# atmos aws cloudformation output

Show the deployed stack's `Outputs` (`DescribeStacks`), formatted for
consumption by shells, other tools, or other Atmos components. `apply`
renders this same view automatically at the end of a successful deploy.

> ⚠️ Experimental

## Usage

```shell
atmos aws cloudformation output <component> [key] --stack <stack> [options]
```

```shell
atmos aws cloudformation output vpc -s plat-ue2-dev
```

Print a single Output by its key. The value is written bare, so it is safe to use in a shell
pipeline:

```shell
atmos aws cloudformation output vpc VpcId -s plat-ue2-dev
VPC_ID=$(atmos aws cloudformation output vpc VpcId -s plat-ue2-dev)
```

Choose an output format:

```shell
atmos aws cloudformation output vpc -s plat-ue2-dev --format=json
atmos aws cloudformation output vpc -s plat-ue2-dev --format=env
atmos aws cloudformation output vpc -s plat-ue2-dev --format=github
```

Flatten nested Outputs into compound keys, or uppercase every key:

```shell
atmos aws cloudformation output vpc -s plat-ue2-dev --format=dotenv --flatten --uppercase
```

Show output for all or affected components:

```shell
atmos aws cloudformation output --all -s plat-ue2-dev
atmos aws cloudformation output --affected --base origin/main
```

With more than one component selected, the JSON and YAML formats print a single document keyed by stack and then by component, so the result stays parseable:

```shell
atmos aws cloudformation output --all --format=json
```

```json
{
  "plat-ue2-dev": {
    "vpc": { "VpcId": "vpc-0123456789abcdef0" },
    "dns": { "ZoneId": "Z0123456789ABCDEFGHIJ" }
  }
}
```

The table format prints a heading naming the component and stack above each table. The other formats print each component's outputs in turn.

## Arguments

- **`component` (required unless `--all`/`--affected`/`--tags`/`--labels` is set)**
  The 
  `aws/cloudformation`
   component.
- **`key` (optional)**

  The Output key to print on its own. With the default `table` format the value is written bare, one line, on stdout.
  With `--format=json` the value is JSON-encoded, with `--format=yaml` YAML-encoded, and the other formats
  render a single `KEY=value`-style entry. A key the stack does not have is an error that lists the
  keys it does have. A key cannot be combined with `--all`, `--affected`, `--tags`, or `--labels`.

## Flags

- **`--stack`, `-s` (required for a single component)**
  Atmos stack. Required when operating on a single component; optional (and used only to narrow the selected set) with 
  `--all`
  /
  `--affected`
  .
- **`--format` (optional, default `table`)**
  Output format: 
  `json`
  , 
  `yaml`
  , 
  `hcl`
  , 
  `env`
  , 
  `dotenv`
  , 
  `bash`
  , 
  `csv`
  , 
  `tsv`
  , 
  `table`
  , or 
  `github`
  . An unsupported value is an error that names the value and lists the valid formats.
- **`--flatten` (optional)**
  Flatten nested Outputs into compound keys.
- **`--uppercase` (optional)**
  Uppercase Output keys.

:::note
`outputs` is accepted as an alias for `output`.
:::

## Stack state

The `output` command reads the deployed stack, so the stack has to be deployed:

- A stack that is not deployed is an error: `REVIEW_IN_PROGRESS` (a preview changeset created by
  `diff` or `plan` on a component that was never applied), `ROLLBACK_COMPLETE`, `ROLLBACK_FAILED`,
  `CREATE_FAILED`, and the `DELETE_*` statuses. Apply the component, or delete a stack that is stuck in
  a failed create first.
- A deployed stack that declares no `Outputs` prints `Stack <name> has no outputs` instead of an empty
  table. `--format=json` and the other structured formats still print an empty document, so
  pipelines keep getting parseable output.

JSON output is written without HTML escaping, so masked values read `<MASKED>`.

## Masking

With masking enabled, `output` and apply summaries require `cloudformation:GetTemplate` in addition
to `cloudformation:DescribeStacks`. Atmos reads deployed NoEcho metadata without loading a local
template or provisioning its source. Outputs referencing NoEcho parameters, including intrinsic
expressions and indirect resource/condition dependencies, are conservatively redacted. Known
parameter/default literals are masked too. Unreadable or malformed metadata stops presentation
before raw values are printed. This also protects outputs when local parameters have changed.

`--mask=false` explicitly disables presentation masking. Internal YAML output lookups retain real
values for component dependencies. Arbitrary transformed secrets without detectable template
references cannot be recognized; keep secrets out of CloudFormation Outputs. Masking also applies
when you print a single key.