AWS CloudFormation Hooks concepts

The following terminology and concepts are central to your understanding and use of AWS CloudFormation Hooks:

Hook

A Hook contains code that is invoked immediately before CloudFormation creates, updates, or deletes stacks or specific resources. It can also be invoked during a create change set operation. Hooks can inspect the template, resources, or change set that CloudFormation is about to provision. Additionally, Hooks can be invoked immediately before the Cloud Control API creates, update, or deletes specific resources.

If a Hook identifies any configurations that don't comply with the organizational guidelines defined in your Hook logic, then you may choose to either WARN users or FAIL, preventing CloudFormation from provisioning the resource.

Hooks have the following characteristics:

Failure mode

Your Hook logic can return success or failure. A success response will allow the operation to continue. A failure for non-compliant resources can result in the following:

Creating Hooks in WARN mode is an effective way to monitor Hook behavior without affecting stack operations. First, activate Hooks in WARN mode to understand which operations will be impacted. After you have assessed the potential effects, you can switch the Hook to FAIL mode to start preventing non-compliant operations.

Hook targets

Hook targets specify the operations that a Hook will evaluate. These can be operations on:

You define one or more targets that specify the broadest operations that the Hook will evaluate. For example, you can author a Hook targeting RESOURCE to target all AWS resources and STACK to target all stack templates.

Target actions

Target actions define the specific actions (CREATE, UPDATE, or DELETE) that will invoke a Hook. For RESOURCE, STACK, and CLOUD_CONTROL targets, all target actions are applicable. For CHANGE_SET targets, only the CREATE action is applicable.

Hook handler

For custom Hooks, this is the code that handles evaluation. It is associated with a target invocation point and a target action that mark an exact point where a Hook runs. You write handlers that host logic for these specific points. For example, a PRE target invocation point with CREATE target action makes a preCreate Hook handler. Code within the Hook handler runs when a matching target invocation point and service are performing an associated target action.

Valid values: (preCreate | preUpdate | preDelete)