CloudFormation Parameters

Introduction

Parameters let you customize templates at each deployment without changing the code.

Basic syntax

Parameters:
  ParameterName:
    Type: String
    Default: default-value
    Description: Description du paramètre
    ConstraintDescription: Message d'erreur personnalisé
    AllowedValues:
      - value1
      - value2
    AllowedPattern: pattern-regex
    MinLength: 1
    MaxLength: 100
    MinValue: 0
    MaxValue: 100
    NoEcho: true

Parameter types

Simple types

Parameters:
  # String
  EnvironmentName:
    Type: String
    Default: development
    Description: Nom de l'environnement
  
  # Number
  InstanceCount:
    Type: Number
    Default: 2
    MinValue: 1
    MaxValue: 10
    Description: Nombre d'instances
  
  # List<Number>
  PortNumbers:
    Type: List<Number>
    Default: "80,443,8080"
    Description: Liste de ports
  
  # CommaDelimitedList
  SubnetIds:
    Type: CommaDelimitedList
    Description: IDs des subnets séparés par virgules

AWS-specific types

Parameters:
  # Référence à une clé SSH existante
  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Nom de la key pair EC2
  
  # ID de VPC existant
  VPCId:
    Type: AWS::EC2::VPC::Id
    Description: ID du VPC
  
  # ID de subnet existant
  SubnetId:
    Type: AWS::EC2::Subnet::Id
    Description: ID du subnet
  
  # Liste de subnets
  SubnetIds:
    Type: List<AWS::EC2::Subnet::Id>
    Description: Liste des subnets
  
  # ID de Security Group
  SecurityGroupId:
    Type: AWS::EC2::SecurityGroup::Id
    Description: ID du security group
  
  # ID d'AMI
  AMIId:
    Type: AWS::EC2::Image::Id
    Description: ID de l'AMI
  
  # Zone de disponibilité
  AvailabilityZone:
    Type: AWS::EC2::AvailabilityZone::Name
    Description: Zone de disponibilité
  
  # Paramètre SSM
  LatestAMI:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
    Description: AMI depuis SSM Parameter Store

Constraints and validation

AllowedValues

Parameters:
  Environment:
    Type: String
    AllowedValues:
      - development
      - staging
      - production
    Default: development
    Description: Environnement de déploiement
  
  InstanceType:
    Type: String
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large
    Default: t3.micro
    Description: Type d'instance EC2

AllowedPattern

Parameters:
  # CIDR valide
  VPCCidr:
    Type: String
    AllowedPattern: '^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$'
    ConstraintDescription: Doit être un CIDR valide (ex: 10.0.0.0/16)
    Default: '10.0.0.0/16'
  
  # Nom de bucket S3
  BucketName:
    Type: String
    AllowedPattern: '^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$'
    ConstraintDescription: 3-63 caractères, minuscules, chiffres, points et tirets
  
  # Email
  AdminEmail:
    Type: String
    AllowedPattern: '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    ConstraintDescription: Doit être une adresse email valide
  
  # Nom de domaine
  DomainName:
    Type: String
    AllowedPattern: '^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$'
    ConstraintDescription: Doit être un nom de domaine valide

Min/Max Length et Value

Parameters:
  # Longueur de chaîne
  DatabaseName:
    Type: String
    MinLength: 1
    MaxLength: 64
    AllowedPattern: '[a-zA-Z][a-zA-Z0-9]*'
    Description: Nom de la base de données
  
  # Valeur numérique
  StorageSize:
    Type: Number
    MinValue: 20
    MaxValue: 16384
    Default: 100
    Description: Taille du stockage en GB

Sensitive parameters

Parameters:
  # Mot de passe masqué
  DatabasePassword:
    Type: String
    NoEcho: true
    MinLength: 8
    MaxLength: 41
    AllowedPattern: '[a-zA-Z0-9!@#$%^&*()_+-=]*'
    Description: Mot de passe de la base de données
  
  # Clé API
  APIKey:
    Type: String
    NoEcho: true
    Description: Clé API secrète

NoEcho

NoEcho: true hides the value in the console and logs, but it remains visible in the state. For truly sensitive secrets, use AWS Secrets Manager.

