diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.assets.json
index d1e6eb28099c9..548ca16be6df1 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.assets.json
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.assets.json
@@ -1,15 +1,15 @@
 {
-  "version": "31.0.0",
+  "version": "34.0.0",
   "files": {
-    "68b22621fff135f9e3f225bad7ff80fdf2f45c3d9910af601206a0d9b279933a": {
+    "e2277687077a2abf9ae1af1cc9565e6715e2ebb62f79ec53aa75a1af9298f642": {
       "source": {
-        "path": "asset.68b22621fff135f9e3f225bad7ff80fdf2f45c3d9910af601206a0d9b279933a.zip",
+        "path": "asset.e2277687077a2abf9ae1af1cc9565e6715e2ebb62f79ec53aa75a1af9298f642.zip",
         "packaging": "file"
       },
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "68b22621fff135f9e3f225bad7ff80fdf2f45c3d9910af601206a0d9b279933a.zip",
+          "objectKey": "e2277687077a2abf9ae1af1cc9565e6715e2ebb62f79ec53aa75a1af9298f642.zip",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
@@ -79,7 +79,20 @@
         }
       }
     },
-    "6c07fbb89bbff6b2b1c4ddd3e1d445bc5b965519deab9fa8e860ccd5312df197": {
+    "4050143e044258715dc77e0d45e38dfaaba94cba5339fe6f76f1c067fa45020d": {
+      "source": {
+        "path": "asset.4050143e044258715dc77e0d45e38dfaaba94cba5339fe6f76f1c067fa45020d",
+        "packaging": "zip"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "4050143e044258715dc77e0d45e38dfaaba94cba5339fe6f76f1c067fa45020d.zip",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    },
+    "aa41586d6a5ad87a518aed4bfccd91c53ba390c0ceb63508028a510dbcdd43a0": {
       "source": {
         "path": "TestBucketDeploymentContent.template.json",
         "packaging": "file"
@@ -87,7 +100,7 @@
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "6c07fbb89bbff6b2b1c4ddd3e1d445bc5b965519deab9fa8e860ccd5312df197.json",
+          "objectKey": "aa41586d6a5ad87a518aed4bfccd91c53ba390c0ceb63508028a510dbcdd43a0.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.template.json
index e7f53021d94cd..b0e4fc31a8ca8 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.template.json
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/TestBucketDeploymentContent.template.json
@@ -20,7 +20,7 @@
      "S3Bucket": {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
-     "S3Key": "68b22621fff135f9e3f225bad7ff80fdf2f45c3d9910af601206a0d9b279933a.zip"
+     "S3Key": "e2277687077a2abf9ae1af1cc9565e6715e2ebb62f79ec53aa75a1af9298f642.zip"
     },
     "Description": "/opt/awscli/aws"
    }
@@ -44,6 +44,9 @@
      {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      },
+     {
+      "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
+     },
      {
       "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
      }
@@ -52,7 +55,8 @@
      "d09271be89b6cb0398f793b40c1531fd9b076aa92ba80b5e436914b1808fe18d.zip",
      "0f14dedeaf4386031c978375cbda0f65d7b52b29452cabb8873eb8f0d0fa936b.zip",
      "27eff729291aea0a2b33592996b9a764c233dc3387bd9cfd58c6f064073f177f.zip",
-     "939a4ab8b51f1a1cccb59d97f04c318ad41c1d404e666c158ca2810894bc5f5f.zip"
+     "939a4ab8b51f1a1cccb59d97f04c318ad41c1d404e666c158ca2810894bc5f5f.zip",
+     "4050143e044258715dc77e0d45e38dfaaba94cba5339fe6f76f1c067fa45020d.zip"
     ],
     "SourceMarkers": [
      {},
@@ -76,6 +80,24 @@
         "WebsiteURL"
        ]
       }
+     },
+     {
+      "<<marker:0xbaba:0>>": {
+       "Fn::Select": [
+        2,
+        {
+         "Fn::Split": [
+          "/",
+          {
+           "Fn::GetAtt": [
+            "Bucket83908E77",
+            "WebsiteURL"
+           ]
+          }
+         ]
+        }
+       ]
+      }
      }
     ],
     "DestinationBucketName": {
@@ -222,12 +244,6 @@
      },
      "S3Key": "9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd.zip"
     },
-    "Role": {
-     "Fn::GetAtt": [
-      "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265",
-      "Arn"
-     ]
-    },
     "Environment": {
      "Variables": {
       "AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
@@ -239,6 +255,12 @@
       "Ref": "DeployMeHereAwsCliLayerDDC2FE7D"
      }
     ],
+    "Role": {
+     "Fn::GetAtt": [
+      "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265",
+      "Arn"
+     ]
+    },
     "Runtime": "python3.9",
     "Timeout": 900
    },
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.4050143e044258715dc77e0d45e38dfaaba94cba5339fe6f76f1c067fa45020d/my-json/config2.json b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.4050143e044258715dc77e0d45e38dfaaba94cba5339fe6f76f1c067fa45020d/my-json/config2.json
