Skip to content
You're viewing an older version of this GitHub Action. Do you want to see the latest version instead?
aws-actions

GitHub Action

AWS CloudFormation "Deploy CloudFormation Stack" Action for GitHub Actions

v1.0.3

AWS CloudFormation "Deploy CloudFormation Stack" Action for GitHub Actions

aws-actions

AWS CloudFormation "Deploy CloudFormation Stack" Action for GitHub Actions

Deploys a AWS CloudFormation stack

Installation

Copy and paste the following snippet into your .yml file.

              

- name: AWS CloudFormation "Deploy CloudFormation Stack" Action for GitHub Actions

uses: aws-actions/[email protected]

Learn more about this action in aws-actions/aws-cloudformation-github-deploy

Choose a version

AWS CloudFormation "Deploy CloudFormation Stack" Action for GitHub Actions

Package License: MIT

Deploys AWS CloudFormation Stacks.

Usage

- name: Deploy to AWS CloudFormation
  uses: aws-actions/aws-cloudformation-github-deploy@v1
  with:
    name: MyStack
    template: myStack.yaml
    parameter-overrides: "MyParam1=myValue,MyParam2=${{ secrets.MY_SECRET_VALUE }}"

The action can be passed a CloudFormation Stack name and a template file. It will create the Stack if it does not exist, or create a Change Set to update the Stack. An update fails by default when the Change Set is empty. Setting no-fail-on-empty-changeset: "1" will override this behavior and not throw an error.

See action.yml for the full documentation for this action's inputs and outputs.

You can learn more about AWS CloudFormation

Credentials and Region

This action relies on the default behavior of the AWS SDK for Javascript to determine AWS credentials and region. Use the aws-actions/configure-aws-credentials action to configure the GitHub Actions environment with environment variables containing AWS credentials and your desired region.

We recommend following Amazon IAM best practices for the AWS credentials used in GitHub Actions workflows, including:

  • Do not store credentials in your repository's code. You may use GitHub Actions secrets to store credentials and redact credentials from GitHub Actions workflow logs.
  • Create an individual IAM user with an access key for use in GitHub Actions workflows, preferably one per repository. Do not use the AWS account root user access key.
  • Grant least privilege to the credentials used in GitHub Actions workflows. Grant only the permissions required to perform the actions in your GitHub Actions workflows. See the Permissions section below for the permissions required by this action.
  • Rotate the credentials used in GitHub Actions workflows regularly.
  • Monitor the activity of the credentials used in GitHub Actions workflows.

Permissions

This action requires the following minimum set of permissions:

We recommend to read AWS CloudFormation Security Best Practices

{
    "Version":"2012-10-17",
    "Statement":[{
        "Effect":"Allow",
        "Action":[
            "cloudformation:*"
        ],
        "Resource":"*"
    },
    {
        "Effect":"Deny",
        "Action":[
            "cloudformation:DeleteStack"
        ],
        "Resource":"arn:aws:cloudformation:us-east-1:123456789012:stack/MyProductionStack/*"
    }]
}

The policy above prevents the stack to be deleted by a policy for production

License

MIT