Struct ResourceProvisioner 

pub struct ResourceProvisioner {

    pub sqs_state: SharedSqsState,
    pub sns_state: SharedSnsState,
    pub ssm_state: SharedSsmState,
    pub iam_state: SharedIamState,
    pub s3_state: SharedS3State,
    pub eventbridge_state: SharedEventBridgeState,
    pub dynamodb_state: SharedDynamoDbState,
    pub logs_state: SharedLogsState,
    pub lambda_state: SharedLambdaState,
    pub secretsmanager_state: SharedSecretsManagerState,
    pub kinesis_state: SharedKinesisState,
    pub kms_state: SharedKmsState,
    pub ecr_state: SharedEcrState,
    pub cloudwatch_state: SharedCloudWatchState,
    pub elbv2_state: SharedElbv2State,
    pub organizations_state: SharedOrganizationsState,
    pub cognito_state: SharedCognitoState,
    pub rds_state: SharedRdsState,
    pub ec2_state: SharedEc2State,
    pub autoscaling_state: SharedAutoScalingState,
    pub batch_state: SharedBatchState,
    pub pipes_state: SharedPipesState,
    pub ecs_state: SharedEcsState,
    pub acm_state: SharedAcmState,
    pub elasticache_state: SharedElastiCacheState,
    pub route53_state: SharedRoute53State,
    pub cloudfront_state: SharedCloudFrontState,
    pub stepfunctions_state: SharedStepFunctionsState,
    pub wafv2_state: SharedWafv2State,
    pub apigateway_state: SharedApiGatewayState,
    pub apigatewayv2_state: SharedApiGatewayV2State,
    pub ses_state: SharedSesState,
    pub app_autoscaling_state: SharedApplicationAutoScalingState,
    pub athena_state: SharedAthenaState,
    pub firehose_state: SharedFirehoseState,
    pub glue_state: SharedGlueState,
    pub cloudformation_state: SharedCloudFormationState,
    pub delivery: Arc<DeliveryBus>,
    pub lambda_runtime: Option<Arc<ContainerRuntime>>,
    pub rds_runtime: Option<Arc<RdsRuntime>>,
    pub ec2_runtime: Option<Arc<Ec2Runtime>>,
    pub ecs_runtime: Option<Arc<EcsRuntime>>,
    pub elasticache_runtime: Option<Arc<ElastiCacheRuntime>>,
    pub pending_container_spawns: Arc<Mutex<Vec<ContainerSpawnIntent>>>,
    pub pending_container_teardowns: Arc<Mutex<Vec<ContainerTeardownIntent>>>,
    pub pending_custom_invokes: Arc<Mutex<Vec<CustomInvokeIntent>>>,
    pub defer_custom_invokes: bool,
    pub s3_store: Arc<dyn S3Store>,
    pub account_id: String,
    pub region: String,
    pub stack_id: String,
    pub strict_unknown_types: bool,
}

Holds references to all service states so CloudFormation can provision resources.

Fields

sqs_state: SharedSqsState

sns_state: SharedSnsState

ssm_state: SharedSsmState

iam_state: SharedIamState

s3_state: SharedS3State

eventbridge_state: SharedEventBridgeState

dynamodb_state: SharedDynamoDbState

logs_state: SharedLogsState

lambda_state: SharedLambdaState

secretsmanager_state: SharedSecretsManagerState

kinesis_state: SharedKinesisState

kms_state: SharedKmsState

ecr_state: SharedEcrState

cloudwatch_state: SharedCloudWatchState

elbv2_state: SharedElbv2State

organizations_state: SharedOrganizationsState

cognito_state: SharedCognitoState

rds_state: SharedRdsState

ec2_state: SharedEc2State

autoscaling_state: SharedAutoScalingState

batch_state: SharedBatchState

pipes_state: SharedPipesState

ecs_state: SharedEcsState

acm_state: SharedAcmState

elasticache_state: SharedElastiCacheState

route53_state: SharedRoute53State

cloudfront_state: SharedCloudFrontState

stepfunctions_state: SharedStepFunctionsState

wafv2_state: SharedWafv2State

apigateway_state: SharedApiGatewayState

apigatewayv2_state: SharedApiGatewayV2State

ses_state: SharedSesState

app_autoscaling_state: SharedApplicationAutoScalingState

athena_state: SharedAthenaState

firehose_state: SharedFirehoseState

glue_state: SharedGlueState

cloudformation_state: SharedCloudFormationState

delivery: Arc<DeliveryBus>

lambda_runtime: Option<Arc<ContainerRuntime>>

Lambda container runtime for pre-pulling CFN-provisioned function images (see CloudFormationDeps::lambda_runtime). None outside a configured runtime (e.g. unit tests).

