CloudFormation Resource Attributes Reference

Why this CloudFormation GetAtt reference exists

Fn::GetAtt is one of the most essential intrinsic functions in AWS CloudFormation. It returns specific attributes from AWS resources in your templates, such as ARNs, DNS names, IP addresses, URLs, and status values.

The hard part is knowing which attributes exist for each resource type. The official AWS documentation spreads this information across many service pages, so this tool consolidates every resource type and its available Fn::GetAtt attributes into one searchable table.

If you use AWS CDK instead of raw CloudFormation, CDK handles many intrinsic references for you. Understanding Fn::GetAtt still helps when debugging synthesized templates or reading CloudFormation errors.

How to use the attributes table

1. Search for your AWS resource type, such as AWS::S3::Bucket.
2. Find the available attributes in the attributes column.
3. Copy the attribute name into your CloudFormation template as !GetAtt YourResourceName.AttributeName.
4. Open the resource documentation link when you need the official schema.

A dash in the attributes column means the resource type does not expose any Fn::GetAtt attributes.

GetAtt vs Ref: when to use each

One of the most common sources of CloudFormation confusion is knowing when to use Fn::GetAtt versus Ref. Both functions retrieve values from resources, but they return different things.

What Ref returns

Ref returns a resource's primary identifier. The exact value depends on the resource type.

What GetAtt returns

Fn::GetAtt provides access to additional attributes beyond the primary identifier. Use it for values like ARNs, DNS names, IP addresses, endpoints, URLs, and resource status fields.

Quick decision guide

Practical examples

S3 bucket attributes

S3 buckets expose several domain-related attributes. The most common mistake is using Ref when a policy or integration expects an ARN.

CloudFront distributions commonly use an S3 bucket's domain name as the origin:

Resources:
  MyBucket:
    Type: AWS::S3::Bucket

  MyDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        Origins:
          - DomainName: !GetAtt MyBucket.DomainName
            Id: S3Origin
            S3OriginConfig:
              OriginAccessIdentity: ""
        Enabled: true

Lambda function attributes

!Ref MyFunction gives you the function name. Use !GetAtt MyFunction.Arn when another service needs the full function ARN.

# API Gateway needs the function ARN for integration
IntegrationUri: !GetAtt MyFunction.Arn

# Lambda permission can use the function name
FunctionName: !Ref MyFunction

EC2 instance attributes

EC2 attributes are useful when a template needs networking details for outputs, DNS records, or security group rules.

Advanced GetAtt patterns

Combining GetAtt with Fn::Sub

You can use Fn::GetAtt inside Fn::Sub to build connection strings, ARN patterns, and configuration values:

Outputs:
  DatabaseConnectionString:
    Value: !Sub "mysql://admin@${MyRDSInstance.Endpoint.Address}:${MyRDSInstance.Endpoint.Port}/mydb"

Using AWS::LanguageExtensions

The AWS::LanguageExtensions transform enables dynamic Fn::GetAtt references. This is useful when resource names or attribute names are generated from mappings, loops, or conditions.

Transform: AWS::LanguageExtensions

Outputs:
  SelectedBucketArn:
    Value: !GetAtt
      - !Sub "${Environment}Bucket"
      - Arn

Cross-stack references with GetAtt

Fn::GetAtt only works inside the same template. For multi-stack architectures, export the attribute from one stack and import it in another with Fn::ImportValue.

# network-stack.yaml
Outputs:
  VPCCidrBlock:
    Value: !GetAtt MyVPC.CidrBlock
    Export:
      Name: !Sub "${AWS::StackName}-VPCCidr"

# application-stack.yaml
Resources:
  MySecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !ImportValue network-stack-VPCId
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: !ImportValue network-stack-VPCCidr

If you are doing this with CDK, the same idea applies through stack outputs and imports. The guide on sharing resources across AWS CDK stacks covers the CDK side of this pattern.