt NetworkStack.Outputs.VpcId\n        SubnetIds: !GetAtt NetworkStack.Outputs.PrivateSubnetIds\n\n  AppStack:\n    Type: AWS::CloudFormation::Stack\n    DependsOn: [NetworkStack, DatabaseStack]\n    Properties:\n      TemplateURL: https:\u002F\u002Fs3.amazonaws.com\u002Fmy-cfn-templates\u002Fapp.yaml\n      Parameters:\n        Environment: !Ref Environment\n        VpcId: !GetAtt NetworkStack.Outputs.VpcId\n        SubnetIds: !GetAtt NetworkStack.Outputs.PrivateSubnetIds\n        DbEndpoint: !GetAtt DatabaseStack.Outputs.Endpoint\n\nOutputs:\n  VpcId:\n    Value: !GetAtt NetworkStack.Outputs.VpcId\n  AppUrl:\n    Value: !GetAtt AppStack.Outputs.LoadBalancerDNS\n```\n\n```bash\n# Package nested templates (uploads local references to S3)\naws cloudformation package \\\n  --template-file parent.yaml \\\n  --s3-bucket my-cfn-templates \\\n  --output-template-file packaged.yaml\n\n# Deploy the packaged template\naws cloudformation deploy \\\n  --template-file packaged.yaml \\\n  --stack-name production-app \\\n  --parameter-overrides Environment=prod \\\n  --capabilities CAPABILITY_IAM CAPABILITY_AUTO_EXPAND \\\n  --tags Environment=production\n```\n\n## Intrinsic Functions Reference\n\n```yaml\n# Ref - reference a parameter or resource\nSecurityGroupId: !Ref SecurityGroup\n\n# GetAtt - get an attribute of a resource\nSecurityGroupId: !GetAtt SecurityGroup.GroupId\n\n# Sub - string substitution\nBucketName: !Sub '${Environment}-${AWS::AccountId}-data'\n\n# Join - concatenate strings\nPolicyArn: !Join ['', ['arn:aws:iam::', !Ref 'AWS::AccountId', ':policy\u002FMyPolicy']]\n\n# Select - pick from a list\nFirstSubnet: !Select [0, !Ref SubnetIds]\n\n# Split - split a string\nFirstPart: !Select [0, !Split ['-', !Ref 'AWS::StackName']]\n\n# If - conditional value\nInstanceSize: !If [IsProd, t3.large, t3.micro]\n\n# Equals - condition definition\nConditions:\n  IsProd: !Equals [!Ref Environment, prod]\n\n# ImportValue - cross-stack reference\nVpcId: !ImportValue production-VpcId\n\n# Cidr - generate CIDR blocks\nSubnets: !Cidr [!GetAtt VPC.CidrBlock, 6, 8]\n\n# GetAZs - list availability zones\nAZ: !Select [0, !GetAZs '']\n```\n\n## Stack Policy (Prevent Accidental Replacements)\n\n```bash\n# Apply a stack policy that prevents replacement of the database\naws cloudformation set-stack-policy \\\n  --stack-name production-web \\\n  --stack-policy-body '{\n    \"Statement\": [\n      {\n        \"Effect\": \"Allow\",\n        \"Action\": \"Update:*\",\n        \"Principal\": \"*\",\n        \"Resource\": \"*\"\n      },\n      {\n        \"Effect\": \"Deny\",\n        \"Action\": \"Update:Replace\",\n        \"Principal\": \"*\",\n        \"Resource\": \"LogicalResourceId\u002FDatabase\"\n      },\n      {\n        \"Effect\": \"Deny\",\n        \"Action\": \"Update:Delete\",\n        \"Principal\": \"*\",\n        \"Resource\": \"LogicalResourceId\u002FDatabase\"\n      }\n    ]\n  }'\n```\n\n## Stack Events and Debugging\n\n```bash\n# View stack events (most recent first)\naws cloudformation describe-stack-events \\\n  --stack-name production-web \\\n  --query \"StackEvents[?ResourceStatus=='CREATE_FAILED' || ResourceStatus=='UPDATE_FAILED'].{Time:Timestamp,Resource:LogicalResourceId,Status:ResourceStatus,Reason:ResourceStatusReason}\" \\\n  --output table\n\n# Continue a rollback that is stuck\naws cloudformation continue-update-rollback \\\n  --stack-name production-web \\\n  --resources-to-skip SecurityGroup\n\n# Cancel an in-progress update\naws cloudformation cancel-update-stack --stack-name production-web\n\n# Get template from an existing stack\naws cloudformation get-template \\\n  --stack-name production-web \\\n  --template-stage Processed \\\n  --query TemplateBody \\\n  --output text > current-template.yaml\n```\n\n## Troubleshooting\n\n| Problem | Cause | Fix |\n|---|---|---|\n| CREATE_FAILED on IAM resource | Missing CAPABILITY_IAM | Add `--capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM` |\n| Stack stuck in UPDATE_ROLLBACK_FAILED | Resource cannot be rolled back | Diagnose and repair the failing resource first. Skipping requires an explicit recovery plan because skipped resources may remain inconsistent |\n| Nested stack fails | Template URL wrong or S3 access denied | Use `aws cloudformation package` to upload; check bucket policy |\n| Circular dependency error | Two resources reference each other | Refactor references\u002Fownership to remove the cycle; adding DependsOn does not remove an existing dependency cycle |\n| Drift detected | Manual changes made outside CloudFormation | Review drift and supported properties; a no-op template update may not reconcile drift. Use an approved explicit remediation\u002Fchange set. |\n| Change set shows no changes | Template and parameters identical | Verify the diff; check if the change is parameter-only |\n| Template validation error | YAML syntax or invalid resource property | Run `cfn-lint`; check property names against docs |\n| Export name already exists | Another stack uses the same export name | Use unique export names with `!Sub '${AWS::StackName}-Name'` |\n| Delete fails - resource in use | Dependent resource outside the stack | Remove the dependency first; check for SG references |\n\n## Related Skills\n\n- terraform-aws (`terraform-aws`) - Alternative IaC with Terraform\n- aws-iam (`aws-iam`) - IAM resources in templates\n- aws-vpc (`aws-vpc`) - Network infrastructure templates\n- aws-ec2 (`aws-ec2`) - Compute resources in templates\n- aws-s3 (`aws-s3`) - Storage resources in templates\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n",{"name":5,"risk":28,"source":49,"license":14,"category":50,"metadata":51,"date_added":54,"description":7,"source_repo":55,"source_type":33,"compatibility":56,"license_source":57},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","devops",{"author":52,"version":53},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant OS\u002Fplatform tooling and privileged access where noted. