CFT Parameter Reference
The template takes 19 parameters. Only three of them have no default, so a minimal deployment is mostly a matter of choosing a VPC, a subnet and an AMI, then leaving everything else alone. The console groups the parameters into six labelled sections using the AWS::CloudFormation::Interface metadata, and the tables below follow exactly that ordering, which makes it straightforward to read this page alongside the stack creation form.
Three parameters are required: VpcId, Ec2SubnetId and Ec2ImageId.
Everything else has a default, and the four booleans that decide how much infrastructure gets created all default to false.
Environment Configuration
| Parameter | Type | Default | Description |
|---|---|---|---|
EnvironmentName | String | dev | Environment name, such as dev, qa, prod or sbx. It's interpolated into almost every resource name and Name tag, so EnvironmentName and the stack name together identify the deployment. |
Network Configuration
| Parameter | Type | Default | Description |
|---|---|---|---|
VpcId | AWS::EC2::VPC::Id | Required | The existing VPC to deploy into. All three security groups are created in it. |
Ec2SubnetId | AWS::EC2::Subnet::Id | Required | Subnet for the EC2 instance and the EFS mount target. Both land in whichever AZ this subnet belongs to. |
EC2 Configuration
| Parameter | Type | Default | Description |
|---|---|---|---|
Ec2ImageId | AWS::EC2::Image::Id | Required | AMI for the instance. Use Ubuntu 22.04 LTS. Validated against ^(?!.*\s)ami-[0-9a-fA-F]{8,}$, minimum length 12. |
Ec2InstanceType | String | c6a.2xlarge | Instance type. The template documents a floor of 8 cores and 16 GB RAM. |
Ec2KeyName | String | '' | Name of an existing EC2 key pair. Leave blank to launch without one. Validated against ^$|[A-Za-z0-9._-]{1,255}$. |
AssignPublicIp | String | false | true or false. When true, the instance gets a public IP and an Elastic IP is allocated and associated. |
RDS Configuration
| Parameter | Type | Default | Description |
|---|---|---|---|
RdsCreate | String | false | true or false. RDS is optional, and the template notes a proof of concept can skip it. |
RdsInstanceClass | String | db.m5.large | Instance class for the database. Minimum length 1, so it can't be blanked out. |
RdsEngineVersion | String | 15.12 | PostgreSQL engine version. Must be a 15.x release, since the parameter group family is fixed at postgres15. |
RdsSubnet1Id | String | '' | First subnet for the DB subnet group. Validated against ^$|subnet-[0-9a-fA-F]+$. |
RdsSubnet2Id | String | '' | Second subnet, in another AZ, for the Multi-AZ deployment. Same validation pattern. |
Application Configuration
| Parameter | Type | Default | Description |
|---|---|---|---|
YeeduVersion | String | v2.9.1 | Release tag. The bootstrap syncs s3://yeedu-softwares/releases/${YeeduVersion}/ onto the instance. |
CreateLogGroups | String | false | true or false. Set to false when the 10 log groups already exist. |
CreateContainerRepositories | String | false | true or false. Set to false when the 17 ECR repositories already exist. |
Access and HTTPS
| Parameter | Type | Default | Description |
|---|---|---|---|
EnableHttps | String | false | true or false. Turning it on makes the next three parameters mandatory. |
CustomDnsName | String | '' | DNS name to serve on, for example app.example.com. Becomes the ApplicationEndpoint output. |
HttpsCertS3Path | String | '' | S3 URI of the certificate. Validated against ^$|s3://.+. |
HttpsKeyS3Path | String | '' | S3 URI of the private key. Same validation. |
The two validation rules
CloudFormation evaluates a Rules section before it creates a single resource, and this template uses it to catch the two combinations that would otherwise fail deep into provisioning. We think that's the single most useful thing about the parameter design, because a rejected parameter set costs you seconds while a rolled-back RDS instance costs you the better part of an hour. RequireRdsSubnetsWhenEnabled fires when RdsCreate is true and asserts that RdsSubnet1Id, RdsSubnet2Id and RdsEngineVersion are all non-empty. RequireHttpsArtifacts fires when EnableHttps is true and asserts the same for CustomDnsName, HttpsCertS3Path and HttpsKeyS3Path.
Each assertion carries its own message, so a failed validation names the parameter you forgot.
What the parameters don't cover
A fair amount of the database configuration is hardcoded, and if any of it doesn't suit your environment you'll be editing the template rather than passing a value. The database name and master username are both yeedu. Storage is 20 GB of gp3, encrypted, with MultiAZ set to true and PubliclyAccessible set to false. Backups retain for 7 days in the 03:00 to 04:00 window, with maintenance on Monday from 04:30. The parameter group sets shared_buffers to 2097152 and max_connections to 5000.
The master password isn't a parameter either. YeeduDbSecret generates a 16-character string, and the RDS resource resolves it through a dynamic reference at create time.
Storage on the instance is fixed too. The root volume is 200 GB of gp3 on /dev/sda1, set to delete on termination.