Using resource types

To use a resource type with AWS Cloud Control API, that resource type must be present and activated in your AWS account. Supported AWS resource types are public and always activated. You can choose to activate public resource types offered by third-party publishers as well. You do this, and other resource type management tasks, through the AWS CloudFormation extension registry.

The extension registry is a feature of AWS CloudFormation that contains detailed information about the resource types available for use in your account. These can include resource types published by third-parties, in addition to those published by AWS. Using the registry, you can manage the resource types in your account, including:

You can also use the AWS CloudFormation registry to view a resource type's schema, which contains important information about how to use the resource with Cloud Control API, such as property definitions and permission requirements. For more information, see Viewing resource type schemas.

The registry is available through the CloudFormation console, in addition to the CloudFormation API.

For more information about resource type management options, see Using the CloudFormation registry in the AWS CloudFormation User Guide.

Managing resource types using the AWS CloudFormation API

In addition to accessing the extension registry through the AWS CloudFormation console, you can use operations included in the AWS CloudFormation API to identify and manage the resource types in your account. The table below lists the API operations that you can use to discover, activate, and configure the resource types available in your account.

Determining if a resource type supports Cloud Control API

By default, resource types published in the CloudFormation registry automatically support Cloud Control API resource operations. This includes private resource types, in addition to public third-party resource types. However, the AWS CloudFormation registry also contains legacy resource types, classified as non-provisionable. These resource types don't currently support Cloud Control API, and you can't use them in resource operations.

For a list of the AWS public resource types that currently support Cloud Control API resource operations, see Resource types that support Cloud Control API.

You can also use the AWS Command Line Interface (AWS CLI) to generate a list of supported resource types or to determine if a specific resource type supports Cloud Control API.

Viewing resource type schemas

During resource create and update operations, you specify which resource properties to set and their values. The properties of a resource are defined in its resource type schema. This includes data type, whether the property is required, valid values, and other property constraints.

You can view a resource type's schema using the CloudFormation console or the AWS CLI. In addition, the AWS CloudFormation User Guide contains reference topics for each available resource type that AWS publishes. For detailed information about resource type properties, in addition to usage examples, see the corresponding topics in the AWS resource and property types reference section.

For detailed information about the resource type definition schema, which defines how resource type schema can be authored, see Resource type definition schema in the CloudFormation CLI User Guide for Extension Development.

For information about how to view an existing resource's current state, which includes its current property values, see Reading a resource's current state.

Viewing resource property attributes

Resource type properties are defined in the properties section of the resource type schema. This includes the property data type, whether the property is required, and any constraints such as allowable values or required patterns.

In addition, certain attributes set at the resource level govern when or if a property can be specified. This includes:

Viewing supported resource operations

You can determine which operations a resource type supports by referring to the handlers section of its resource type schema. If the resource type supports an operation, it's listed in the handlers section, and it contains a permissions element that lists the permissions that the handler requires.

For example, below is the handlers section of the resource type schema for the AWS::Logs::LogGroup resource type. This section shows that this resource type supports all five resource operations, and lists the permissions that each handler requires.

  "handlers": {
    "create": {
      "permissions": [
        "logs:DescribeLogGroups",
        "logs:CreateLogGroup",
        "logs:PutRetentionPolicy"
      ]
    },
    "read": {
      "permissions": [
        "logs:DescribeLogGroups"
      ]
    },
    "update": {
      "permissions": [
        "logs:DescribeLogGroups",
        "logs:AssociateKmsKey",
        "logs:DisassociateKmsKey",
        "logs:PutRetentionPolicy",
        "logs:DeleteRetentionPolicy"
      ]
    },
    "delete": {
      "permissions": [
        "logs:DescribeLogGroups",
        "logs:DeleteLogGroup"
      ]
    },
    "list": {
      "permissions": [
        "logs:DescribeLogGroups"
      ]
    }
  }