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","7bf2279c8a65758319526a721d5c4b75683aec9c","skills\u002Fantigravity-cloudformation",3,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections","https:\u002F\u002Fgithub.com\u002Fboisenoise","2026-11-11 14:20:43",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add boisenoise\u002Fskills-collections --skill cloudformation",{"tool":70,"command":71},"bunx","bunx skills add boisenoise\u002Fskills-collections --skill cloudformation",{"tool":73,"command":74},"pnpm","pnpm dlx skills add boisenoise\u002Fskills-collections --skill cloudformation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-cloudformation\u002FSKILL.md",true,[],[79,103,128,154,173,195],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":83,"licenseFileUrl":84,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":44},"01M6WNH92BHVFXHGPDZCPJ0AG0","web-access","Use Treg for public web or platform data only when existing search, browser and connected tools cannot cover the task, with explicit cost and data boundaries.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-web-access\u002FSKILL.md",[],[88,39,89,90,91,92,93,94,95,96,97,37,98,99,30,28,100,101,102,20,19],"web","web access","official","development","browser","search","data","Tools","read","fetch","youtube","free tools","free","cover","normal",{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":83,"licenseFileUrl":107,"sourceHtmlUrl":108,"categories":109,"keywords":115,"publishedAt":44},"01M6WNF9XAYAB2CZDDJBAKNM93","treg","Use the Treg CLI or MCP catalog to discover, price and call authorized external tools with team-scoped credentials and a user-approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-treg\u002FSKILL.md",[110],{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[105,116,117,118,90,91,41,95,119,120,121,122,38,123,124,28,125,22,126,127,19],"MCP","cli","github","Budget","credentials","team","catalog","call","discover","external tools","scoped","blob",{"skillNo":129,"name":130,"nameZh":6,"description":131,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":83,"licenseFileUrl":132,"sourceHtmlUrl":133,"categories":134,"keywords":140,"publishedAt":44},"01M6WN93MEAZ4E41DYAHJRPHQT","recruit","Turn a job description into an evidence-linked candidate shortlist through Treg, with job-related ranking and optional authorized business contact enrichment.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-recruit\u002FSKILL.md",[135],{"categoryNo":136,"categoryName":137,"taxonomyType":138,"taxonomyTypeDesc":139},"01JBSEEDCAT000000000000038","人力资源","PROFESSION","适用职业",[130,118,90,41,141,142,143,144,145,146,28,147,148,149,22,150,151,152,153,127,105,19],"https","email","enrichment","business","evidence","phone","ranking","post","job description","for","person","candidate","reason",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":83,"licenseFileUrl":158,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":44},"01M6WN8R5RXSMHM9B4D9FAFX42","rea-growth","Analyze a company’s public growth and content through Treg, distinguish observations from hypotheses, and produce an evidence-linked playbook within an approved budget.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-rea-growth\u002FSKILL.md",[],[162,163,164,118,90,41,165,166,141,167,119,168,169,170,145,28,171,172,127,105,19],"growth","rea","rea growth","produce","content","playbook","marketing","analyze","public","observations","company",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":83,"licenseFileUrl":177,"sourceHtmlUrl":178,"categories":179,"keywords":180,"publishedAt":44},"01M6WN2EVE3RQRGWAKBT4S7YT2","make-ugc","Create original AI UGC-style product videos through Treg: research hooks, approve a licensed presenter and voice, generate clips, add captions and report costs.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-make-ugc\u002FSKILL.md",[],[181,182,118,183,90,42,41,184,185,186,187,188,28,189,190,191,192,193,194,127],"make","make ugc","research","Video","Captions","ads","short","hooks","head","style","niche","trending","talking-head","approve",{"skillNo":196,"name":197,"nameZh":6,"description":198,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":83,"licenseFileUrl":199,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":44},"01M6WN10ARAA63Y8K1YNGXJ2RM","lead-signals","Find and qualify public buying signals through Treg, rank fitting business accounts and optionally enrich authorized business contact information.","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-lead-signals\u002FSKILL.md",[],[203,204,205,118,90,41,206,207,144,208,209,28,210,211,212,213,214,215,216,127],"signals","lead","lead signals","how","find","ready","as","how to","qualify","people","information","enrich","changes","funding"]