new file mode 100644
index 0000000000000..47301e2a3c4cf
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.4050143e044258715dc77e0d45e38dfaaba94cba5339fe6f76f1c067fa45020d/my-json/config2.json
@@ -0,0 +1 @@
+{"bucket_domain_name":"<<marker:0xbaba:0>>"}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.68b22621fff135f9e3f225bad7ff80fdf2f45c3d9910af601206a0d9b279933a.zip b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.e2277687077a2abf9ae1af1cc9565e6715e2ebb62f79ec53aa75a1af9298f642.zip
similarity index 71%
rename from packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.68b22621fff135f9e3f225bad7ff80fdf2f45c3d9910af601206a0d9b279933a.zip
rename to packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.e2277687077a2abf9ae1af1cc9565e6715e2ebb62f79ec53aa75a1af9298f642.zip
index 156315e053998..90a8a2a6e2615 100644
Binary files a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.68b22621fff135f9e3f225bad7ff80fdf2f45c3d9910af601206a0d9b279933a.zip and b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/asset.e2277687077a2abf9ae1af1cc9565e6715e2ebb62f79ec53aa75a1af9298f642.zip differ
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/cdk.out b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/cdk.out
index 7925065efbcc4..2313ab5436501 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/cdk.out
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/cdk.out
@@ -1 +1 @@
-{"version":"31.0.0"}
\ No newline at end of file
+{"version":"34.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/integ.json b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/integ.json
index 825c0e8038359..5e7e68bdb5f88 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/integ.json
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/integ.json
@@ -1,5 +1,5 @@
 {
-  "version": "31.0.0",
+  "version": "34.0.0",
   "testCases": {
     "integ-test-bucket-deployment-data/DefaultTest": {
       "stacks": [
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/integtestbucketdeploymentdataDefaultTestDeployAssert6FF3075D.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/integtestbucketdeploymentdataDefaultTestDeployAssert6FF3075D.assets.json
index 27cb2ff6f7dfb..9e127759cebf9 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/integtestbucketdeploymentdataDefaultTestDeployAssert6FF3075D.assets.json
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/integtestbucketdeploymentdataDefaultTestDeployAssert6FF3075D.assets.json
@@ -1,5 +1,5 @@
 {
-  "version": "31.0.0",
+  "version": "34.0.0",
   "files": {
     "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
       "source": {
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/manifest.json b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/manifest.json
index bffd43c6372c7..5a5e8593fd15b 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/manifest.json
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/manifest.json
@@ -1,5 +1,5 @@
 {
-  "version": "31.0.0",
+  "version": "34.0.0",
   "artifacts": {
     "TestBucketDeploymentContent.assets": {
       "type": "cdk:asset-manifest",
@@ -14,10 +14,11 @@
       "environment": "aws://unknown-account/unknown-region",
       "properties": {
         "templateFile": "TestBucketDeploymentContent.template.json",
+        "terminationProtection": false,
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/6c07fbb89bbff6b2b1c4ddd3e1d445bc5b965519deab9fa8e860ccd5312df197.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/aa41586d6a5ad87a518aed4bfccd91c53ba390c0ceb63508028a510dbcdd43a0.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [
@@ -103,6 +104,7 @@
       "environment": "aws://unknown-account/unknown-region",
       "properties": {
         "templateFile": "integtestbucketdeploymentdataDefaultTestDeployAssert6FF3075D.template.json",
+        "terminationProtection": false,
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/tree.json b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/tree.json
index 761ed554f0329..340079da8f477 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/tree.json
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.js.snapshot/tree.json
@@ -81,7 +81,7 @@
                           "s3Bucket": {
                             "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
                           },
-                          "s3Key": "68b22621fff135f9e3f225bad7ff80fdf2f45c3d9910af601206a0d9b279933a.zip"
