# atmos aws cloudformation validate

Validate the component's template with CloudFormation's server-side
`ValidateTemplate` API — a syntax and capability-discovery check, not a local
linter.

> ⚠️ Experimental

## Usage

```shell
atmos aws cloudformation validate <component> --stack <stack> [options]
```

```shell
atmos aws cloudformation validate vpc -s plat-ue2-dev
```

Validate all or affected components in dependency order:

```shell
atmos aws cloudformation validate --all -s plat-ue2-dev
atmos aws cloudformation validate --affected --base origin/main
```

Validate components filtered by tags or labels (composes with `--all`/`--affected` to narrow the selected set further):

```shell
atmos aws cloudformation validate --all --tags production,tier-1
atmos aws cloudformation validate --affected --labels cost-center=platform
```

## Flags

- **`--stack`, `-s` (required for a single component)**
  Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with 
  `--all`
  /
  `--affected`
  .
- **`--all` (optional)**
  Validate all 
  `aws/cloudformation`
   components in dependency order.
- **`--affected` (optional)**
  Validate affected 
  `aws/cloudformation`
   components and their dependencies.
- **`--include-dependents` (optional)**
  With 
  `--affected`
  , include dependent 
  `aws/cloudformation`
   components.
- **`--base` (optional)**
  Git base ref or SHA to compare against for affected detection: 
  `--base origin/main`
  . Used with 
  `--affected`
  .
- **`--tags` (optional)**
  Filter by tags (comma-separated, matches any): 
  `--tags=production,tier-1`
  . Composes with 
  `--all`
  /
  `--affected`
   to narrow the selected set further; cannot be combined with a single component argument.
- **`--labels` (optional)**
  Filter by labels (comma-separated 
  `key=value`
   or 
  `key:value`
   pairs, matches all): 
  `--labels=cost-center=platform,compliance=sox`
  . Composes with 
  `--all`
  /
  `--affected`
  /
  `--tags`
  ; cannot be combined with a single component argument.

:::note
`validate` only checks template syntax and discovers required capabilities
(e.g. `CAPABILITY_IAM`) via the AWS API. It does not run local linters such as
`cfn-lint` or `cfn-guard` — declare those tools via the
[toolchain subsystem](/cli/configuration/toolchain) and run them from
[hooks](/stacks/hooks) or workflow steps if you want that check.
:::