Parameters
Every stack parameter and output, grouped as the CloudFormation console shows them.
The groups below match the CloudFormation console's parameter page. "Required" means the launch fails without a value; some parameters are required only in a particular setup, as noted.
Changing a parameter later is a stack update. Leave every parameter you aren't changing at its previous value: an AWS CLI update that omits a parameter resets it to the template default.
Deployment
| Parameter | Required | Default | Meaning |
|---|---|---|---|
TenantName | yes | Your organisation's display name in the console (1 to 80 characters). | |
TenantSlug | yes | URL slug for your organisation: 3 to 50 lowercase letters, digits and hyphens, not starting or ending with a hyphen. | |
AdminEmail | no | empty | Email of the first owner. With single sign-on configured, the first federated sign-in with this address becomes owner. Leave empty to bootstrap through emergency access. |
EntitlementSet | no | teams-v1 | Capability bundle. teams-v1 is the only one offered. |
Ring | no | general | Release ring: general or early. Design partners run early. |
ContentFeedBaseUrl | no | https://dl.tracemill.io | Origin of the release and content feed: https, no path. |
DeploymentReport | yes | none | enabled or disabled, deliberately without a default. Records whether you consent to the deployment report (version, licence state, health summary and content state; never run data, telemetry or identities). This release sends no report either way. |
SentryReporting | no | disabled | enabled sends crash and error reports to Tracemill's Sentry. |
AlertEmail | no | empty | Subscribed to the stack's SNS topic: release applied, release failed to start, update refused. |
Console hostname and certificate
| Parameter | Required | Default | Meaning |
|---|---|---|---|
ConsoleHostname | yes | The console hostname in your domain, such as tracemill.example.com. | |
CertificateArn | yes | ACM certificate for ConsoleHostname, issued in the stack's Region. | |
PrivateHostedZoneId | no | empty | A Route 53 private hosted zone. When set, the stack creates an alias record for ConsoleHostname in it. |
AlbScheme | no | internet-facing | internal keeps the console reachable only from your network. |
AllowedIngressCidr | no | 0.0.0.0/0 | Source IPv4 CIDR allowed to reach the load balancer on ports 443 and 80 (80 only redirects to 443). |
EnableWaf | no | true | Attach an AWS WAF rate-limiting web ACL to the load balancer. Billed to your account. |
Network
Leave VpcId empty to have the stack create a VPC.
| Parameter | Required | Default | Meaning |
|---|---|---|---|
VpcId | no | empty | An existing VPC id, or empty to create one. |
VpcCidr | no | 10.30.0.0/16 | The VPC's CIDR. For a created VPC it must be /16 to /18 (it's split into four /20 subnets). For an existing VPC, give that VPC's CIDR. It's always used as the trusted-proxy range. |
AvailabilityZones | with a created VPC | empty | Exactly two Availability Zones that offer DbInstanceClass with gp3 storage. See Launch for the lookup command. Ignored when VpcId is set. |
PrivateSubnetIds | with an existing VPC | empty | Comma-separated private subnet ids in two AZs, with outbound internet access. |
PublicSubnetIds | with an existing VPC and an internet-facing load balancer | empty | Comma-separated public subnet ids in two AZs. |
Database
Leave ExistingDbInstanceIdentifier empty to have the stack create a database.
| Parameter | Required | Default | Meaning |
|---|---|---|---|
ExistingDbInstanceIdentifier | no | empty | An existing RDS for PostgreSQL 17 instance identifier. Its security group must allow the stack's server security group on 5432. |
ExistingDbEndpointAddress | with an existing database | empty | That instance's endpoint address. |
ExistingDbMasterSecretArn | with an existing database | empty | Secrets Manager secret holding {"username","password"} for the instance's master user. |
ExistingDbSecretKmsKeyArn | no | empty | Only if that secret is encrypted with a customer-managed KMS key: the key's ARN. |
ExistingDataEncKeySecretArn | no | empty | Only when moving another deployment's database snapshot into this stack: that deployment's retained data-encryption-key secret (tracemill/<stack>-<id>/data-enc-key). Encrypted fields can't be read without it. |
DbInstanceClass | no | db.t3.medium | Instance class of a created database. |
DbAllocatedStorage | no | 50 | Storage in GiB for a created database (20 to 2000). |
DbMultiAz | no | true | Multi-AZ for a created database. |
DbBackupRetentionDays | no | 7 | Automated backup retention for a created database, which is also its point-in-time recovery window (1 to 35). |
SnapshotRetentionDays | no | 35 | Days to keep the snapshot taken before each migration-crossing update (0 keeps them forever). The newest one is always kept. |
The stack refuses any update that would replace or delete the database it created. Changing the network parameters of a running stack would do that, so such an update fails and leaves the database untouched.