+                          "s3Key": "e2277687077a2abf9ae1af1cc9565e6715e2ebb62f79ec53aa75a1af9298f642.zip"
                         },
                         "description": "/opt/awscli/aws"
                       }
@@ -226,6 +226,32 @@
                   "fqn": "aws-cdk-lib.aws_s3_assets.Asset",
                   "version": "0.0.0"
                 }
+              },
+              "Asset5": {
+                "id": "Asset5",
+                "path": "TestBucketDeploymentContent/DeployMeHere/Asset5",
+                "children": {
+                  "Stage": {
+                    "id": "Stage",
+                    "path": "TestBucketDeploymentContent/DeployMeHere/Asset5/Stage",
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.AssetStaging",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "AssetBucket": {
+                    "id": "AssetBucket",
+                    "path": "TestBucketDeploymentContent/DeployMeHere/Asset5/AssetBucket",
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.aws_s3.BucketBase",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.aws_s3_assets.Asset",
+                  "version": "0.0.0"
+                }
               }
             },
             "constructInfo": {
@@ -444,12 +470,6 @@
                       },
                       "s3Key": "9eb41a5505d37607ac419321497a4f8c21cf0ee1f9b4a6b29aa04301aea5c7fd.zip"
                     },
-                    "role": {
-                      "Fn::GetAtt": [
-                        "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265",
-                        "Arn"
-                      ]
-                    },
                     "environment": {
                       "variables": {
                         "AWS_CA_BUNDLE": "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"
@@ -461,6 +481,12 @@
                         "Ref": "DeployMeHereAwsCliLayerDDC2FE7D"
                       }
                     ],
+                    "role": {
+                      "Fn::GetAtt": [
+                        "CustomCDKBucketDeployment8693BB64968944B69AAFB0CC9EB8756CServiceRole89A01265",
+                        "Arn"
+                      ]
+                    },
                     "runtime": "python3.9",
                     "timeout": 900
                   }
@@ -519,7 +545,7 @@
                 "path": "integ-test-bucket-deployment-data/DefaultTest/Default",
                 "constructInfo": {
                   "fqn": "constructs.Construct",
-                  "version": "10.1.270"
+                  "version": "10.2.70"
                 }
               },
               "DeployAssert": {
@@ -565,7 +591,7 @@
         "path": "Tree",
         "constructInfo": {
           "fqn": "constructs.Construct",
-          "version": "10.1.270"
+          "version": "10.2.70"
         }
       }
     },
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.ts
index d31df79ccdb98..7fbf88f7d6e4c 100644
--- a/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.ts
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-s3-deployment/test/integ.bucket-deployment-data.ts
@@ -11,6 +11,7 @@ const file1 = Source.data('file1.txt', 'boom');
 const file2 = Source.data('path/to/file2.txt', `bam! ${bucket.bucketName}`);
 const file3 = Source.jsonData('my-json/config.json', { website_url: bucket.bucketWebsiteUrl });
 const file4 = Source.yamlData('my-yaml/config.yaml', { website_url: bucket.bucketWebsiteUrl });
+const file5 = Source.jsonData('my-json/config2.json', { bucket_domain_name: bucket.bucketWebsiteDomainName });
 
 const deployment = new BucketDeployment(stack, 'DeployMeHere', {
   destinationBucket: bucket,
@@ -20,6 +21,7 @@ const deployment = new BucketDeployment(stack, 'DeployMeHere', {
 });
 deployment.addSource(file3);
 deployment.addSource(file4);
+deployment.addSource(file5);
 
 new CfnOutput(stack, 'BucketName', { value: bucket.bucketName });
 
diff --git a/packages/aws-cdk-lib/aws-s3-deployment/README.md b/packages/aws-cdk-lib/aws-s3-deployment/README.md
index 07853eb1e6f6a..86b14a7ecd38a 100644
--- a/packages/aws-cdk-lib/aws-s3-deployment/README.md
+++ b/packages/aws-cdk-lib/aws-s3-deployment/README.md
@@ -330,19 +330,23 @@ new s3deploy.BucketDeployment(this, 'DeployMeWithEfsStorage', {
 ## Data with deploy-time values
 
 The content passed to `Source.data()`, `Source.jsonData()`, or `Source.yamlData()` can include
-references that will get resolved only during deployment.
