AWS resource plugin for formae. This plugin enables Formae to manage AWS resources using the AWS Cloud Control API.

This plugin supports 209 AWS resource types across 21 services via the CloudControl API:

See schema/pkl/ for the complete list of supported resource types.

Configure an AWS target in your Forma file:

import "@formae/formae.pkl"
import "@aws/aws.pkl"

target: formae.Target = new formae.Target {
  label = "aws-target"
  config = new aws.Config {
    region = "us-east-1"
    // Optional: specify a named profile
    // profile = "my-profile"
  }
}

The plugin uses the standard AWS credential chain. Configure credentials using one of:

Environment Variables:

export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export AWS_REGION="us-east-1"

# For temporary credentials (e.g., from STS AssumeRole)
export AWS_SESSION_TOKEN="your-session-token"

Named Profile:

# Use a profile from ~/.aws/credentials
export AWS_PROFILE="my-profile"

IAM Instance Profile / ECS Task Role: When running on EC2 or ECS, credentials are automatically retrieved from the instance metadata service.

OIDC (for CI/CD): See .github/workflows/ci.yml for an example using GitHub Actions OIDC with aws-actions/configure-aws-credentials.

See the examples/ directory for usage examples.

# Evaluate an example
formae eval examples/complete/lifeline/basic_infrastructure.pkl

# Apply resources
formae apply --mode reconcile --watch examples/complete/lifeline/basic_infrastructure.pkl

This plugin is licensed under the Functional Source License, Version 1.1, ALv2 Future License (FSL-1.1-ALv2).

Copyright 2026 Platform Engineering Labs Inc.