Skip to main content

atmos aws cloudformation output

Show the deployed stack's Outputs (DescribeStacks), formatted for consumption by shells, other tools, or other Atmos components. apply renders this same view automatically at the end of a successful deploy.

Experimental
CloudFormation Configuration

Configure templates, parameters, and delivery targets for your component.

atmos aws cloudformation output --help

Usage​

atmos aws cloudformation output <component> [key] --stack <stack> [options]

Examples​

atmos aws cloudformation output vpc -s plat-ue2-dev

Print a single Output by its key. The value is written bare, so it is safe to use in a shell pipeline:

atmos aws cloudformation output vpc VpcId -s plat-ue2-dev
VPC_ID=$(atmos aws cloudformation output vpc VpcId -s plat-ue2-dev)

Choose an output format:

atmos aws cloudformation output vpc -s plat-ue2-dev --format=json
atmos aws cloudformation output vpc -s plat-ue2-dev --format=env
atmos aws cloudformation output vpc -s plat-ue2-dev --format=github

Flatten nested Outputs into compound keys, or uppercase every key:

atmos aws cloudformation output vpc -s plat-ue2-dev --format=dotenv --flatten --uppercase

Show output for all or affected components:

atmos aws cloudformation output --all -s plat-ue2-dev
atmos aws cloudformation output --affected --base origin/main

With more than one component selected, the JSON and YAML formats print a single document keyed by stack and then by component, so the result stays parseable:

atmos aws cloudformation output --all --format=json
{
  "plat-ue2-dev": {
    "vpc": { "VpcId": "vpc-0123456789abcdef0" },
    "dns": { "ZoneId": "Z0123456789ABCDEFGHIJ" }
  }
}

The table format prints a heading naming the component and stack above each table. The other formats print each component's outputs in turn.

Arguments​

component (required unless --all/--affected/--tags/--labels is set)
The aws/cloudformation component.
key (optional)

The Output key to print on its own. With the default table format the value is written bare, one line, on stdout. With --format=json the value is JSON-encoded, with --format=yaml YAML-encoded, and the other formats render a single KEY=value-style entry. A key the stack does not have is an error that lists the keys it does have. A key cannot be combined with --all, --affected, --tags, or --labels.

Flags​

--stack, -s (required for a single component)
Atmos stack. With bulk selection flags, limits the selected components to this stack.
--format (optional, default table)
Output format: json, yaml, hcl, env, dotenv, bash, csv, tsv, table, or github. An unsupported value is an error that names the value and lists the valid formats.
--flatten (optional)
Flatten nested Outputs into compound keys.
--uppercase (optional)
Uppercase Output keys.
--all (optional)
Process all aws/cloudformation components. Deployment runs dependencies first; deletion runs consumers first.
--affected (optional)
Process affected aws/cloudformation components and their dependencies. Compares the working tree against a base: see --base and the Git flags below.
--include-dependents (optional)
With --affected, include dependent aws/cloudformation components.
--base (optional)
Git base ref or SHA to compare against for affected detection: --base=origin/main. A value that looks like a commit SHA is treated as --sha, anything else as --ref. Used with --affected.
--tags (optional)
Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.
--labels (optional)
Filter by labels (repeatable and/or comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.
--ci (optional)
Enable CI integration for supported operations when ci.enabled is configured. Summary and output-variable publishing use their respective CI settings. Also enabled by CI and ATMOS_CI.
--ref (optional)
Git ref to compare against for affected detection. Used with --affected.
--sha (optional)
Git SHA to compare against for affected detection. Used with --affected.
--repo-path (optional)
Path to an already cloned target repository to use as the affected baseline. Used with --affected.
--clone-target-ref (optional)
Clone the target ref instead of checking it out in the current repository for affected detection. Used with --affected.
--ssh-key (optional)
Path to the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
--ssh-key-password (optional)
Password for the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
note

outputs is accepted as an alias for output.

Stack state​

The output command reads the deployed stack, so the stack has to be deployed:

  • A stack that is not deployed is an error: REVIEW_IN_PROGRESS (a preview changeset created by diff or plan on a component that was never applied), ROLLBACK_COMPLETE, ROLLBACK_FAILED, CREATE_FAILED, and the DELETE_* statuses. Apply the component, or delete a stack that is stuck in a failed create first.
  • A deployed stack that declares no Outputs prints Stack <name> has no outputs instead of an empty table. --format=json and the other structured formats still print an empty document, so pipelines keep getting parseable output.

JSON output is written without HTML escaping, so masked values read <MASKED>.

Masking​

With masking enabled, output presentation requires both cloudformation:GetTemplate and cloudformation:DescribeStacks. Atmos reads the deployed template's NoEcho metadata, without requiring a local template or source download.

Values Masked​

  • Outputs that reference NoEcho parameters, including intrinsic expressions and indirect resource or condition dependencies.
  • Known parameter and default literals registered for masking.
  • A single selected output key, using the same rules as the full output listing.

Unreadable or malformed template metadata stops presentation before values are printed. Changes to local parameters do not bypass deployed-template masking.

Limits and Overrides​

Use --mask=false to disable presentation masking. Internal YAML output lookups return real values for component dependencies.

Secrets transformed in ways that leave no detectable template reference may not be recognized. Keep secrets out of CloudFormation outputs.

Try it out​

Copy the example into a new directory and make it your own:

atmos init examples/cloudformation
cd cloudformation

Requires Docker or Podman, Python 3, and network access for the emulator image. Run against the local AWS emulator; the final commands clean up. No AWS account is needed.

atmos config set aliases.cft "aws cloudformation"
atmos emulator up aws -s local
atmos cft deploy demo -s local
atmos cft output demo -s local
atmos cft delete demo -s local --auto-approve
atmos emulator down aws -s local
Explore the example →Initialization and repository settings