Advanced 18 min read

Stacks, Parameters, and Outputs

By the end of this lesson, you'll be able to:

Explain how a Parameter makes a template reusable without editing every resource definition
Read a template that uses a Parameter to configure a Resource, and an Output to expose a value from it
Explain why Outputs must never expose secrets, and what belongs there instead

Prerequisites: "AWS CloudFormation Templates"

Parameters: reusing one template for different deployments

A Parameter is a deployment-time input to a template — a value supplied when the stack is created or updated, rather than hardcoded into the template itself. A simple, fictional example:

Parameters:
  EnvironmentName:
    Type: String
    Default: training

This lets the same template be deployed more than once with a different EnvironmentName value each time — a genuine, common need this course has run into repeatedly (Module 5's discussion of reusable table designs, Module 9's discussion of one image running as many independent containers). Good uses for a parameter: an environment name, a non-secret configuration choice, a deployment-specific setting. A parameter should never be a plain-text secret — that's exactly the anti-pattern Module 10 already warned against for environment variables generally, and it applies here without exception.

Resources: using the parameter

Resources:
  TrainingQueue:
    Type: AWS::SQS::Queue

This fictional TrainingQueue resource builds directly on Module 8's SQS lesson — the same managed queue concept, now expressed as a template resource instead of something clicked into existence by hand. A real template would typically reference the EnvironmentName parameter somewhere in this resource's configuration (for example, as part of a name), so the deployed queue reflects which environment it belongs to.

Outputs: exposing useful values — never secrets

Outputs:
  QueueUrl:
    Value: !Ref TrainingQueue

Diagram showing a fictional EnvironmentName parameter set to training feeding into an application bucket resource, which produces a bucket name output, labeled with parameters as inputs, resources as infrastructure, and outputs as useful values that must never include a secret. — Parameters = inputs. Resources = infrastructure. Outputs = useful values — never a password, access key, or other secret.

An Output exposes a value produced by the stack — here, the URL of the fictional queue it created — so other templates, tools, or people can retrieve it without having to look it up manually. This is worth stating as directly as Module 10 stated it for logs: an Output must never expose a password, access key, token, or any other secret value. A stack's outputs are plainly visible information about the deployment, not a protected place to stash something sensitive.

Exercise

For each of the following, classify it as a Parameter, a Resource, or an Output: (1) "EnvironmentName, defaulting to training", (2) "an SQS queue named TrainingQueue", (3) "the queue's URL, exposed after deployment." Then explain why a database password should never appear as a template Output, even though it might seem convenient to retrieve it that way.

Show hint

Match each item to whether it's a deployment-time input, the actual infrastructure, or a value exposed afterward. The password question connects directly to Module 10's secrets-handling guidance.

Stacks, Parameters, and Outputs Quiz

1. A team wants development and test environments to use the same infrastructure definition, differing only by an environment name. Which CloudFormation concept fits?

A Parameter, supplying the environment name as a deployment-time input A separate, hand-edited template for each environment An Output, since outputs control what gets deployed Resources cannot be reused across environments under any circumstances

2. CloudFormation parameters can make a template reusable across deployments.

True False

3. A deployed collection of CloudFormation-managed resources is called a ______.

Show hint

It's the term the previous lesson introduced for what results from deploying a template.

4. Deployment-time inputs supplied to a CloudFormation template are called ______.

Show hint

It's the concept this lesson introduces for values like EnvironmentName.

My Notes

Questions about this lesson

No questions yet — be the first to ask.

Summary

A Parameter supplies a deployment-time input so the same template can be reused across environments without editing its Resources, and an Output exposes a useful value produced by a deployed resource — but an Output must never expose a password, access key, or other secret, since it's a plainly visible part of the stack's information.

❬ Previous Next ❭