atmos aws cloudformation get policy

Fetch the deployed stack's current stack policy (GetStackPolicy) and write it to stdout — the policy CloudFormation is actually enforcing, as opposed to the stack_policy configured on the component (which apply only applies after a successful deploy).

Experimental

atmos aws cloudformation get policy --help

Usage

atmos aws cloudformation get policy <component> --stack <stack> [options]

atmos aws cloudformation get policy vpc -s plat-ue2-dev

Flags

--stack, -s (required for a single component)

Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with --all/--affected.

--all (optional)

Fetch the policy for all aws/cloudformation components in dependency order.

--affected (optional)

Fetch the policy for affected aws/cloudformation components and their dependencies.

--include-dependents (optional)

With --affected, include dependent aws/cloudformation components.

--tags (optional)

Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.

--labels (optional)

Filter by labels (comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.

Output

If the stack has no policy set (CloudFormation's default), get policy prints a message saying so instead of an empty body.

note

get policy does not fire before/after hook events — only apply, diff, and delete do.