如何在嵌套CloudFormation中从父栈向子栈传递资源？

Great question! When you need a nested CloudFormation stack to access resources or their attributes from the parent stack (like your Lambda function needing RDS database config), there are two primary, reliable methods to make this work—let’s break them down with your example in mind.

1. Use Nested Stack Parameters (Most Common for Nested Scenarios) #

This is the straightforward go-to approach since nested stacks are directly tied to the parent, so parameter passing is clean and maintainable.

Step 1: Define Parameters in Your Nested Stack Template #

First, add parameters to your nested stack template that correspond to the values you need from the parent. For your Lambda's DB config:

Parameters:
  DBuser:
    Type: String
    Description: Username for the MySQL database
  DBHost:
    Type: String
    Description: Endpoint address of the MySQL database
  DBname:
    Type: String
    Description: Name of the MySQL database

Step 2: Reference Parameters in Your Nested Stack Lambda #

Update your Lambda function definition in the nested stack to use these parameters instead of trying to directly reference parent stack resources:

"ProjectsusgetProjectFinancialsLF": {
  "Type": "AWS::Lambda::Function",
  "Properties": {
    "Code": {
      "S3Bucket": "dev",
      "S3Key": "test-lamda.zip",
      "S3ObjectVersion": "9eNYbcI5EOuuut9igX2xpgbGCtKD1D4K"
    },
    "Environment": {
      "Variables": {
        "MYSQLDB_USER": { "Ref": "DBuser" },
        "MYSQLDB_HOST": { "Ref": "DBHost" },
        "MYSQLDB_DATABASE": { "Ref": "DBname" }
      }
    }
    # Add other required Lambda properties (Runtime, Handler, Role, etc.)
  }
}

Step 3: Pass Values from Parent Stack to Nested Stack #

In your parent stack template, when defining the nested stack resource, pass the required values using Ref or Fn::GetAtt to pull from the parent's resources:

Resources:
  MyNestedStack:
    Type: AWS::CloudFormation::Stack
    Properties:
      # Point to your nested stack template (S3 URL or local file path)
      TemplateURL: "https://s3.amazonaws.com/your-bucket/path/to/nested-stack.yaml"
      Parameters:
        DBuser: { "Ref": "DBuser" }
        DBHost: { "Fn::GetAtt": [ "testDB", "Endpoint.Address" ] }
        DBname: { "Ref": "DBname" }

2. Use Export/Import (For Cross-Stack, Not Just Nested) #

If you ever need to share resources across independent stacks (not just parent-child nested stacks), you can use CloudFormation exports and imports. Note that this is less ideal for nested stacks (since parameters are more direct), but it’s a useful tool to know:

Step 1: Export Values from the Parent Stack #

Add outputs to your parent stack that export the required DB attributes:

Outputs:
  DBUserExport:
    Value: { "Ref": "DBuser" }
    Export:
      Name: "DBUser-{{AWS::StackName}}" # Use stack name to avoid conflicts
  DBHostExport:
    Value: { "Fn::GetAtt": [ "testDB", "Endpoint.Address" ] }
    Export:
      Name: "DBHost-{{AWS::StackName}}"

Step 2: Import Values in the Nested Stack #

In your nested stack's Lambda, reference the exported values using Fn::ImportValue:

"MYSQLDB_USER": { "Fn::ImportValue": "DBUser-MainStackName" } # Replace with your parent stack name
"MYSQLDB_HOST": { "Fn::ImportValue": "DBHost-MainStackName" }

Key Notes to Keep in Mind #

• Type Matching: Ensure the parameter types in the nested stack match the values you’re passing from the parent (e.g., don’t pass a Number to a String parameter).
• Sensitive Data: For sensitive values like DB passwords, avoid passing them directly as parameters. Instead, store them in AWS Secrets Manager or AWS Systems Manager Parameter Store, then pass the secret/parameter ARN to the nested stack. Your Lambda can then retrieve the sensitive value at runtime.
• Attribute Availability: Double-check that the parent resource actually exposes the attribute you’re trying to get with Fn::GetAtt (e.g., RDS instances do have Endpoint.Address).

内容的提问来源于stack exchange，提问作者Harsh Saudagar