The New CloudFormation Intrinsic Function Fn::GetStackOutput Now Enables Cross-Region and Cross-Account References Without Dependencies
This page has been translated by machine translation. View original
A new intrinsic function, Fn::GetStackOutput, has been added to CloudFormation. It natively enables cross-region and cross-account stack references, which were restricted with Fn::ImportValue, available since 2016.
I found out about this feature in AWS CDK PR #37724 (merged on May 1, 2026).
The PR description contains the following.
But CloudFormation has now released a new intrinsic function,
Fn::GetStackOutput, which, as the name suggests, gets the value of a arbitrary output. This function works cross-region and cross-account.
In this article, I actually verified its behavior and summarize the differences from the conventional Fn::ImportValue and its use cases.
Conventional Stack Reference Patterns and Their Limitations
To share values between stacks in CloudFormation, several patterns have traditionally been used.
For convenience, in this article the stack that outputs a value is called the "Producer" and the stack that references it is called the "Consumer". Also, a reference that comes with a deletion constraint between stacks, like Fn::ImportValue, is called "with dependency", and a reference without such a constraint is called "without dependency".
① Fn::ImportValue (with dependency)
This is a mechanism for sharing values between stacks, introduced in September 2016. The Consumer imports a value that the Producer has exported.
Its constraints are that an Export declaration (Export: Name:) is required, that it can only be used within the same region and the same account, and that while a Consumer is referencing it, the Producer cannot be deleted and the Export value cannot be changed.
② Via SSM Parameter Store (without dependency)
In this pattern, the Producer writes a value to an SSM parameter and the Consumer reads it with a dynamic reference. No dependency is created, but the problems were that the SSM parameter remains after the Producer is deleted, that it cannot be used across regions, and that an SSM resource must be added on the Producer side.
③ Passing arguments at the CLI level (without dependency)
In this pattern, you retrieve a value with describe-stacks and pass it to the Consumer with --parameter-overrides. The problem was that deployment scripts had to be managed and CI/CD pipelines became complicated.
What Is Fn::GetStackOutput
It is a new intrinsic function that can directly reference a stack's Output. It requires no Export declaration and supports cross-region and cross-account use.
The full syntax is as follows.
Fn::GetStackOutput:
StackName: <producer stack name>
OutputName: <output key name>
Region: ap-northeast-1 # Optional (same region if omitted)
RoleArn: arn:aws:iam::... # Optional (used for cross-account)
The YAML shorthand syntax can also be used (verified to work).
Value: !GetStackOutput
StackName: getstackoutput-producer
OutputName: MyValue
Region: ap-northeast-1
Comparison with Fn::ImportValue (with dependency vs. without dependency)
| Item | Fn::ImportValue (with dependency) | Fn::GetStackOutput (without dependency) |
|---|---|---|
| Same region, same account | ✅ | ✅ |
| Cross-region (same account) | ❌ | ✅ |
| Cross-account | ❌ | ✅ |
| Export declaration required | ✅ Required | ❌ Not required (a regular Output is fine) |
| Deleting the Producer | ❌ Blocked | ✅ Can be deleted |
| Reference integrity guarantee | ✅ The referenced target always exists | ⚠️ The reference breaks after the Producer is deleted |
| YAML shorthand | ✅ !ImportValue |
✅ !GetStackOutput |
| Listed in official documentation | ✅ Yes | ❌ Not listed (as of May 2026) |
All of the conventional patterns without dependency can be replaced with Fn::GetStackOutput.
Note that in all of these methods, values are resolved at deploy time (when the stack is created or updated). Even if the Producer's value changes, the Consumer does not follow automatically. The new value is reflected only after the Consumer is redeployed.
Guidelines for Choosing
Fn::GetStackOutput(without dependency): For cross-region and cross-account references, when the lifecycles of the Producer and Consumer are independent, or when you want flexibility in deleting and recreating stacksFn::ImportValue(with dependency): When you want to prevent accidental deletion of the Producer (e.g., when an application stack references the Subnet ID of a VPC stack)
Trying It Out
| # | Pattern | Producer | Consumer | Result |
|---|---|---|---|---|
| 1 | Cross-region | ap-northeast-1 | us-east-1 | ✅ |
| 2 | Same region (Region omitted) | ap-northeast-1 | ap-northeast-1 | ✅ |
| 3 | Shorthand syntax !GetStackOutput |
ap-northeast-1 | us-east-1 | ✅ |
Because it also works within the same region, it is useful as an alternative to Fn::ImportValue not only for cross-region use but whenever you want to share values between stacks without an Export declaration or dependency.
Producer Template (ap-northeast-1)
AWSTemplateFormatVersion: '2010-09-09'
Resources:
DummyParam:
Type: AWS::SSM::Parameter
Properties:
Name: /getstackoutput-test/dummy
Type: String
Value: hello-from-ap-northeast-1
Outputs:
MyValue:
Value: !GetAtt DummyParam.Value
Consumer Template (us-east-1)
AWSTemplateFormatVersion: '2010-09-09'
Resources:
DummyParam:
Type: AWS::SSM::Parameter
Properties:
Name: /getstackoutput-test/consumed-value
Type: String
Value:
Fn::GetStackOutput:
StackName: getstackoutput-producer
OutputName: MyValue
Region: ap-northeast-1
Outputs:
ConsumedValue:
Value: !GetAtt DummyParam.Value
Result
Let's check the Output of the Consumer stack.
