Updraft ExtensionsPreview

Getting started

Activate the Updraft extensions in an account, then read a value out of a configuration file from a template — in about ten minutes.

What you are installing #

Updraft Extensions are third-party resource types in the CloudFormation registry. They are not macros, not AWS::CloudFormation::CustomResource Lambdas, and not a CLI wrapper. CloudFormation treats them like any other resource type: they appear in change sets, they participate in rollback, and they have create, read, update and delete handlers with real drift detection.

The practical consequences:

  • Activation is per account and per region. A type activated in us-west-2 is not available in eu-west-1.
  • Each type runs under an execution role you control, so its permissions are visible and auditable.
  • Versions are pinned per activation, and upgrades are deliberate.

1. Activate the types #

aws cloudformation activate-type \
  --type RESOURCE \
  --type-name Updraft::Config::Document \
  --publisher-id 6f4a1b2c8d3e5f7a9b0c1d2e3f4a5b6c7d8e9f01 \
  --execution-role-arn arn:aws:iam::123456789012:role/UpdraftExtensionExecution \
  --region us-west-2

Repeat per type and per region, or use the activation stack:

aws cloudformation deploy \
  --stack-name updraft-extensions \
  --template-url https://updraft-extensions-public.s3.amazonaws.com/activate/v1.2.yaml \
  --capabilities CAPABILITY_IAM \
  --region us-west-2

2. Confirm it is available #

aws cloudformation describe-type \
  --type RESOURCE \
  --type-name Updraft::Config::Document \
  --query '{Status:DeprecatedStatus,Version:DefaultVersionId,Arn:Arn}'

3. Read something #

Put a file in S3:

# s3://my-config-bucket/demo.yaml
retention:
  days: 45

Then a template that reads it:

Resources:
  DemoConfig:
    Type: Updraft::Config::Document
    Properties:
      Source:
        Bucket: my-config-bucket
        Key: demo.yaml
        ExpectedOwner: !Ref AWS::AccountId

  RetentionDays:
    Type: Updraft::Config::Lookup
    Properties:
      Document: !Ref DemoConfig
      Path: /retention/days
      Type: Number

Outputs:
  Retention:
    Value: !Ref RetentionDays
  Checksum:
    Value: !GetAtt DemoConfig.Checksum

Deploy it, and:

!Ref RetentionDays → 45

4. Grant the execution role access #

The document handler reads from S3, so its execution role needs to. Every resource page lists the exact actions — the ones for Updraft::Config::Document are:

- Effect: Allow
  Action:
    - s3:GetObject
    - s3:GetObjectVersion
    - s3:ListBucket
  Resource:
    - arn:aws:s3:::my-config-bucket
    - arn:aws:s3:::my-config-bucket/*

Where to go next #