+references that will get resolved only during deployment. Only a subset of CloudFormation functions
+are supported however, namely: Ref, Fn::GetAtt, Fn::Join, and Fn::Select (Fn::Split may be nested under Fn::Select).
 
 For example:
 
 ```ts
 import * as sns from 'aws-cdk-lib/aws-sns';
+import * as elbv2 from 'aws-cdk-lib/aws-elasticloadbalancingv2';
 
 declare const destinationBucket: s3.Bucket;
 declare const topic: sns.Topic;
+declare const tg: elbv2.ApplicationTargetGroup;
 
 const appConfig = {
   topic_arn: topic.topicArn,
   base_url: 'https://my-endpoint',
+  lb_name: tg.firstLoadBalancerFullName,
 };
 
 new s3deploy.BucketDeployment(this, 'BucketDeployment', {
diff --git a/packages/aws-cdk-lib/aws-s3-deployment/lib/render-data.ts b/packages/aws-cdk-lib/aws-s3-deployment/lib/render-data.ts
index 0ea0b47cc1c38..33d970afc2360 100644
--- a/packages/aws-cdk-lib/aws-s3-deployment/lib/render-data.ts
+++ b/packages/aws-cdk-lib/aws-s3-deployment/lib/render-data.ts
@@ -52,16 +52,18 @@ export function renderData(scope: Construct, data: string): Content {
       throw new Error(`Unexpected "Fn::Join" part, expecting string or object but got ${typeof (part)}`);
     }
 
-  } else if (obj.Ref || obj['Fn::GetAtt']) {
+  } else if (obj.Ref || obj['Fn::GetAtt'] || obj['Fn::Select']) {
     addMarker(obj);
   } else {
     throw new Error('Unexpected: Expecting `resolve()` to return "Fn::Join", "Ref" or "Fn::GetAtt"');
   }
 
-  function addMarker(part: Ref | GetAtt) {
+  function addMarker(part: Ref | GetAtt | FnSelect) {
     const keys = Object.keys(part);
-    if (keys.length !== 1 || (keys[0] != 'Ref' && keys[0] != 'Fn::GetAtt')) {
-      throw new Error(`Invalid CloudFormation reference. "Ref" or "Fn::GetAtt". Got ${JSON.stringify(part)}`);
+    const acceptedCfnFns = ['Ref', 'Fn::GetAtt', 'Fn::Select'];
+    if (keys.length !== 1 || !acceptedCfnFns.includes(keys[0])) {
+      const stringifiedAcceptedCfnFns = acceptedCfnFns.map((fn) => `"${fn}"`).join(' or ');
+      throw new Error(`Invalid CloudFormation reference. Key must start with any of ${stringifiedAcceptedCfnFns}. Got ${JSON.stringify(part)}`);
     }
 
     const marker = `<<marker:0xbaba:${markerIndex++}>>`;
@@ -73,6 +75,8 @@ export function renderData(scope: Construct, data: string): Content {
 }
 
 type FnJoin = [string, FnJoinPart[]];
-type FnJoinPart = string | Ref | GetAtt;
+type FnJoinPart = string | Ref | GetAtt | FnSelect;
 type Ref = { Ref: string };
-type GetAtt = { 'Fn::GetAtt': [string, string] };
\ No newline at end of file
+type GetAtt = { 'Fn::GetAtt': [string, string] };
+type FnSplit = { 'Fn::Split': [string, string | Ref] };
+type FnSelect = { 'Fn::Select': [number, string[] | FnSplit] };
\ No newline at end of file
diff --git a/packages/aws-cdk-lib/aws-s3-deployment/test/content.test.ts b/packages/aws-cdk-lib/aws-s3-deployment/test/content.test.ts
index 858f6afd9a394..aa2cf8f346005 100644
--- a/packages/aws-cdk-lib/aws-s3-deployment/test/content.test.ts
