Intrinsic functions & pseudo-parameters

Ref, GetAtt, Sub, and friends.

Intrinsic functions are how a template computes values at deploy time instead of hard-coding them. The everyday ones: !Ref returns a resource’s identifier (or a parameter’s value), !GetAtt reads a specific attribute of a resource (an ARN, a DNS name), !Sub interpolates variables into a string, and !Join concatenates. These are what wire resources together dynamically — a security group referencing a VPC, a policy embedding a bucket ARN.

Resources:
  Bucket:
    Type: AWS::S3::Bucket
  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref Bucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Principal: { AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root" }
            Action: s3:GetObject
            Resource: !Sub "${Bucket.Arn}/*"   # GetAtt via !Sub

Pseudo-parameters and conditions

AWS provides pseudo-parameters — values CloudFormation fills in automatically: AWS::Region, AWS::AccountId, AWS::StackName, AWS::Partition. They let a template adapt to wherever it deploys without hard-coding an account or region. Combined with Conditions (built from !If, !Equals, !And) you get templates that create resources only in certain environments — a prod-only WAF, a dev-only bastion — from one file.

Conditions:
  IsProd: !Equals [!Ref Environment, prod]
 
Resources:
  Waf:
    Type: AWS::WAFv2::WebACL
    Condition: IsProd            # only created when Environment=prod
    Properties:
      Name: !Sub "${AWS::StackName}-waf"
      Scope: REGIONAL