Skip to main content

atmos aws cloudformation output

Show the deployed stack's Outputs (DescribeStacks), formatted for consumption by shells, other tools, or other Atmos components. apply renders this same view automatically at the end of a successful deploy.

Experimental
atmos aws cloudformation output --help

Usage​

atmos aws cloudformation output <component> [key] --stack <stack> [options]
atmos aws cloudformation output vpc -s plat-ue2-dev

Print a single Output by its key. The value is written bare, so it is safe to use in a shell pipeline:

atmos aws cloudformation output vpc VpcId -s plat-ue2-dev
VPC_ID=$(atmos aws cloudformation output vpc VpcId -s plat-ue2-dev)

Choose an output format:

atmos aws cloudformation output vpc -s plat-ue2-dev --format=json
atmos aws cloudformation output vpc -s plat-ue2-dev --format=env
atmos aws cloudformation output vpc -s plat-ue2-dev --format=github

Flatten nested Outputs into compound keys, or uppercase every key:

atmos aws cloudformation output vpc -s plat-ue2-dev --format=dotenv --flatten --uppercase

Show output for all or affected components:

atmos aws cloudformation output --all -s plat-ue2-dev
atmos aws cloudformation output --affected --base origin/main

With more than one component selected, the JSON and YAML formats print a single document keyed by stack and then by component, so the result stays parseable:

atmos aws cloudformation output --all --format=json
{
  "plat-ue2-dev": {
    "vpc": { "VpcId": "vpc-0123456789abcdef0" },
    "dns": { "ZoneId": "Z0123456789ABCDEFGHIJ" }
  }
}

The table format prints a heading naming the component and stack above each table. The other formats print each component's outputs in turn.

Arguments​

component (required unless --all/--affected/--tags/--labels is set)
The aws/cloudformation component.
key (optional)

The Output key to print on its own. With the default table format the value is written bare, one line, on stdout. With --format=json the value is JSON-encoded, with --format=yaml YAML-encoded, and the other formats render a single KEY=value-style entry. A key the stack does not have is an error that lists the keys it does have. A key cannot be combined with --all, --affected, --tags, or --labels.

Flags​

--stack, -s (required for a single component)
Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with --all/--affected.
--format (optional, default table)
Output format: json, yaml, hcl, env, dotenv, bash, csv, tsv, table, or github. An unsupported value is an error that names the value and lists the valid formats.
--flatten (optional)
Flatten nested Outputs into compound keys.
--uppercase (optional)
Uppercase Output keys.
--all (optional)
Process all aws/cloudformation components in dependency order.
--affected (optional)
Process affected aws/cloudformation components and their dependencies. Compares the working tree against a base: see --base and the Git flags below.
--include-dependents (optional)
With --affected, include dependent aws/cloudformation components.
--base (optional)
Git base ref or SHA to compare against for affected detection: --base=origin/main. A value that looks like a commit SHA is treated as --sha, anything else as --ref. Used with --affected.
--tags (optional)
Filter by tags (comma-separated, matches any): --tags=production,tier-1. Composes with --all/--affected to narrow the selected set further; cannot be combined with a single component argument.
--labels (optional)
Filter by labels (repeatable and/or comma-separated key=value or key:value pairs, matches all): --labels=cost-center=platform,compliance=sox. Composes with --all/--affected/--tags; cannot be combined with a single component argument.
--ci (optional)
Enable native CI integration (requires ci.enabled): writes the job summary and output variables for the operation. Also enabled by the CI and ATMOS_CI environment variables.
--ref (optional)
Git ref to compare against for affected detection. Used with --affected.
--sha (optional)
Git SHA to compare against for affected detection. Used with --affected.
--repo-path (optional)
Path to an already cloned target repository to use as the affected baseline. Used with --affected.
--clone-target-ref (optional)
Clone the target ref instead of checking it out in the current repository for affected detection. Used with --affected.
--ssh-key (optional)
Path to the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
--ssh-key-password (optional)
Password for the SSH private key used to clone the target ref for affected detection. Used with --clone-target-ref.
note

outputs is accepted as an alias for output.

Stack state​

The output command reads the deployed stack, so the stack has to be deployed:

  • A stack that is not deployed is an error: REVIEW_IN_PROGRESS (a preview changeset created by diff or plan on a component that was never applied), ROLLBACK_COMPLETE, ROLLBACK_FAILED, CREATE_FAILED, and the DELETE_* statuses. Apply the component, or delete a stack that is stuck in a failed create first.
  • A deployed stack that declares no Outputs prints Stack <name> has no outputs instead of an empty table. --format=json and the other structured formats still print an empty document, so pipelines keep getting parseable output.

JSON output is written without HTML escaping, so masked values read <MASKED>.

Masking​

With masking enabled, output and apply summaries require cloudformation:GetTemplate in addition to cloudformation:DescribeStacks. Atmos reads deployed NoEcho metadata without loading a local template or provisioning its source. Outputs referencing NoEcho parameters, including intrinsic expressions and indirect resource/condition dependencies, are conservatively redacted. Known parameter/default literals are masked too. Unreadable or malformed metadata stops presentation before raw values are printed. This also protects outputs when local parameters have changed.

--mask=false explicitly disables presentation masking. Internal YAML output lookups retain real values for component dependencies. Arbitrary transformed secrets without detectable template references cannot be recognized; keep secrets out of CloudFormation Outputs. Masking also applies when you print a single key.