aws-cloudformation-template-body-metadata-and-defaults
CloudFormation templates can hard-code credentials anywhere; NoEcho only masks parameter display and does not protect Metadata, mappings, resource properties, or outputs.
Where it sits
location GetTemplate.TemplateBody (Parameters.Default, Metadata, Mappings, Resources properties, Outputs)location kind iac_templatedata kinds credential password api_key access_key secret_key private_key connection_string source_code_secret emits edge ContainsCredentialservice CloudFormation (aws:cloudformation)
Collection recipe
access mode read_apioperation GetTemplateresponse path TemplateBodyencoding jsonparams {"StackName": "\u003cstack-or-change-set-name\u003e", "TemplateStage": "Original"}
Required permissions
cloudformation:GetTemplate
Copy
References