+++ b/packages/aws-cdk-lib/aws-s3-deployment/test/content.test.ts
@@ -1,3 +1,5 @@
+import { Vpc } from '../../aws-ec2';
+import * as elbv2 from '../../aws-elasticloadbalancingv2';
 import * as lambda from '../../aws-lambda';
 import * as s3 from '../../aws-s3';
 import { Lazy, Stack } from '../../core';
@@ -52,6 +54,26 @@ test('string with a "Fn::GetAtt" token', () => {
   });
 });
 
+test('string is a single "Fn::Select" token', () => {
+  const stack = new Stack();
+  const bucket = new s3.Bucket(stack, 'Bucket');
+
+  expect(renderData(stack, bucket.bucketWebsiteDomainName)).toStrictEqual({
+    text: '<<marker:0xbaba:0>>',
+    markers: { '<<marker:0xbaba:0>>': { 'Fn::Select': [2, { 'Fn::Split': ['/', { 'Fn::GetAtt': ['Bucket83908E77', 'WebsiteURL'] }] }] } },
+  });
+});
+
+test('string with a "Fn::Select" token', () => {
+  const stack = new Stack();
+  const bucket = new s3.Bucket(stack, 'Bucket');
+
+  expect(renderData(stack, `test.${bucket.bucketWebsiteDomainName}`)).toStrictEqual({
+    text: 'test.<<marker:0xbaba:0>>',
+    markers: { '<<marker:0xbaba:0>>': { 'Fn::Select': [2, { 'Fn::Split': ['/', { 'Fn::GetAtt': ['Bucket83908E77', 'WebsiteURL'] }] }] } },
+  });
+});
+
 test('multiple markers', () => {
   const stack = new Stack();
   const bucket = new s3.Bucket(stack, 'Bucket');
@@ -68,16 +90,29 @@ test('multiple markers', () => {
 test('json-encoded string', () => {
   const stack = new Stack();
   const bucket = new s3.Bucket(stack, 'Bucket');
+  const tg = new elbv2.ApplicationTargetGroup(stack, 'TargetGroup');
+  const lb = new elbv2.ApplicationLoadBalancer(stack, 'LB', { vpc: new Vpc(stack, 'vpc') });
+  lb.addListener('Listener', { port: 80, defaultTargetGroups: [tg] });
   const json = {
     BucketArn: bucket.bucketArn,
     BucketName: bucket.bucketName,
+    ComplexFnSelect: tg.firstLoadBalancerFullName + '/' + tg.targetGroupFullName,
   };
 
+  const expectedTextResult = {
+    BucketArn: '<<marker:0xbaba:0>>',
+    BucketName: '<<marker:0xbaba:1>>',
+    ComplexFnSelect: '<<marker:0xbaba:2>>/<<marker:0xbaba:3>>/<<marker:0xbaba:4>>/<<marker:0xbaba:5>>',
+  };
   expect(renderData(stack, JSON.stringify(json))).toStrictEqual({
-    text: JSON.stringify({ BucketArn: '<<marker:0xbaba:0>>', BucketName: '<<marker:0xbaba:1>>' }),
+    text: JSON.stringify(expectedTextResult),
     markers: {
       '<<marker:0xbaba:0>>': { 'Fn::GetAtt': ['Bucket83908E77', 'Arn'] },
       '<<marker:0xbaba:1>>': { Ref: 'Bucket83908E77' },
+      '<<marker:0xbaba:2>>': { 'Fn::Select': [1, { 'Fn::Split': ['/', { Ref: 'LBListener49E825B4' }] }] },
+      '<<marker:0xbaba:3>>': { 'Fn::Select': [2, { 'Fn::Split': ['/', { Ref: 'LBListener49E825B4' }] }] },
+      '<<marker:0xbaba:4>>': { 'Fn::Select': [3, { 'Fn::Split': ['/', { Ref: 'LBListener49E825B4' }] }] },
+      '<<marker:0xbaba:5>>': { 'Fn::GetAtt': ['TargetGroup3D7CD9B8', 'TargetGroupFullName'] },
     },
   });
 });