Outputs for cross-stack references in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What is the output of this CloudFormation stack's output section?

Given this CloudFormation output configuration, what will be the value of the output named BucketNameOutput after deployment?

Outputs:
  BucketNameOutput:
    Description: "Name of the S3 bucket"
    Value: !Ref MyS3Bucket
    Export:
      Name: "MyApp-BucketName"

A The physical name of the S3 bucket resource created in this stack.

B The ARN of the S3 bucket resource.

C The region where the stack is deployed.

D The CloudFormation stack ID.

💡 Hint

The !Ref function returns the logical resource's name or ID depending on the resource type.

The !Ref function on an S3 bucket returns the bucket's name, which is the physical resource name. This is what the output exports for cross-stack use.

❓ Architecture

intermediate

Which option correctly describes how to import a value exported by another stack?

You have a CloudFormation stack exporting a value named MyApp-BucketName. How can another stack import this value to use it in a resource property?

A Use the intrinsic function !GetAtt with the export name, like !GetAtt MyApp-BucketName.

B Use the intrinsic function !Ref with the export name, like !Ref MyApp-BucketName.

C Directly reference the exporting stack's resource logical ID.

D Use the intrinsic function !ImportValue with the export name, like !ImportValue MyApp-BucketName.

💡 Hint

Look for the function designed to import exported values across stacks.

The !ImportValue function imports a value exported by another stack using the export name. !Ref and !GetAtt do not work for cross-stack imports.

❓ security

advanced

What is a security risk when exporting sensitive information in stack outputs?

If a CloudFormation stack exports a secret key or password in its Outputs section, what is the main security risk?

A Anyone with access to the AWS account can view the exported secret in the CloudFormation console or API.

B The secret is automatically encrypted and safe to export.

C The secret is only visible to the stack creator and cannot be accessed by others.

D Exported outputs are not stored and thus pose no risk.

💡 Hint

Consider who can view stack outputs and exports in AWS.

Stack outputs are visible to anyone with permissions to view the stack, so exporting secrets can expose them unintentionally.

❓ Configuration

advanced

What error occurs if two stacks export outputs with the same name?

Two CloudFormation stacks export outputs with the same export name MyApp-BucketName. What happens when you try to deploy the second stack?

A The second stack overwrites the first stack's export silently.

B Deployment fails with a validation error about duplicate export names.

C Both stacks deploy successfully without any conflict.

D The second stack's export is ignored and not created.

💡 Hint

Export names must be unique across all stacks in an AWS account and region.

CloudFormation requires export names to be unique. Duplicate export names cause deployment validation errors.

✅ Best Practice

expert

Which approach best ensures stable cross-stack references when stack resources are renamed or replaced?

You want to export a resource identifier for cross-stack use, but the resource's logical ID or physical name might change during updates. What is the best practice to maintain stable references?

A Avoid exporting and instead hardcode values in dependent stacks.

B Export the resource's logical ID directly, assuming it never changes.

C Export a fixed, manually specified parameter or resource attribute that does not change on updates.

D Export the resource's physical ID generated by CloudFormation, even if it changes on replacement.

💡 Hint

Think about what stays constant even if the resource is replaced.

Exporting a stable, manually set value (like a parameter or a fixed resource attribute) avoids breaking references if logical or physical IDs change.