Native CloudFormation extensions
Updraft Extensions are installable resource types that give your stacks the primitives CloudFormation never shipped — dynamic lookups, secure generation, real orchestration — without custom resources, pipeline glue, or leaving the platform your organization already trusts.
Installs through the AWS CloudFormation registry · no agents · no separate workflow
Resources:
DbHost:
Type: Updraft::SSM::Parameter Properties:
Name: /myapp/production/db/host
AppServer:
Type: AWS::EC2::Instance
Properties:
UserData:
Fn::Base64:
!Sub "DB_HOST=${DbHost.Value}"The problem
CloudFormation is deeply integrated into AWS and often mandated — but it has no rich data lookups, no secure generation, and little orchestration. So teams build around it: a Lambda function here, a pipeline script there. Each workaround works. Each one is also infrastructure of its own, owned by you forever.
Teams end up working around CloudFormation rather than with it.
A Lambda function to write, deploy, permit, monitor, and patch — for every gap, in every account and region that needs it.
Scripts that resolve values before deployment, holding state the stack cannot see, order, or roll back.
One-off orchestration for certificates, trust, and multi-account coordination that templates cannot express on their own.
The same workarounds rebuilt by every team, slightly differently, with no shared owner and no upgrade path.
The model
Updraft Extensions register through the CloudFormation registry — the same mechanism AWS uses for its own resource types. Nothing new runs in your provisioning path.
Register the extension in an account and region. Every stack in that scope can use the type — no per-stack deployment.
Add the resource type to a template like any built-in. Reference its attributes with standard CloudFormation syntax.
Create, update, delete, rollback — extension resources follow the same lifecycle and dependency graph as everything else.
Capabilities
Extensions cluster into four families of missing primitives. Each one is built to be reused across organizations — not bespoke logic for a single pipeline.
Dynamic discovery resolved at stack evaluation time — parameters, metadata, and policy-aware selection without Lambda-backed custom resources.
Updraft::SSM::Parameter
Resolve Systems Manager Parameter Store values inside the stack — Standard, Advanced, and SecureString tiers.
View extensionKeys, passwords, and identifiers generated with correct lifecycle semantics — created with the stack, removed with the stack, deterministic and policy-driven where possible.
Trigger and await external systems — Terraform, Helm, domain events — and model asynchronous workflows declaratively, inside the stack.
Certificate and trust management, multi-account coordination patterns, and region-aware primitives for the boundaries CloudFormation treats as walls.
Why trust it
Extensions respect how CloudFormation thinks — creation, updates, deletes, failures, and rollbacks — instead of forcing it to adapt to them.
Where generation is involved, behavior is predictable, auditable, and policy-driven — never opaque or surprising.
Each extension does one thing well and composes with the rest of your template — small orthogonal primitives, not a framework.
Commercial licensing funds compatibility testing against AWS releases, support, and long-term evolution — primitives that outlive tooling trends. See how licensing works.
Browse the catalog, find the primitive your team keeps rebuilding, and license it once.