Using parameters

Reference with !Ref

Parameters:
  InstanceType:
    Type: String
    Default: t3.micro

Resources:
  WebServer:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType

In intrinsic functions

Parameters:
  Environment:
    Type: String
    Default: dev

Resources:
  Bucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub 'myapp-${Environment}-${AWS::AccountId}'
      Tags:
        - Key: Environment
          Value: !Ref Environment

Parameter interface

Organize the display in the AWS console:

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Configuration Réseau"
        Parameters:
          - VPCCidr
          - PublicSubnetCidr
          - PrivateSubnetCidr
      - Label:
          default: "Configuration Compute"
        Parameters:
          - InstanceType
          - KeyPairName
          - AMIId
      - Label:
          default: "Configuration Base de Données"
        Parameters:
          - DBInstanceClass
          - DBName
          - DBUsername
          - DBPassword
      - Label:
          default: "Tags"
        Parameters:
          - Environment
          - Project
          - Owner
    
    ParameterLabels:
      VPCCidr:
        default: "CIDR du VPC"
      InstanceType:
        default: "Type d'instance EC2"
      DBPassword:
        default: "Mot de passe DB (min 8 caractères)"

Parameters:
  VPCCidr:
    Type: String
    Default: '10.0.0.0/16'
  
  PublicSubnetCidr:
    Type: String
    Default: '10.0.1.0/24'
  
  PrivateSubnetCidr:
    Type: String
    Default: '10.0.2.0/24'
  
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
  
  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
  
  AMIId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
  
  DBInstanceClass:
    Type: String
    Default: db.t3.micro
  
  DBName:
    Type: String
    Default: mydb
  
  DBUsername:
    Type: String
    Default: admin
  
  DBPassword:
    Type: String
    NoEcho: true
  
  Environment:
    Type: String
    Default: development
  
  Project:
    Type: String
  
  Owner:
    Type: String

Passing parameters

Via CLI

# Paramètres inline
aws cloudformation create-stack \
    --stack-name my-stack \
    --template-body file://template.yaml \
    --parameters \
        ParameterKey=Environment,ParameterValue=production \
        ParameterKey=InstanceType,ParameterValue=t3.medium

# Fichier de paramètres
aws cloudformation create-stack \
    --stack-name my-stack \
    --template-body file://template.yaml \
    --parameters file://parameters.json

parameters.json file

[
  {
    "ParameterKey": "Environment",
    "ParameterValue": "production"
  },
  {
    "ParameterKey": "InstanceType",
    "ParameterValue": "t3.medium"
  },
  {
    "ParameterKey": "DBPassword",
    "ParameterValue": "MySecurePassword123!"
  }
]

Using previous values

# Garder les valeurs existantes lors d'un update
aws cloudformation update-stack \
    --stack-name my-stack \
    --template-body file://template.yaml \
    --parameters \
        ParameterKey=Environment,UsePreviousValue=true \
        ParameterKey=InstanceType,ParameterValue=t3.large

SSM parameters

Reference parameters stored in SSM Parameter Store:

Parameters:
  # Valeur depuis SSM
  DatabaseHost:
    Type: AWS::SSM::Parameter::Value<String>
    Default: /myapp/database/host
  
  # Liste depuis SSM
  SubnetIds:
    Type: AWS::SSM::Parameter::Value<List<AWS::EC2::Subnet::Id>>
    Default: /myapp/network/subnets
  
  # AMI dynamique
  LatestAMI:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2

Resources:
  Instance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAMI
      # ...

Complete example

AWSTemplateFormatVersion: '2010-09-09'
Description: Template avec paramètres complets

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: "Environnement"
        Parameters:
          - Environment
          - Project
      - Label:
          default: "Compute"
        Parameters:
          - InstanceType
          - KeyPairName
      - Label:
          default: "Stockage"
        Parameters:
          - VolumeSize

Parameters:
  Environment:
    Type: String
    AllowedValues:
      - dev
      - staging
      - prod
    Default: dev
    Description: Environnement de déploiement

  Project:
    Type: String
    MinLength: 1
    MaxLength: 20
    AllowedPattern: '[a-z0-9-]+'
    Description: Nom du projet

  InstanceType:
    Type: String
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
    Default: t3.micro

  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Clé SSH existante

  VolumeSize:
    Type: Number
    MinValue: 8
    MaxValue: 500
    Default: 20
    Description: Taille du volume en GB

Resources:
  Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyPairName
      ImageId: !Sub '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}'
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: !Ref VolumeSize
            VolumeType: gp3
      Tags:
        - Key: Name
          Value: !Sub '${Project}-${Environment}'
        - Key: Environment
          Value: !Ref Environment
        - Key: Project
          Value: !Ref Project

Outputs:
  InstanceId:
    Value: !Ref Instance
  Environment:
    Value: !Ref Environment

Summary

Parameters make templates reusable
Use AWS types for automatic validation
AllowedValues and AllowedPattern constrain inputs
NoEcho hides sensitive values
Metadata::Interface improves the UX in the console
SSM parameters enable dynamic values

← Resources | Mappings and Conditions →

Introduction​

Basic syntax​

Parameter types​

Simple types​

AWS-specific types​

Constraints and validation​

AllowedValues​

AllowedPattern​

Min/Max Length et Value​

Sensitive parameters​

Using parameters​

Reference with !Ref​

In intrinsic functions​

Parameter interface​

Passing parameters​

Via CLI​

parameters.json file​

Using previous values​

SSM parameters​

Complete example​

Summary​