Glossary

Terms used across this site, defined once.

Activation — Enabling a third-party resource type in one account and one region. Activation is not global; a type must be activated in every region where a stack uses it.

Alias record — A Route 53 record that points at an AWS resource and is resolved inside Route 53, returning addresses rather than a name. Unlike a CNAME it is legal at a zone apex and is not billed per query.

Attribute — A value a resource exposes through Fn::GetAtt. Attributes are read-only and are computed by the resource, not set in the template.

Change set — A preview of what a stack update will do, including which resources will be replaced. The only reliable way to find out before executing.

Conditional requirement — A property that is required in some circumstances and not others. Marked Conditional in the explorer, with the circumstance stated in its detail panel.

Create-only property — A property that can be set at creation and never changed. Changing it replaces the resource.

Drift — Divergence between a stack’s recorded state and the real configuration of its resources, usually caused by a change made outside CloudFormation. Write-only properties are invisible to drift detection.

Dynamic reference — Template syntax ({{resolve:ssm:/name:version}}) that resolves a value from Parameter Store or Secrets Manager at deploy time, without a template parameter.

Execution role — The IAM role a resource type’s handlers assume when they call AWS APIs. Distinct from the role deploying the stack, and the reason each resource page documents the actions its handlers need.

Logical ID — The name a resource has inside a template. Stable across updates; changing it removes one resource and creates another.

Permissions boundary — A managed policy that caps the maximum permissions an identity can have. It grants nothing; effective permissions are the intersection of the boundary and the identity’s policies.

Physical ID — The identifier the underlying service assigns to a resource — a bucket name, an instance ID, a role name. Changes when a resource is replaced, which is what breaks external references.

Replacement — CloudFormation creating a new resource and deleting the old one in response to a property change. See update behaviour .

Resource type — The AWS::S3::Bucket style identifier naming what a resource is. Third-party types such as Updraft::Config::Document follow the same three-part form.

Write-only property — A property accepted on write and never returned. Invisible to describe calls and to drift detection; typically a credential.