Overcast is alpha — behaviour and APIs may change between releases. Pin your version and read the changelog before upgrading.

overcast

CDK resource type coverage

Which CloudFormation resource types Overcast provisions for real, which are recognised as stubs, and what happens to a type that is in neither list.

Overcast’s CloudFormation provisioner handles 138 resource types, and a cdk deploy succeeds for a stack built from them: 129 have real handlers, 9 are recognised as stubs, and custom resources and nested stacks are resolved dynamically on top of those.

Read the tables by what a type creates. A real handler provisions through the emulated service, so it creates state the ordinary AWS APIs can query and Fn::GetAtt resolves against. A stub returns a synthetic physical ID and creates nothing. A type in neither table is stubbed the same way, so a template that uses one still deploys.

Real handlers

ServiceResource Types
S3AWS::S3::Bucket, AWS::S3::BucketPolicy
SQSAWS::SQS::Queue
SNSAWS::SNS::Topic, AWS::SNS::Subscription
DynamoDBAWS::DynamoDB::Table, AWS::DynamoDB::GlobalTable
LambdaAWS::Lambda::Function, AWS::Lambda::Alias, AWS::Lambda::Url, AWS::Lambda::EventSourceMapping, AWS::Lambda::Permission, AWS::Lambda::LayerVersion, AWS::Lambda::CodeSigningConfig
IAMAWS::IAM::Role, AWS::IAM::Policy, AWS::IAM::ManagedPolicy, AWS::IAM::InstanceProfile, AWS::IAM::ServiceLinkedRole, AWS::IAM::User, AWS::IAM::Group, AWS::IAM::AccessKey
EC2 / VPCAWS::EC2::VPC, AWS::EC2::Subnet, AWS::EC2::SecurityGroup, AWS::EC2::InternetGateway, AWS::EC2::VPNGateway, AWS::EC2::VPCGatewayAttachment, AWS::EC2::RouteTable, AWS::EC2::Route, AWS::EC2::SubnetRouteTableAssociation, AWS::EC2::NatGateway, AWS::EC2::EIP, AWS::EC2::LaunchTemplate
ECSAWS::ECS::Cluster, AWS::ECS::TaskDefinition, AWS::ECS::Service
ECRAWS::ECR::Repository
API GatewayAWS::ApiGateway::RestApi, AWS::ApiGateway::Resource, AWS::ApiGateway::Method, AWS::ApiGateway::Deployment, AWS::ApiGateway::Stage, AWS::ApiGateway::ApiKey, AWS::ApiGateway::UsagePlan, AWS::ApiGateway::UsagePlanKey, AWS::ApiGateway::Authorizer, AWS::ApiGateway::Model, AWS::ApiGateway::RequestValidator
API Gateway V2AWS::ApiGatewayV2::Api, AWS::ApiGatewayV2::Stage, AWS::ApiGatewayV2::Integration, AWS::ApiGatewayV2::Route
AppSyncAWS::AppSync::Api, AWS::AppSync::GraphQLApi, AWS::AppSync::GraphQLSchema, AWS::AppSync::ChannelNamespace, AWS::AppSync::ApiKey, AWS::AppSync::DataSource, AWS::AppSync::Resolver, AWS::AppSync::FunctionConfiguration, AWS::AppSync::DomainName, AWS::AppSync::DomainNameApiAssociation, AWS::AppSync::ApiCache, AWS::AppSync::SourceApiAssociation
AppConfigAWS::AppConfig::Application, AWS::AppConfig::Environment, AWS::AppConfig::ConfigurationProfile
RDSAWS::RDS::DBInstance, AWS::RDS::DBCluster, AWS::RDS::DBSubnetGroup, AWS::RDS::DBParameterGroup
ElastiCacheAWS::ElastiCache::CacheCluster, AWS::ElastiCache::ServerlessCache, AWS::ElastiCache::ReplicationGroup, AWS::ElastiCache::SubnetGroup
EFSAWS::EFS::FileSystem, AWS::EFS::MountTarget, AWS::EFS::AccessPoint
EKSAWS::EKS::Cluster, AWS::EKS::Nodegroup, AWS::EKS::FargateProfile, AWS::EKS::Addon, AWS::EKS::AccessEntry, AWS::EKS::PodIdentityAssociation
MSKAWS::MSK::Cluster, AWS::MSK::Configuration
EventBridgeAWS::Events::EventBus, AWS::Events::Rule
SchedulerAWS::Scheduler::Schedule, AWS::Scheduler::ScheduleGroup
PipesAWS::Pipes::Pipe
Step FunctionsAWS::StepFunctions::StateMachine
KinesisAWS::Kinesis::Stream
FirehoseAWS::KinesisFirehose::DeliveryStream
CloudWatchAWS::CloudWatch::Alarm
CloudWatch LogsAWS::Logs::LogGroup, AWS::Logs::LogStream, AWS::Logs::MetricFilter
KMSAWS::KMS::Key, AWS::KMS::Alias
SSMAWS::SSM::Parameter
Secrets ManagerAWS::SecretsManager::Secret
CognitoAWS::Cognito::UserPool, AWS::Cognito::UserPoolClient
Route 53AWS::Route53::HostedZone, AWS::Route53::RecordSet, AWS::Route53::HealthCheck
CloudFrontAWS::CloudFront::Distribution
ELBv2AWS::ElasticLoadBalancingV2::LoadBalancer, AWS::ElasticLoadBalancingV2::TargetGroup, AWS::ElasticLoadBalancingV2::Listener
Auto ScalingAWS::AutoScaling::AutoScalingGroup, AWS::AutoScaling::LaunchConfiguration
SESAWS::SES::Template
ACMAWS::CertificateManager::Certificate
CloudTrailAWS::CloudTrail::Trail
BackupAWS::Backup::BackupVault, AWS::Backup::BackupPlan
Transfer FamilyAWS::Transfer::Server, AWS::Transfer::User
GlueAWS::Glue::Database, AWS::Glue::Table
AthenaAWS::Athena::WorkGroup
OpenSearchAWS::OpenSearchService::Domain
ShieldAWS::Shield::Protection
WAF v2AWS::WAFv2::WebACL
AppRegistryAWS::ServiceCatalogAppRegistry::Application, AWS::ServiceCatalogAppRegistry::ResourceAssociation
CloudFormationAWS::CloudFormation::Stack (nested stacks), AWS::CloudFormation::CustomResource, Custom::* (resolved dynamically, in addition to the 136 static handlers)

Stubs

Recognised, and answered with a synthetic physical ID so the stack can complete. No real resources are created.

  • AWS::SQS::QueuePolicy
  • AWS::ApiGateway::Account
  • AWS::ApiGatewayV2::Deployment
  • AWS::ElastiCache::ParameterGroup
  • AWS::SES::ConfigurationSet
  • AWS::Events::Connection
  • AWS::CDK::Metadata
  • AWS::CloudFormation::WaitConditionHandle
  • AWS::CloudFormation::WaitCondition

Unknown resource types

A type in neither table is handled permissively: it receives a synthetic physical ID (<stackName>-<logicalId>-stub) and succeeds. A template with unsupported types deploys, and those resources have no backing state — see CDK limitations § Partial resource coverage for how to see which resources were stubbed.

Fn::GetAtt

For a provisioned resource, Fn::GetAtt resolves to the real attribute value: !GetAtt MyVPC.VpcId returns the VPC ID the EC2 service created. The supported attributes per resource type are listed in the CloudFormation service reference.