rds_runtime: Option<Arc<RdsRuntime>>

Container runtimes for stateful services whose CFN-provisioned resources must be backed by REAL containers. See CloudFormationDeps. None (no Docker/Podman, e.g. CI/unit tests) keeps metadata-only provisioning.

ec2_runtime: Option<Arc<Ec2Runtime>>

ecs_runtime: Option<Arc<EcsRuntime>>

elasticache_runtime: Option<Arc<ElastiCacheRuntime>>

pending_container_spawns: Arc<Mutex<Vec<ContainerSpawnIntent>>>

Intents queued by container-backed provisioners during the synchronous provisioning pass. After provisioning, CreateStack drains these and backs each freshly-inserted record with a real container in the background (so CreateStack returns without blocking on a container boot — the #1539/#1730 timeout lesson). Shared via Arc so the drain can read it after the provisioner is moved into spawn_blocking.

pending_container_teardowns: Arc<Mutex<Vec<ContainerTeardownIntent>>>

Teardown intents queued by container-backed delete provisioners during a synchronous delete pass (stack delete, or a stack update that removes a resource). The in-memory record is removed synchronously (so DescribeStacks reflects the deletion at once); the REAL backing container is reaped in the background by the CloudFormation delete drain, mirroring pending_container_spawns for teardown. Without this drain a stack delete would leak the running RDS / ElastiCache / ECS / EC2 containers (the create-side #2031-#2034 hardening never reached delete).

pending_custom_invokes: Arc<Mutex<Vec<CustomInvokeIntent>>>

Custom-resource (Custom::*) Lambda invoke intents queued during a changeset/update provision when defer_custom_invokes is set. Invoking the Lambda synchronously (invoke_lambda_sync) can cold-pull a container image for minutes – far past the client’s 60s read timeout – and, on the changeset/update path, it ran while holding the CloudFormation state write lock, stalling every other CFN op behind it. Queueing here lets the caller drain + tokio::spawn the invokes off the request path after the lock is dropped, mirroring how CreateStack provisions custom resources off the request path.

defer_custom_invokes: bool

When true, create_custom_resource / delete_custom_resource queue their Lambda invoke onto pending_custom_invokes instead of running it synchronously. Set on the changeset/update/delete provisioners; left false for CreateStack (which already provisions off the request path in a detached task, so its synchronous invoke never blocks the client or the state lock).

s3_store: Arc<dyn S3Store>

Fine-grained S3 disk store. Bucket create/delete (and bucket-policy updates) write through this so a CFN-provisioned bucket lands on disk, matching the real CreateBucket/DeleteBucket handlers. A MemoryS3Store (memory mode) makes the writes no-ops.

account_id: String

region: String

stack_id: String

strict_unknown_types: bool

When true, create_resource’s fallback arm for unmodeled resource types returns an error instead of recording a phantom resource with no backing state. Cloud Control API sets this so CreateResource rejects a TypeName fakecloud has no provisioner for, rather than reporting success for a resource Get/List would then surface with no owning service state. CreateStack leaves it false to keep accepting full templates (SAM/CDK output routinely includes types fakecloud does not model).

Implementations

impl ResourceProvisioner

pub fn create_resource( &self, resource: &ResourceDefinition, ) -> Result<StackResource, String>

Create a resource and return the StackResource with physical ID.

pub fn update_resource( &self, existing: &StackResource, new_def: &ResourceDefinition, ) -> Result<Option<StackResource>, String>

Apply a property update to an existing stack resource. Returns Ok(Some(updated)) when the resource type supports in-place updates (the caller swaps the resulting StackResource for the old one) or Ok(None) when the type has no update path defined (the caller leaves the existing resource alone). Err propagates a resource-level failure up to the stack-level UPDATE_FAILED status.

pub fn get_att( &self, resource: &StackResource, attribute: &str, ) -> Option<String>

Resolve a Fn::GetAtt against a previously provisioned resource. Returns the attribute value as a string, or None if the resource type doesn’t expose that attribute (caller falls back to a placeholder so multi-pass provisioning can retry).

The lookup first checks attributes captured at create time on the StackResource, then falls back to live service-state queries for the well-known attribute names of each resource type. This means attributes that change after creation (e.g. Lambda FunctionUrl) resolve correctly even when the URL was added in a separate pass.

pub fn delete_resource(&self, resource: &StackResource) -> Result<(), String>

Delete a previously created resource.