Skip to main content

External stack output resolver

The external stack output resolver reads the parameter value from a stack output of a stack. The source stack does not have to belong to the same Takomo project as the target stack.


Here are the properties of the external stack output resolver:

resolveryesstringResolver name, this must be external-stack-output.
stackyesstringName of the source stack.
outputyesstringName of the stack output whose value is read.
regionnostringRegion of the source stack. Region is optional. By default, the region of the target stack is used.
commandRolenostringIAM role used to access the stack output. Command role is optional. By default, credentials associated with the target stack are used.
confidentialnobooleanConceal the resolved parameter value from logs, defaults to false.
immutablenobooleanMark the parameter as immutable, defaults to false.


Say, we have two accounts: 123456789012 and 888888888888.

The account 123456789012 has one stack: src-bucket. It is located in the us-east-1 region and exposes the name of an application source bucket in a stack output named SrcBucketName. The 123456789012 account also has a read-only role that the 888888888888 account can assume.

The 888888888888 account has two stacks: assets-bucket and build-infra. The stacks are located in the us-east-1 and eu-west-1 regions, respectively. The assets-bucket stack exposes the name of an assets bucket in a stack output named AssetsBucket.

Only the build-infra stack is managed in our Takomo project. The two other stacks are configured elsewhere. The build-infra stack has two parameters: SrcBucket and AssetsBucket. To get the values for them, we use the external-stack-output resolver to read the two other stacks' outputs.

The directory structure looks like this:

├─ stacks
│ └─ build-infra.yml
└─ templates
└─ build-infra.yml

The configuration of build-infra stack looks like this:

regions: us-east-1
resolver: external-stack-output
stack: src-bucket
output: SrcBucketName
commandRole: arn:aws:iam::123456789012:role/read-only
resolver: external-stack-output
stack: assets-bucket
output: AssetsBucketName
region: eu-west-1

For the SrcBucket parameter, we need to specify the commandRole property because the source stack is located in a different account. We don't need to specify the region because both stacks are located in the same region.

For the AssetsBucket parameter, we must specify the region but not the commandRole because the stacks are located in the same account but different regions.