AWS Cloudformation: Cross Stack Reference - amazon-web-services

Question

I have the following stack structure.
ParentStack:
ChildStack1
ChildStack2
What I need to do is to pass LambdaExecutionRole arn created in ChildStack2, having ChildStack2Name as a parameter, to ChildStack1.
Here are the snippets of my script
Parent Stack:
"Resources": {
"ChildStack1": {
"Type": "AWS::CloudFormation::Stack",
"Properties": {
"Parameters": {
"ChildStack2Name": {"Fn::GetAtt": ["ChildStack2", "Outputs.StackName"]}
},
....
ChildStack1:
"Parameters" {
"ChildStack2Name": {
"Type": "String",
"Description": "Name of commons stack"
},
...
"Resources": {
"Role": {
HERE I NEED A LambdaExecutionRole ARN CREATED IN CHILDSTACK2
}
}
ChildStack2
"Resources": {
"LambdaExecutionRole": {
.....
}
}
"Outputs": {
"LambdaExecutionRole": {
"Value": {"Fn::Join" : [ ":", [ { "Ref" : "AWS::StackName" }, "LambdaExecutionRole" ]]},
"Export": {
"Name": {
"Fn::Join" : [ ":", [ { "Ref" : "AWS::StackName" }, "LambdaExecutionRole" ]]
}
}
},
"StackName": {
"Value": {"Ref": "AWS::StackName"},
"Export": {
"Name": {"Ref": "AWS::StackName"}
}
}
}
}
I'm new to cloudformation and probably these snippets could be refactored in some way.
Thank you.

Answer 1

First, you should output the LambdaExecutionRole's ARN from the template. Example below is assuming the resource LambdaExecutionRole in ChildStack2 is an AWS::IAM::Role type and the output name is LambdaExecutionRoleARN.
"Outputs": {
"LambdaExecutionRole": {
"Value": {"Fn::Join" : [ ":", [ { "Ref" : "AWS::StackName" }, "LambdaExecutionRole" ]]},
"Export": {
"Name": {
"Fn::Join" : [ ":", [ { "Ref" : "AWS::StackName" }, "LambdaExecutionRole" ]]
}
}
},
"LambdaExecutionRoleARN": {
"Value": {"Fn::GetAtt" : ["LambdaExecutionRole", "Arn"]}
},
Next, in ChildStack1, add another parameter to hold the ARN value that will be passed from Parent Stack. Then you can Ref the parameter into Role resource.
"Parameters" {
"ChildStack2Name": {
"Type": "String",
"Description": "Name of commons stack"
},
"LambdaExecutionRoleArn": {
"Type": "String",
"Description": "Lambda Execution Role's ARN"
},
...
"Resources": {
"Role": {
// Here use { "Ref": "LambdaExecutionRoleArn"} to get the value of the parameters
}
}
Then in your Parent Stack, you can pass the ARN from ChildStack2 to ChildStack 1 using Fn::GetAtt
"Resources": {
"ChildStack1": {
"Type": "AWS::CloudFormation::Stack",
"Properties": {
"Parameters": {
"ChildStack2Name": {"Fn::GetAtt": ["ChildStack2", "Outputs.StackName"]}
"LambdaExecutionRoleArn": {"Fn::GetAtt": ["ChildStack2", "Outputs.LambdaExecutionRoleARN"]}
},
....