Only partly. Setting NoEcho to true makes CloudFormation show the parameter as asterisks in describe calls for the stack and its events. It does not mask values placed in the template Metadata section, the Outputs section, or a resource Metadata attribute. AWS recommends dynamic references to external secret stores instead.
What NoEcho does
NoEcho is an attribute on a template parameter. The documentation says it masks the value to prevent it showing in the console, command line tools or API. When it is true, CloudFormation returns the parameter value as asterisks for calls that describe the stack or stack events, with exceptions listed below.
That is a display control. It reduces accidental exposure when someone views a stack. It is not encryption of the secret and not access control over it.
Where it does not apply
The AWS documentation states that NoEcho does not mask information stored in:
| Location | What AWS says |
|---|---|
| Metadata template section | CloudFormation does not transform, modify or redact anything you put here |
| Outputs template section | Not masked |
| Metadata attribute of a resource | Not masked |
AWS strongly recommends you do not use these mechanisms to include sensitive information such as passwords or secrets.
So a parameter marked NoEcho is only as private as the places it flows to. If you pass a database password into an output so another stack can use it, the mask no longer helps.
What AWS recommends instead
Rather than embedding sensitive information in templates, the documentation recommends dynamic references to values stored and managed outside CloudFormation, such as AWS Systems Manager Parameter Store or AWS Secrets Manager. The template then holds a reference, and the secret lives in a store with its own access control, audit trail and rotation. We cover this in dynamic references instead of embedded secrets.
How to audit your templates
- Search templates for NoEcho and list every parameter that uses it.
- For each, check whether it is referenced in Outputs, Metadata or any resource Metadata attribute.
- Check who can call the describe APIs, and who can read the template itself, since the template and its parameters may be stored elsewhere.
- Replace the parameter with a dynamic reference where you can.
- Rotate any secret that was ever exposed through an output or metadata.
Quick check
Is NoEcho a substitute for a secrets manager?
No. It masks display in some calls. It does not store, rotate or control access to the secret.
Does NoEcho hide the value in Outputs?
No. The documentation lists the Outputs section as not masked.
Safeguard runs policies and gates on pull requests, so a failed rule can hold a merge, and its dependency and SBOM scanning covers the packages your infrastructure code pulls in. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
