AWS AWSCloudFormation documentation change
Summary
Added documentation for Fn::GetStackOutput function to reference stack outputs without exports, including comparison table between Export+Fn::ImportValue and Fn::GetStackOutput capabilities.
Security assessment
The change introduces Fn::GetStackOutput as an alternative to exports, highlighting security implications like weak references (no deletion protection) and cross-account/region capabilities. It adds security documentation by explaining referential integrity trade-offs.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/using-cfn-stack-exports.md b/AWSCloudFormation/latest/UserGuide/using-cfn-stack-exports.md index b99b188b0..8c74dfa7f 100644 --- a//AWSCloudFormation/latest/UserGuide/using-cfn-stack-exports.md +++ b//AWSCloudFormation/latest/UserGuide/using-cfn-stack-exports.md @@ -7 +7 @@ -Exporting stack output values versus using nested stacksConsiderationsListing exported output valuesListing stacks that import an exported output value +Exporting stack output values versus using nested stacksConsiderationsListing exported output valuesListing stacks that import an exported output valueReferencing outputs without exports @@ -44 +44 @@ The following restrictions apply to cross-stack references: - * You can't create cross-stack references across Regions. You can use the intrinsic function `Fn::ImportValue` to import only values that have been exported within the same Region. + * When using `Export` and `Fn::ImportValue`, cross-stack references are limited to the same account and Region. To reference stack outputs across accounts or Regions, use `Fn::GetStackOutput`. @@ -137,0 +138,26 @@ Once you know which stacks are importing a particular exported value, you need t +## Referencing outputs without exports + +In addition to using `Export` and `Fn::ImportValue` for cross-stack references, you can use `Fn::GetStackOutput` to reference stack outputs directly. This approach does not require the referenced stack to declare an export and supports cross-account and cross-Region references. + +The following table compares the two approaches: + +Comparison of Export with Fn::ImportValue and Fn::GetStackOutput Capability | Export + `Fn::ImportValue` | `Fn::GetStackOutput` +---|---|--- +Same account, same Region | Supported | Supported +Cross-account | Not supported | Supported +Cross-Region | Not supported | Supported +Requires explicit Export | Yes | No +Reference type | Strong (blocks deletion of exporting stack) | Weak (resolved at deploy time) +Referential integrity | Enforced | Not enforced + +When to use each approach: + + * Use `Export` and `Fn::ImportValue` when you need strong referential integrity. With this approach, CloudFormation prevents you from deleting a stack that exports values consumed by other stacks, protecting you from accidentally breaking dependencies. + + * Use `Fn::GetStackOutput` when you need to reference outputs across accounts or Regions, or when you prefer not to manage explicit exports. Be aware that `Fn::GetStackOutput` creates a weak reference. If the referenced stack or output is deleted, the consuming stack is not notified, and subsequent operations that re-resolve the reference will fail. + + + + +For more information, see [Fn::GetStackOutput](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getstackoutput.html) in the __. +