# CloudFormation template parameters

> A reference guide for CloudFormation template parameters used during AWS account configuration

---

Site [llms.txt](/llms.txt)

---

This page details the AWS CloudFormation template parameters you can configure when deploying the template in your AWS environment.

Use this guide when [configuring AWS accounts for CloudBolt Platform integration](/docs/cbp/reference/aws-account-config/) to determine the appropriate parameter settings for your environment.

## S3 bucket configuration

| Parameter | Description | Allowed values | Default value | Required |
| --- | --- | --- | --- | --- |
| **CreateS3Bucket** | Create a new S3 bucket. To use an existing bucket, set to `false` and specify the bucket name in `S3BucketName`. | true, false | true | Yes |
| **CreateS3BucketPolicy** | Create an S3 bucket policy to control access to billing data. Set to `false` if a bucket with [the correct policy](#s3-bucket-policy) exists. | true, false | true | Yes |
| **S3BucketName** | Name for new S3 bucket, or existing S3 bucket name. | Valid S3 bucket name | N/A | Conditional, not required when `TargetDeploymentType=MemberAccountOnly` |

<div class="alert alert-warning" role="alert">


If you set `CreateS3BucketPolicy=false`, the existing bucket's policy must grant `bcm-data-exports.amazonaws.com` the actions shown in **S3 bucket policy**. If it does not, the exports are created, but every run fails with "Data Exports no longer has permission to run this export."
</div>


### S3 bucket policy

If using an existing S3 bucket and policy (`CreateS3Bucket=false`, `CreateS3BucketPolicy=false`) the policy **must** match the following (replacing placeholders `bucket` and `account-id`):

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowFOCUSDataExports",
      "Effect": "Allow",
      "Principal": { "Service": "bcm-data-exports.amazonaws.com" },
      "Action": [
        "s3:GetBucketAcl",
        "s3:GetBucketPolicy",
        "s3:PutObject",
        "s3:PutObjectAcl"
      ],
      "Resource": [
        "arn:aws:s3:::<bucket>",
        "arn:aws:s3:::<bucket>/*"
      ],
      "Condition": {
        "StringEquals": { "aws:SourceAccount": "<account-id>" },
        "ArnLike": { "aws:SourceArn": "arn:aws:bcm-data-exports:us-east-1:<account-id>:export/*" }
      }
    }
  ]
}
```

## CloudBolt stack management

| Parameter | Description | Allowed values | Default value | Required |
| --- | --- | --- | --- | --- |
| **CloudBoltStackExist** | Controls whether this stack creates the CloudBolt IAM resources (OIDC trust, IAM roles, policies). Leave at `false` in almost every case, including stack updates. Set to `true` only when deploying a second stack from this template in the same account where a stack already created those IAM resources. | true, false | false | Yes |
| **ResourceNamePrefix** | Prefix added to created resource names to aid discovery and avoid conflicts. | String | CloudBolt | Yes |

## Deployment scope and targeting

| Parameter | Description | Allowed values | Default value | Required |
| --- | --- | --- | --- | --- |
| **TargetDeploymentType** | Where the template deploys resources:<br>- **OrganizationWide (default):** Entire organization<br>- SpecificOU: Specific organizational units<br>- ManagementAccountOnly: Management account only, no StackSet<br>- MemberAccountOnly: Member account only (action role and OIDC trust only) | OrganizationWide, SpecificOU, ManagementAccountOnly, MemberAccountOnly | OrganizationWide | Yes |
| **TargetRootOUId** | For **OrganizationWide** deployments only.<br>Organization's root organizational unit ID for resource creation. | Valid OUID | N/A | Conditional, when `TargetDeploymentType=OrganizationWide` |
| **TargetOUIds** | For **SpecificOU** deployments only.<br>Organizational unit IDs for resource creation. | Comma-separated list of valid OUIDs | N/A | Conditional, when `TargetDeploymentType=SpecificOU` |

## Account filtering

| Parameter | Description | Allowed values | Default value | Required |
| --- | --- | --- | --- | --- |
| **TargetAccountFilterType** | For **SpecificOU** deployments only.<br>Filter accounts within OUs:<br>- **NONE (default):** Deploy to all accounts in the selected OUs.<br>- INTERSECTION: Deploy to accounts in `TargetAccountsToFilter` that are in the selected OUs.<br>- DIFFERENCE: Deploy to accounts in the selected OUs not listed in `TargetAccountsToFilter`. | NONE, INTERSECTION, DIFFERENCE | NONE | Conditional, when `TargetDeploymentType=SpecificOU` |
| **TargetAccountsToFilter** | Accounts to include or exclude, based on `TargetAccountFilterType`. | Comma-separated list of valid account IDs | N/A | Conditional, when `TargetDeploymentType=SpecificOU` and `TargetAccountFilterType` **isn't** set to `NONE` |

## Tenant configuration

| Parameter | Description | Allowed values | Default value | Required |
| --- | --- | --- | --- | --- |
| **TenantHostedRegion** | Selects which CloudBolt SaaS OIDC provider the cross-account roles trust. Pick the value matching where your CloudBolt tenant is hosted.<br>- **US** (default): Trusts `auth.cloudbolt.io`. Choose this if your CloudBolt tenant is hosted in the US.<br>- **EU**: Trusts `auth.eu.cloudbolt.io`. Choose this if your CloudBolt tenant is hosted in the EU. | US, EU | US | Yes |

<div class="alert alert-info" role="alert">


OIDC provider defaults are pre-configured for connecting to CloudBolt. Change these only if instructed by CloudBolt Support.
</div>