Credential Access
CloudFormation stack output secret harvest
An attacker with cloudformation:DescribeStacks reads every stack's outputs and parameters, which routinely contain plaintext credentials.
Required Permissions
Description
CloudFormation stacks expose Parameters and Outputs on the stack description. Parameters are the inputs the template was deployed with, including NoEcho parameters, which are returned as asterisks for Parameters but may still appear in Outputs. Outputs are what the template chose to expose and are returned in plaintext.
The hackaws agent lists every stack with cloudformation:DescribeStacks (one API, no pagination needed per stack) and runs each stack's Outputs and Parameters through the secret-detection pipeline. Deleted stacks are also readable for 90 days after deletion.
Outputs are a common place for credentials: database endpoints paired with passwords, API keys the stack generated, access keys for IAM users the stack created.
Impact
Harvest of credentials from current and recently deleted stacks. Credentials in Outputs often map to resources that are still in use.
Detection
Alert on DescribeStacks calls that enumerate every stack in a short window, especially from a principal with no deployment history. Flag Outputs that look like credentials in CI; refuse to merge templates that expose them.
Mitigation
Never put a plaintext credential in a CloudFormation Output. Mark sensitive Parameters as NoEcho and keep them out of Outputs. Deny cloudformation:DescribeStacks from read-only principals that do not need stack internals.