# CloudFormation Stack Enumeration

> Enumerate AWS CloudFormation stacks, resources, outputs, and parameters to map infrastructure, expose sensitive configs, and identify attack paths.

- **URL:** https://hackindex.io/platforms/aws/enumeration/cloudformation/cloudformation-stack-enumeration
- **Path:** AWS > Enumeration > CloudFormation
- **Up:** [CloudFormation](https://hackindex.io/platforms/aws/enumeration/cloudformation.md)
- **Published:** 2026-05-24
- **Updated:** 2026-05-24

CloudFormation templates describe the entire infrastructure. Stack parameters often contain database passwords, API keys, and AMI IDs. Stack outputs expose endpoint URLs, ARNs, and resource IDs.

## List Stacks

```bash
aws cloudformation list-stacks --profile $PROFILE --region $REGION --stack-status-filter CREATE_COMPLETE UPDATE_COMPLETE --query 'StackSummaries[*].{Name:StackName,Status:StackStatus,Created:CreationTime}' --output table
```

## Describe a Stack

Outputs, parameters (values visible if not marked `NoEcho`), and resource list:

```bash
aws cloudformation describe-stacks --stack-name $STACK_NAME --profile $PROFILE --region $REGION
```

Stack outputs often expose:

- Database endpoint URLs
- S3 bucket names
- Load balancer DNS names
- API Gateway URLs
- IAM role ARNs

## Get Template

Retrieve the actual template (JSON or YAML) used to deploy the stack:

```bash
aws cloudformation get-template --stack-name $STACK_NAME --profile $PROFILE --region $REGION | jq -r '.TemplateBody'
```

**Search for secrets in template**

```bash
aws cloudformation get-template --stack-name $STACK_NAME --profile $PROFILE --region $REGION | jq -r '.TemplateBody' | grep -iE "password|secret|key|token|credential"
```

## List Stack Resources

Maps logical resource names to actual AWS resource IDs:

```bash
aws cloudformation list-stack-resources --stack-name $STACK_NAME --profile $PROFILE --region $REGION --query 'StackResourceSummaries[*].{Logical:LogicalResourceId,Physical:PhysicalResourceId,Type:ResourceType}' --output table
```

This tells you exactly what IAM roles, EC2 instances, RDS instances, and Lambda functions belong to this stack.

## Stack Events

Stack events show the history of what was deployed and any previous configurations:

```bash
aws cloudformation describe-stack-events --stack-name $STACK_NAME --profile $PROFILE --region $REGION --query 'StackEvents[*].{Time:Timestamp,Resource:LogicalResourceId,Status:ResourceStatus,Reason:ResourceStatusReason}' --output table
```

## StackSets

StackSets deploy stacks across multiple accounts and regions: evidence of a multi-account AWS Organization:

```bash
aws cloudformation list-stack-sets --profile $PROFILE --region $REGION
aws cloudformation list-stack-instances --stack-set-name $STACKSET_NAME --profile $PROFILE --region $REGION
```

Enumerating StackSet instances reveals which accounts are managed from the current account: useful for identifying lateral movement targets.

## Parameter Visibility

Parameters marked `NoEcho: true` are masked in the API response. However, if you can retrieve the template and the stack was deployed with hardcoded `Default` values, those defaults are visible in the template itself: `NoEcho` only masks the runtime value, not the template default.