OutputKey: ConsumedValue
OutputValue: hello-from-ap-northeast-1 ✅
I was able to retrieve the Producer's value in ap-northeast-1 from the Consumer in us-east-1 without a custom resource.
Gotcha: OutputName, Not OutputKey
The CDK source code used OutputKey, but the key name that CloudFormation actually requires is OutputName. Using OutputKey produces the following error.
ValidationError: GetStackOutput: OutputName is required
Comparison of Stack Deletion Behavior
I actually checked whether the Producer can be deleted while a Consumer is referencing it.
Case of Fn::ImportValue (with dependency)
$ aws cloudformation delete-stack --stack-name importvalue-producer
$ aws cloudformation describe-stacks --stack-name importvalue-producer \
--query 'Stacks[0].{StackStatus:StackStatus,StackStatusReason:StackStatusReason}'
{
"StackStatus": "CREATE_COMPLETE",
"StackStatusReason": "Delete canceled. Cannot delete export importvalue-test-MyValue as it is in use by importvalue-consumer."
}
The delete request is accepted but is canceled immediately. The stack remains in CREATE_COMPLETE.
Case of Fn::GetStackOutput (without dependency)
$ aws cloudformation delete-stack --stack-name getstackoutput-producer
$ aws cloudformation describe-stacks --stack-name getstackoutput-producer
An error occurred (ValidationError): Stack with id getstackoutput-producer does not exist
The Producer could be deleted even while the Consumer was referencing it.
What Happens If You Update the Consumer After Deleting the Producer
If you change the Consumer's template and update it after the Producer has been deleted, it results in UPDATE_FAILED and is rolled back.
Stack with id getstackoutput-producer does not exist
(Service: AmazonCloudFormation; Status Code: 400; Error Code: ValidationError)
Because there is no dependency, reference integrity must be managed on the user side. Possible operational measures include enabling Termination Protection on the Producer stack, and managing inter-stack dependencies in the CI/CD pipeline so that the Consumer's reference is removed before the Producer is deleted.
Use Case: CloudFront + ACM Certificate
A clear example of using Fn::GetStackOutput is the combination of CloudFront and an ACM certificate.
SSL certificates used with CloudFront can only be created in us-east-1, but in many cases the application stack is in ap-northeast-1. Previously, you had to pass the certificate ARN using a custom resource or an SSM parameter.
ACM Certificate Stack (us-east-1)
AWSTemplateFormatVersion: '2010-09-09'
Resources:
Certificate:
Type: AWS::CertificateManager::Certificate
Properties:
DomainName: app.example.com
ValidationMethod: DNS
DomainValidationOptions:
- DomainName: app.example.com
HostedZoneId: ZXXXXXXXXXXXXX
Outputs:
CertificateArn:
Value: !Ref Certificate
CloudFront Stack (ap-northeast-1)
AWSTemplateFormatVersion: '2010-09-09'
Resources:
Distribution:
Type: AWS::CloudFront::Distribution
Properties:
DistributionConfig:
Enabled: true
Aliases:
- app.example.com
ViewerCertificate:
AcmCertificateArn:
Fn::GetStackOutput:
StackName: acm-certificate-stack
OutputName: CertificateArn
Region: us-east-1
SslSupportMethod: sni-only
MinimumProtocolVersion: TLSv1.2_2021
Origins:
- Id: AppOrigin
DomainName: origin.example.com
CustomOriginConfig:
OriginProtocolPolicy: https-only
DefaultCacheBehavior:
TargetOriginId: AppOrigin
ViewerProtocolPolicy: redirect-to-https
CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
No custom resource or SSM parameter is needed. Everything is completed within the templates alone. I actually deployed this configuration and confirmed it works.
Other Useful Use Cases
- WAF WebACL + CloudFront: WAF for CloudFront also has to be created in us-east-1, which is the same situation
- Multi-region DR configuration: Reference the primary region's RDS cluster ARN or KMS key ARN from the DR region
- Security aggregation configuration: Reference the aggregation S3 bucket and SNS topic for Config / CloudTrail / GuardDuty from each region
- Shared resources across multiple accounts: Reference the Transit Gateway ID in the network account from a workload account (using
RoleArn)
Support in CDK
AWS CDK supports it in PR #37724 (merged on May 1, 2026).
The Fn.getStackOutput() method has been added, and crossRegionReferences: true has been deprecated. From now on, Fn::GetStackOutput will be used by default.
The conventional crossRegionReferences: true was internally implemented by combining SSM parameters with two Lambda custom resources (Writer / Reader). By migrating to Fn::GetStackOutput, managing Lambda functions, adding IAM roles, and increased deployment time are all eliminated.
Caveats and Constraints (as of May 2026)
- Not listed in official documentation: It is not yet described in the official AWS intrinsic function reference
- cfn-lint not supported: The linter may report errors
- IAM permissions: Within the same account and across regions, it worked without additional IAM configuration. For cross-account use, the role specified in
RoleArnneeds thecloudformation:DescribeStackspermission - Combination with Nested Stacks / StackSets: Not verified
Summary
Fn::GetStackOutput makes cross-region and cross-account stack references possible natively in CloudFormation. With no Export declaration, no custom resource, and no SSM parameter needed, templates become simpler.
However, unlike Fn::ImportValue, it has no dependency (deletion guard), so it is important to choose between them according to the use case. While waiting for it to be listed in the official documentation, I would like to keep an eye on the upcoming official release.
References
