Question

A DevOps team manages a shared networking stack and multiple application stacks in the same account and region using AWS CDK. Application stacks need to reference the VPC ID and subnet IDs produced by the networking stack. Currently they use CloudFormation cross-stack exports (Fn::ImportValue). The team frequently needs to modify the networking stack's subnet configuration, but CloudFormation blocks these updates because the values are exported and consumed by other stacks. They want a decoupling approach that still keeps everything defined as code and allows the networking stack to update independently while application stacks pick up current values. What should they do?

Accepted Answer

Have the networking stack write the VPC ID and subnet IDs to SSM Parameter Store parameters, and have application stacks read those parameters at deploy time (e.g., via CDK StringParameter.valueFromLookup or CloudFormation SSM dynamic references).

Answer

Convert the networking stack into a nested stack of each application stack so the resources are recreated per application and no cross-stack dependency exists.

Answer

Add a DeletionPolicy of Retain to the exported outputs so CloudFormation permits updates to the exported values while consumers keep the old references.

Answer

Enable termination protection on the networking stack and manually copy the subnet IDs into each application stack's parameters whenever they change.