Intrinsic Functions

Introduction

Intrinsic functions let you perform dynamic operations in your CloudFormation templates.

Ref

Returns the value of a parameter or the physical ID of a resource.

Parameters:
  InstanceType:
    Type: String
    Default: t3.micro

Resources:
  MyVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16

  MySubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref MyVPC              # Référence à une ressource
      CidrBlock: 10.0.1.0/24

  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType # Référence à un paramètre
      SubnetId: !Ref MySubnet

Outputs:
  VPCId:
    Value: !Ref MyVPC                 # Retourne vpc-xxxxxxxx
  StackName:
    Value: !Ref AWS::StackName        # Pseudo-paramètre
  AccountId:
    Value: !Ref AWS::AccountId        # Pseudo-paramètre

!Ref return values by type

Resource type	!Ref return value
AWS::EC2::VPC	VPC ID
AWS::EC2::Subnet	Subnet ID
AWS::EC2::Instance	Instance ID
AWS::S3::Bucket	Bucket name
AWS::IAM::Role	Role name
AWS::Lambda::Function	Function name

GetAtt

Returns a specific attribute of a resource.

Resources:
  MyBucket:
    Type: AWS::S3::Bucket

  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t3.micro
      ImageId: ami-12345678

  MyLoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: application
      Subnets:
        - !Ref Subnet1
        - !Ref Subnet2

Outputs:
  # Bucket
  BucketArn:
    Value: !GetAtt MyBucket.Arn
  BucketDomainName:
    Value: !GetAtt MyBucket.DomainName
  BucketWebsiteURL:
    Value: !GetAtt MyBucket.WebsiteURL

  # Instance EC2
  InstancePublicIP:
    Value: !GetAtt MyInstance.PublicIp
  InstancePrivateIP:
    Value: !GetAtt MyInstance.PrivateIp
  InstanceDNS:
    Value: !GetAtt MyInstance.PublicDnsName
  InstanceAZ:
    Value: !GetAtt MyInstance.AvailabilityZone

  # Load Balancer
  ALBDnsName:
    Value: !GetAtt MyLoadBalancer.DNSName
  ALBHostedZone:
    Value: !GetAtt MyLoadBalancer.CanonicalHostedZoneID

Syntax

# Forme longue
Value: !GetAtt 
  - ResourceName
  - AttributeName

# Forme courte (recommandée)
Value: !GetAtt ResourceName.AttributeName

Sub (Substitution)

Substitutes variables into a string.

Simple substitution

Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'myapp-${AWS::Region}-${AWS::AccountId}'
      Tags:
        - Key: Name
          Value: !Sub '${AWS::StackName}-bucket'

Substitution with custom variables

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      UserData:
        Fn::Base64: !Sub 
          - |
            #!/bin/bash
            echo "Stack: ${StackName}"
            echo "Region: ${Region}"
            echo "Bucket: ${BucketName}"
            aws s3 cp s3://${BucketName}/config.json /etc/myapp/
          - StackName: !Ref AWS::StackName
            Region: !Ref AWS::Region
            BucketName: !Ref ConfigBucket

Variables available in Sub

# Pseudo-paramètres
${AWS::StackName}     # Nom de la stack
${AWS::StackId}       # ARN de la stack
${AWS::Region}        # Région
${AWS::AccountId}     # ID du compte
${AWS::URLSuffix}     # amazonaws.com
${AWS::Partition}     # aws, aws-cn, aws-us-gov

# Références à des ressources
${ResourceName}       # Équivalent à !Ref ResourceName

# Attributs de ressources
${ResourceName.Attribute}  # Équivalent à !GetAtt ResourceName.Attribute

Join

Concatenates values with a delimiter.

Outputs:
  # Joindre des références
  SubnetList:
    Value: !Join 
      - ','
      - - !Ref Subnet1
        - !Ref Subnet2
        - !Ref Subnet3
    # Résultat: "subnet-111,subnet-222,subnet-333"

  # Joindre avec des chaînes
  ConnectionString:
    Value: !Join 
      - ''
      - - 'postgresql://'
        - !Ref DBUsername
        - ':'
        - !Ref DBPassword
        - '@'
        - !GetAtt Database.Endpoint.Address
        - ':'
        - !GetAtt Database.Endpoint.Port
        - '/'
        - !Ref DBName

  # ARN construit
  S3ObjectArn:
    Value: !Join 
      - ''
      - - 'arn:aws:s3:::'
        - !Ref MyBucket
        - '/*'

Split

Splits a string into a list.

Parameters:
  SubnetIds:
    Type: String
    Default: 'subnet-111,subnet-222,subnet-333'

Resources:
  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier: !Split [',', !Ref SubnetIds]
      # Résultat: ['subnet-111', 'subnet-222', 'subnet-333']

  # Avec ImportValue
  AppInstances:
    Type: AWS::AutoScaling::AutoScalingGroup
    Properties:
      VPCZoneIdentifier: !Split 
        - ','
        - !ImportValue network-stack-PrivateSubnets

Select

Selects an element from a list by index (0-based).

