CloudFormation stack outputs do not contain secrets

Check ID: cloudformation_stack_outputs_find_secrets
Provider: AWS
Service: cloudformation
Severity: CRITICAL
Categories: secrets
Resource type: AwsCloudFormationStack

What this check verifies

CloudFormation stack Outputs are analyzed for hardcoded secrets-passwords, API keys, tokens-using pattern-based detection across output values. A finding indicates potential secret strings present within Outputs of the template or stack.

Risk

Secrets in Outputs are readable to anyone with stack metadata access, enabling credential theft, unauthorized API calls, and lateral movement. Exposure via consoles, exports, or CI logs undermines confidentiality and can lead to privilege escalation and data exfiltration.

Recommendation

Remove secrets from Outputs. Store credentials in Secrets Manager or Parameter Store and reference them via dynamic references; set NoEcho for sensitive parameters. Apply least privilege to view stack metadata, avoid exporting sensitive values, and add automated IaC secret scanning for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws cloudformation update-stack —stack-name <STACK_NAME> —template-body file://<TEMPLATE_WITHOUT_SENSITIVE_OUTPUTS>.yaml

# Critical: the embedded CloudFormation template removes secret outputs
resource "aws_cloudformation_stack" "<example_resource_name>" {
  name          = "<example_resource_name>"
  template_body = <<-YAML
    AWSTemplateFormatVersion: '2010-09-09'
    # Critical: delete Outputs that expose secrets; keep only non-sensitive values
    Outputs:
      SafeInfo:
        Value: "non-sensitive"  # Avoids exposing secrets in stack outputs
  YAML
}

AWSTemplateFormatVersion: '2010-09-09'
Outputs:
  # Critical: remove outputs that expose secrets (passwords/tokens/keys)
  # Keeping only non-sensitive values in Outputs remediates the finding
  SafeInfo:
    Value: "non-sensitive"

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudformation_stack_outputs_find_secrets. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

CDKToolkit stack is on Bootstrap version 21 or higher CloudFormation stack has termination protection enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires