AWS resource plugin for formae. This plugin enables formae to manage AWS resources using the AWS Cloud Control API.

formae · Hub · Configuration · Supported resources

Requires the formae CLI: see the quick start.

formae plugin install aws

Also included in the default plugin set: formae plugin install standard.

Restart the formae agent afterwards so it loads the plugin.

New project: with the agent running, formae project init --include aws my-project creates my-project with a PklProject that declares the formae and aws schema packages, so import "@aws/..." resolves, and a starter main.pkl. Don't run it in an existing project: it overwrites both files.

Existing project: add the plugin to dependencies in your PklProject, with the current version from the hub page, then run pkl project resolve:

["aws"] {
  uri = "package://hub.platform.engineering/plugins/aws/schema/pkl/aws/aws@<version>"
}

Next: write your first forma, then formae apply (see apply modes).

With an AI coding assistant, use the formae plugin (formerly formae-mcp), which can search the hub and fetch plugin examples. The formae documentation is also available as llms.txt.

This plugin supports 246 AWS resource types across 28 services via the CloudControl API:

See schema/pkl/ for the complete list of supported resource types.

Configure an AWS target in your Forma file:

import "@formae/formae.pkl"
import "@aws/aws.pkl"

target: formae.Target = new formae.Target {
  label = "aws-target"
  config = new aws.Config {
    region = "us-east-1"
    // Optional: specify a named profile
    // profile = "my-profile"
  }
}

The plugin uses the standard AWS credential chain. Configure credentials using one of:

Environment Variables:

export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export AWS_REGION="us-east-1"

# For temporary credentials (e.g., from STS AssumeRole)
export AWS_SESSION_TOKEN="your-session-token"

Named Profile:

# Use a profile from ~/.aws/credentials
export AWS_PROFILE="my-profile"

IAM Instance Profile / ECS Task Role: When running on EC2 or ECS, credentials are automatically retrieved from the instance metadata service.

OIDC (for CI/CD): See .github/workflows/ci.yml for an example using GitHub Actions OIDC with aws-actions/configure-aws-credentials.

See the examples/ directory for usage examples.

# Evaluate an example
formae eval examples/complete/lifeline/basic_infrastructure.pkl

# Apply resources
formae apply --mode reconcile --watch examples/complete/lifeline/basic_infrastructure.pkl

This plugin is licensed under the Functional Source License, Version 1.1, ALv2 Future License (FSL-1.1-ALv2).

Copyright 2026 Platform Engineering Labs Inc.