Single sign-on
Optional at launch; you can configure it later from the console. See Single sign-on.
| Parameter | Required | Default | Meaning |
|---|---|---|---|
SsoType | no | none | none, saml or oidc. none means you'll configure it later and bootstrap through emergency access. |
IdpName | no | corporate | The identity provider's name inside Cognito: up to 32 letters, digits, hyphens or underscores. Changing it after members exist locks them all out; see Changing the identity provider. Switching between saml and oidc requires a new name. |
SamlMetadataUrl | with saml | empty | Your IdP's SAML metadata URL (https). |
OidcIssuer | with oidc | empty | Your OIDC issuer URL (https). |
OidcClientId | with oidc | empty | The OIDC client id. |
OidcClientSecret | no | empty | The OIDC client secret. Hidden in the console; never carried by the console's links, so you paste it on the update page. |
OidcScopes | no | openid email profile | Scopes requested from the OIDC provider. |
EmailAttribute | no | the SAML emailaddress claim URI | The IdP attribute carrying the user's email: a SAML claim URI, or email for OIDC. |
Emergency access
See Emergency access.
| Parameter | Required | Default | Meaning |
|---|---|---|---|
EmergencyAccessMode | no | mfa-iam-users | Who may assume the emergency role: mfa-iam-users, identity-center or supplied. |
EmergencyPrincipalArn | with identity-center or supplied | empty | identity-center: the permission-set role ARN pattern, arn:aws:iam::<account>:role/aws-reserved/sso.amazonaws.com/*AWSReservedSSO_<set>_* (never a / directly after a *). supplied: the role to use as the emergency role. |
Updates and sizing
See Updates.
| Parameter | Required | Default | Meaning |
|---|---|---|---|
AutoApply | no | disabled | enabled applies the ring's head release on AutoApplySchedule. Requires AutoApplyRoleArn. |
AutoApplyRoleArn | with AutoApply enabled | empty | A role you create that auto-apply assumes to update the stack. |
AutoApplySchedule | no | cron(0 3 ? * SUN *) | EventBridge schedule expression, in UTC. |
AutoApplyMaxDeferMinutes | no | 120 | How long auto-apply waits while runs are in progress before it proceeds anyway (0 to 1440). |
TransitionTimeoutSeconds | no | 3300 | Budget for stop, snapshot and migrate during a release change (900 to 3600). CloudFormation caps it at one hour. |
DesiredCount | no | 1 | Number of server tasks (1 to 4). |
TaskCpu | no | 1024 | Fargate CPU units per server task: 512, 1024 or 2048. |
TaskMemory | no | 2048 | Fargate memory (MiB) per server task: 1024, 2048 or 4096. |
OperationAttempt | no | 1 | Attempt id for the release change. The console's Updates page fills in a new one for each update and retry. Never reuse one. |
ImageUriOverride | no | empty | Tracemill support use only. Leave empty. |
Outputs
| Output | Meaning |
|---|---|
ConsoleUrl | https://<ConsoleHostname>. |
DeploymentId | The deployment's id (the stack id's unique part). Its first block is the short id used in resource names. |
Region | The stack's Region. |
EmergencyRoleArn | The role to assume for emergency access. |
CognitoSamlAcsUrl | Assertion Consumer Service URL for your SAML IdP. |
CognitoSamlEntityId | SP entity id for your SAML IdP. |
CognitoOidcRedirectUri | Redirect URI to register with your OIDC provider. |
ServerSecurityGroupId | Allow this group on 5432 in an existing database's security group. |
WorkspaceBucketName | The S3 workspace bucket. |
AlbDnsName | Point ConsoleHostname at this name. |
ClusterName | The ECS cluster (named after the stack). |
TransitionStatePrefix | SSM parameter path holding the release ledger mirror (.../last, .../installed). |
LastSnapshotNamePattern | Name pattern of the pre-migration snapshots: tracemill-<short id>-*. |