What Is a Token in AWS CDK? Unresolved Values Explained

An AWS CDK token represents a value that is not yet known when the app runs. For example, bucket.bucketName can refer to a name that CloudFormation generates later. CDK preserves that reference in the synthesized template instead of inventing a name during synthesis.

A complete token example

Instantiate this stack from a CDK v2 TypeScript app:

COPY
import { CfnOutput, Stack, StackProps, Token } from "aws-cdk-lib";
import * as s3 from "aws-cdk-lib/aws-s3";
import { Construct } from "constructs";

export class TokenStack extends Stack {
  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);
    const bucket = new s3.Bucket(this, "Files");
    console.log("Unresolved:", Token.isUnresolved(bucket.bucketName));
    new CfnOutput(this, "BucketName", { value: bucket.bucketName });
  }
}

With a generated physical name, the diagnostic should report an unresolved value. Inspect the synthesized output: its value references the bucket resource rather than containing a deployed bucket name. Token display strings and logical IDs can vary between CDK versions, so don't paste them into external configuration.

The example targets CDK 2.272.0 and constructs 10.5.0. No deployment was performed for this revision. AWS explains string, list, number, and lazy token handling in Tokens and the AWS CDK.

Pass values without resolving them yourself

Pass a resource property directly to another construct that accepts it. CDK encodes the dependency for CloudFormation. String interpolation is supported in appropriate string properties, but JavaScript operations that depend on the eventual contents, such as slicing a generated name or making a synth-time branch based on it, cannot know the deployed result.

Token.asString, Token.asNumber, and Token.asList are encoding helpers where applicable, not methods on every resource attribute. There is no generic someValue.asBool() conversion for making a deployment-time boolean usable in an arbitrary construct. For deployment-time conditions, use CloudFormation conditions and compatible resource properties.

Tokens, outputs, and context are different

A CfnOutput construct itself is not the bucket-name string, and it has no export() method. See outputs and cross-stack exports for the supported API.

A VPC lookup needs enough concrete information to query the account during synthesis. Supplying Fn.importValue to fromLookup does not turn a deploy-time reference into a lookup result. Reference imports such as fromVpcAttributes have their own required attributes and constraints; do not omit the Availability Zones or subnet details a consumer needs.

For that workflow, continue with importing an existing VPC and CDK context. Review generated templates with cdk synth before deployment.