How It Works

CloudFormation solves the hardest part of infrastructure management well: declare what you need, and the stack handles create, update, delete, and rollback consistently. The difficulty is that built-in resource types stop short of what real infrastructure requires. Teams fill the gaps with custom resources, Lambda-backed lookup functions, and pipeline preprocessing—each a bespoke system that must be built and maintained alongside the infrastructure it was meant to simplify.

Updraft Extensions closes those gaps without leaving CloudFormation.

Extensions in the CloudFormation registry

AWS CloudFormation includes a registry that allows additional resource types to be installed and activated in an account and region. AWS itself publishes extensions through the public registry; third-party extensions use the same mechanism.

Updraft Extensions are registered CloudFormation extensions. Once activated, they appear as resource types available to any template in that account and region. There is no separate agent to run, no wrapper service, and nothing additional in the provisioning path. CloudFormation calls an extension handler at the same points it calls any built-in type: when the stack creates, updates, or deletes resources.

Activation is a one-time operation per account and region. After activation, the extension type is available to all stacks in that scope without a per-stack deployment step.

Stack lifecycle semantics

The defining characteristic of a CloudFormation-native resource type is that the stack owns its lifecycle. A resource is created when the stack creates it, updated when the stack changes it, and deleted when the stack deletes it. If an operation fails, CloudFormation rolls it back.

Extensions preserve that guarantee. A credential generated by an extension is removed when the stack is deleted. A value resolved by an extension is obtained when CloudFormation processes that resource, ordered by the same dependency graph that governs every other resource in the template. If a stack operation fails and rolls back, extension resources roll back with it.

This is the meaningful difference from custom resources and pipeline scripts. A Lambda-backed custom resource requires a function that you deploy, IAM-permit, and maintain as a separate system from the stacks that use it—with lifecycle coupling that CloudFormation cannot fully enforce. A pipeline script that pre-resolves values runs outside the stack lifecycle, producing state that the stack does not own. Both approaches introduce maintenance surface that follows the infrastructure wherever it is deployed.

Extensions move those concerns inside the CloudFormation resource model, where they participate in the same lifecycle as every other resource in the template.

What extensions are not

Not custom resources. You do not write the handler, manage the Lambda function, or maintain the provisioning logic. Updraft provides and maintains the extension. You declare it in a template and CloudFormation calls it.

Not pipeline tooling. Extensions operate inside the CloudFormation execution model, not alongside it. No additional process runs in the provisioning path.

Not a platform replacement. The goal is the opposite: making CloudFormation more capable so teams can express more of their infrastructure declaratively, without workarounds that live outside the template.

Prerequisites and compatibility

Activating an extension requires IAM permissions to register and use CloudFormation extension types. The specific permissions depend on what AWS services the extension handler interacts with—an extension that reads from SSM Parameter Store, for example, requires the relevant SSM read permissions on the execution role.

Each extension documents its prerequisites, required IAM permissions, and any service-specific constraints. Review the documentation before activating an extension in a production account.

Licensing

Extensions are commercial products. A license covers use in your AWS environment, maintenance for compatibility with CloudFormation and AWS service updates, and ongoing support. Pricing and licensing terms are on the pricing page.

Where to go next

The pricing page covers tiers and how to obtain a license. The blog has technical articles on CloudFormation patterns, including the operational costs of the custom-resource and pipeline-script workarounds that extensions replace.