CloudFormation template parameters

A reference guide for CloudFormation template parameters used during AWS account configuration

  3 minute read  

This page details the AWS CloudFormation template parameters you can configure when deploying the template in your AWS environment.

Use this guide when configuring AWS accounts for CloudBolt Platform integration to determine the appropriate parameter settings for your environment.

S3 bucket configuration

Parameter Description Allowed values Default value Required
CreateS3Bucket Create a new S3 bucket. To use an existing bucket, set to false and specify the bucket name in S3BucketName. true, false true Yes
CreateS3BucketPolicy Create an S3 bucket policy to control access to billing data. Set to false if a bucket with the correct policy exists. true, false true Yes
S3BucketName Name for new S3 bucket, or existing S3 bucket name. Valid S3 bucket name N/A Conditional, not required when TargetDeploymentType=MemberAccountOnly

S3 bucket policy

If using an existing S3 bucket and policy (CreateS3Bucket=false, CreateS3BucketPolicy=false) the policy must match the following (replacing placeholders bucket and account-id):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowFOCUSDataExports",
      "Effect": "Allow",
      "Principal": { "Service": "bcm-data-exports.amazonaws.com" },
      "Action": [
        "s3:GetBucketAcl",
        "s3:GetBucketPolicy",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": [
        "arn:aws:s3:::<bucket>",
        "arn:aws:s3:::<bucket>/*"
      ],
      "Condition": {
        "StringEquals": { "aws:SourceAccount": "<account-id>" },
        "ArnLike": { "aws:SourceArn": "arn:aws:bcm-data-exports:us-east-1:<account-id>:export/*" }
      }
    }
  ]
}

CloudBolt stack management

Parameter Description Allowed values Default value Required
CloudBoltStackExist Controls whether this stack creates the CloudBolt IAM resources (OIDC trust, IAM roles, policies). Leave at false in almost every case, including stack updates. Set to true only when deploying a second stack from this template in the same account where a stack already created those IAM resources. true, false false Yes
ResourceNamePrefix Prefix added to created resource names to aid discovery and avoid conflicts. String CloudBolt Yes

Deployment scope and targeting

Parameter Description Allowed values Default value Required
TargetDeploymentType Where the template deploys resources:
- OrganizationWide (default): Entire organization
- SpecificOU: Specific organizational units
- ManagementAccountOnly: Management account only, no StackSet
- MemberAccountOnly: Member account only (action role and OIDC trust only)		 OrganizationWide, SpecificOU, ManagementAccountOnly, MemberAccountOnly OrganizationWide Yes
TargetRootOUId For OrganizationWide deployments only.
Organization’s root organizational unit ID for resource creation.		 Valid OUID N/A Conditional, when TargetDeploymentType=OrganizationWide
TargetOUIds For SpecificOU deployments only.
Organizational unit IDs for resource creation.		 Comma-separated list of valid OUIDs N/A Conditional, when TargetDeploymentType=SpecificOU

Account filtering

Parameter Description Allowed values Default value Required
TargetAccountFilterType For SpecificOU deployments only.
Filter accounts within OUs:
- NONE (default): Deploy to all accounts in the selected OUs.
- INTERSECTION: Deploy to accounts in TargetAccountsToFilter that are in the selected OUs.
- DIFFERENCE: Deploy to accounts in the selected OUs not listed in TargetAccountsToFilter.		 NONE, INTERSECTION, DIFFERENCE NONE Conditional, when TargetDeploymentType=SpecificOU
TargetAccountsToFilter Accounts to include or exclude, based on TargetAccountFilterType. Comma-separated list of valid account IDs N/A Conditional, when TargetDeploymentType=SpecificOU and TargetAccountFilterType isn’t set to NONE

Tenant configuration

Parameter Description Allowed values Default value Required
TenantHostedRegion Selects which CloudBolt SaaS OIDC provider the cross-account roles trust. Pick the value matching where your CloudBolt tenant is hosted.
- US (default): Trusts auth.cloudbolt.io. Choose this if your CloudBolt tenant is hosted in the US.
- EU: Trusts auth.eu.cloudbolt.io. Choose this if your CloudBolt tenant is hosted in the EU.		 US, EU US Yes