Feature request: CloudFormation stack outputs ESC provider

[jdavredbeard]

Summary

Requesting an ESC provider that reads AWS CloudFormation stack outputs, analogous to the existing pulumi-stacks and terraform-stacks providers.

Motivation

Migration decoupling

When migrating infrastructure to Pulumi, it's common to have CloudFormation stacks (deployed via SAM, CDK, or raw CFN) that provide outputs consumed by multiple downstream programs — API Gateway IDs, endpoint URLs, ARNs, etc.

By decoupling these values through ESC, downstream Pulumi programs read config values without knowing whether the upstream is CFN, Terraform, or Pulumi. When the upstream CFN stack eventually gets migrated to Pulumi, you swap the ESC provider from cloudformation-stacks to pulumi-stacks — zero downstream programs need to change. Without this, every downstream consumer needs aws.cloudformation.getStackOutput() calls that must be individually found and replaced.

This follows the same pattern that terraform-stacks enables for Terraform-to-Pulumi migrations.

Cross-account shared infrastructure

A central account's CFN stacks often provide shared resources consumed by workload accounts:

• Shared ECR repository ARNs
• Hub VPC/subnet IDs (hub-spoke networking)
• Transit gateway IDs
• Central ACM certificate ARNs

An ESC provider would authenticate via an upstream aws-login OIDC provider and read outputs from the central account, making them available as config to programs targeting other accounts.

Proposed usage

values:
  aws-creds:
    fn::open::aws-login:
      oidc:
        roleArn: arn:aws:iam::123456789012:role/esc-reader
        sessionName: esc-cfn-reader
  cfn-outputs:
    fn::open::cloudformation-stacks:
      region: us-east-1
      credentials: ${aws-creds}
      stacks:
        capture: dmvhm-capture-service-develop
        credential: dmvhm-credential-service-develop
  pulumiConfig:
    captureApiGwEndpoint: ${cfn-outputs.capture.ApiGatewayEndpoint}
    credentialApiGwArn: ${cfn-outputs.credential.ApiGatewayArn}

Prior art

• pulumi-stacks provider — reads Pulumi stack outputs
• terraform-stacks provider — reads Terraform remote state outputs
• Both follow the same pattern: authenticate, specify stack/workspace name, get outputs as a map