works, except for Fn::GetAtt on the cache server