Features: provisioning

The SDK, not a template language.

A stack in Foundry is a flat list of resources. Each one has an AWS type, AWS property names, and nothing between you and boto3: no Terraform, no CloudFormation templates, no CDK.

Illustration: a machinist's tool wall with every tool hanging in its own place, and one bench drawer open under an amber lamp.

What you declare

Resource types

Foundry registers 140 resource types, named the way CloudFormation names them. A resource is its type, a logical ID, its properties, the dependencies it names, and, once it exists, the physical ID AWS gave it.

Networking: AWS::EC2::VPC, AWS::EC2::Subnet, AWS::EC2::SecurityGroup, AWS::EC2::VPCEndpoint, and 22 more EC2 types
Compute and containers: AWS::ECS::Service, AWS::Lambda::Version, load balancers, and auto scaling
Data: AWS::RDS::DBInstance, AWS::ElastiCache::ReplicationGroup, AWS::ElastiCache::ParameterGroup, AWS::S3::Bucket
Edge, identity, and security: AWS::CloudFront::Distribution, AWS::Route53::RecordSet, AWS::KMS::Key, AWS::IAM::Role, AWS::WAFv2::WebACL, AWS::Cognito::UserPool

Counted from the resource registry on 10/29/2026. A type that is not in the registry is rejected, never guessed.

How a change runs

Plan, apply, destroy

Declare
Add or change resources in a stack, in the console or through the agent tools.
Plan
Foundry resolves the Ref and GetAtt references between resources, orders them, and diffs the declaration against live state. Every create, update, replace, and destroy is listed before anything happens.
Apply
The plan runs through the governance validator and the pre-flight gates, then boto3 executes it. The deployment is recorded with its plan and the outcome of each resource.
Converge
Plan again and a converged stack has an empty diff. Destroy tears a stack down in reverse order.

History you can go back to

Versions, releases, and drift

Stack versions

Changes are saved as immutable versions you can list, diff against each other, and roll back to.

Releases

A release groups changes across stacks. It is planned, approved, applied, and can be rolled back, and a stuck release can be reconciled.

Drift detection

Compare a stack's declared resources with what is live and list the differences.

Careful types

ElastiCache parameter groups plan a flagged reboot note, and a reboot is a separate, audited request. A CloudFront distribution that names a Lambda version follows each new version in the same release.

Bring in what exists

Import

Import live resources into a stack with their physical IDs attached. The next plan on the imported stack is empty, so nothing is rebuilt. Renkara used it to bring infrastructure that earlier tools had created under Foundry's management.

Screens