Skip to content
HackIndex logo

HackIndex

CloudFormation Stack Enumeration

2 min read May 24, 2026

CloudFormation templates describe the entire infrastructure. Stack parameters often contain database passwords, API keys, and AMI IDs. Stack outputs expose endpoint URLs, ARNs, and resource IDs.

List Stacks

┌──(kali㉿kali)-[~]
└─$ aws cloudformation list-stacks --profile $PROFILE --region $REGION --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE --query 'StackSummaries[*].{Name:StackName,Status:StackStatus,Created:CreationTime}' --output table

Describe a Stack

Outputs, parameters (values visible if not marked NoEcho), and resource list:

┌──(kali㉿kali)-[~]
└─$ aws cloudformation describe-stacks --stack-name $STACK_NAME --profile $PROFILE --region $REGION

Stack outputs often expose:

  • Database endpoint URLs

  • S3 bucket names

  • Load balancer DNS names

  • API Gateway URLs

  • IAM role ARNs

Get Template

Retrieve the actual template (JSON or YAML) used to deploy the stack:

┌──(kali㉿kali)-[~]
└─$ aws cloudformation get-template --stack-name $STACK_NAME --profile $PROFILE --region $REGION | jq -r '.TemplateBody'
┌──(kali㉿kali)-[~]
└─$ aws cloudformation get-template --stack-name $STACK_NAME --profile $PROFILE --region $REGION | jq -r '.TemplateBody' | grep -iE "password|secret|key|token|credential"

List Stack Resources

Maps logical resource names to actual AWS resource IDs:

┌──(kali㉿kali)-[~]
└─$ aws cloudformation list-stack-resources --stack-name $STACK_NAME --profile $PROFILE --region $REGION --query 'StackResourceSummaries[*].{Logical:LogicalResourceId,Physical:PhysicalResourceId,Type:ResourceType}' --output table

This tells you exactly what IAM roles, EC2 instances, RDS instances, and Lambda functions belong to this stack.

Stack Events

Stack events show the history of what was deployed and any previous configurations:

┌──(kali㉿kali)-[~]
└─$ aws cloudformation describe-stack-events --stack-name $STACK_NAME --profile $PROFILE --region $REGION --query 'StackEvents[*].{Time:Timestamp,Resource:LogicalResourceId,Status:ResourceStatus,Reason:ResourceStatusReason}' --output table

StackSets

StackSets deploy stacks across multiple accounts and regions — evidence of a multi-account AWS Organization:

┌──(kali㉿kali)-[~]
└─$ aws cloudformation list-stack-sets --profile $PROFILE --region $REGION
┌──(kali㉿kali)-[~]
└─$ aws cloudformation list-stack-instances --stack-set-name $STACKSET_NAME --profile $PROFILE --region $REGION

Enumerating StackSet instances reveals which accounts are managed from the current account — useful for identifying lateral movement targets.

Parameter Visibility

Parameters marked NoEcho: true are masked in the API response. However, if you can retrieve the template and the stack was deployed with hardcoded Default values, those defaults are visible in the template itself — NoEcho only masks the runtime value, not the template default.