Resources:
  # Sélectionner la première AZ
  MySubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select 
        - 0
        - !GetAZs ''    # Liste des AZs de la région
      CidrBlock: 10.0.1.0/24

  # Sélectionner un subnet d'une liste
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      SubnetId: !Select 
        - 0
        - !Split [',', !ImportValue network-stack-PrivateSubnets]

Combining Select with Split

Parameters:
  Subnets:
    Type: String
    Default: 'subnet-1,subnet-2,subnet-3'

Resources:
  Instance1:
    Type: AWS::EC2::Instance
    Properties:
      SubnetId: !Select [0, !Split [',', !Ref Subnets]]

  Instance2:
    Type: AWS::EC2::Instance
    Properties:
      SubnetId: !Select [1, !Split [',', !Ref Subnets]]

GetAZs

Returns the list of availability zones for a region.

Resources:
  # Utiliser toutes les AZs
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: 10.0.1.0/24

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: 10.0.2.0/24

  PublicSubnet3:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [2, !GetAZs '']
      CidrBlock: 10.0.3.0/24

Outputs:
  AvailabilityZones:
    Value: !Join [',', !GetAZs '']

Cidr

Generates CIDR blocks from a parent CIDR.

Parameters:
  VPCCidr:
    Type: String
    Default: '10.0.0.0/16'

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VPCCidr

  # Générer 4 subnets /24 à partir du VPC /16
  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select 
        - 0
        - !Cidr [!Ref VPCCidr, 4, 8]  # 10.0.0.0/24
      AvailabilityZone: !Select [0, !GetAZs '']

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select 
        - 1
        - !Cidr [!Ref VPCCidr, 4, 8]  # 10.0.1.0/24
      AvailabilityZone: !Select [1, !GetAZs '']

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select 
        - 2
        - !Cidr [!Ref VPCCidr, 4, 8]  # 10.0.2.0/24
      AvailabilityZone: !Select [0, !GetAZs '']

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: !Select 
        - 3
        - !Cidr [!Ref VPCCidr, 4, 8]  # 10.0.3.0/24
      AvailabilityZone: !Select [1, !GetAZs '']

Cidr syntax

!Cidr [ipBlock, count, cidrBits]
# ipBlock: CIDR source (ex: 10.0.0.0/16)
# count: Nombre de CIDRs à générer
# cidrBits: Bits pour la partie réseau des sous-CIDRs

# Exemples:
!Cidr ['10.0.0.0/16', 4, 8]   # Génère 4 x /24
!Cidr ['10.0.0.0/16', 16, 12] # Génère 16 x /28

Base64

Encodes a string in Base64 (useful for UserData).

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t3.micro
      ImageId: ami-12345678
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum update -y
          yum install -y httpd
          systemctl start httpd
          systemctl enable httpd
          echo "<h1>Hello from ${AWS::StackName}</h1>" > /var/www/html/index.html

  # Combiner avec Sub et Join
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      UserData:
        Fn::Base64: !Join 
          - ''
          - - "#!/bin/bash\n"
            - "echo 'Stack: "
            - !Ref AWS::StackName
            - "' > /tmp/stack-info.txt\n"
            - "echo 'Region: "
            - !Ref AWS::Region
            - "' >> /tmp/stack-info.txt\n"

FindInMap

Retrieves a value from a mapping.

Mappings:
  RegionConfig:
    us-east-1:
      AMI: ami-0ff8a91507f77f867
      InstanceType: t3.micro
    eu-west-1:
      AMI: ami-0c55b159cbfafe1f0
      InstanceType: t3.small

Resources:
  MyInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !FindInMap 
        - RegionConfig
        - !Ref AWS::Region
        - AMI
      InstanceType: !FindInMap 
        - RegionConfig
        - !Ref AWS::Region
        - InstanceType

Conditional functions

Conditions:
  IsProduction: !Equals [!Ref Environment, production]
  HasKeyPair: !Not [!Equals [!Ref KeyPair, '']]
  IsLargeAndProd: !And 
    - !Condition IsProduction
    - !Equals [!Ref Size, large]
  NeedsBackup: !Or 
    - !Condition IsProduction
    - !Equals [!Ref EnableBackup, 'true']

Resources:
  Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !If 
        - IsProduction
        - t3.large
        - t3.micro
      KeyName: !If 
        - HasKeyPair
        - !Ref KeyPair
        - !Ref AWS::NoValue

Summary table

Function	Usage	Example
`!Ref`	Resource ID/param value	`!Ref MyVPC`
`!GetAtt`	Attribute of a resource	`!GetAtt Bucket.Arn`
`!Sub`	Variable substitution	`!Sub '${AWS::Region}'`
`!Join`	Concatenate with delimiter	`!Join [',', [a, b]]`
`!Split`	Split into a list	`!Split [',', 'a,b']`
`!Select`	Select by index	`!Select [0, !GetAZs '']`
`!GetAZs`	List of AZs	`!GetAZs ''`
`!Cidr`	Generate CIDRs	`!Cidr [cidr, 4, 8]`
`!Base64`	Encode to Base64	`!Base64 script`
`!FindInMap`	Value from a mapping	`!FindInMap [Map, K1, K2]`
`!If`	Ternary condition	`!If [Cond, a, b]`
`!ImportValue`	Cross-stack import	`!ImportValue name`

← Outputs and Exports | Nested Stacks →

Introduction​

Ref​

!Ref return values by type​

GetAtt​

Syntax​

Sub (Substitution)​

Simple substitution​

Substitution with custom variables​

Variables available in Sub​

Join​

Split​

Select​

Combining Select with Split​

GetAZs​

Cidr​

Cidr syntax​

Base64​

FindInMap​

Conditional functions​

Summary table​