NoEcho: Prevents CloudFormation from displaying the parameter value in the console, CLI, or API calls. However, the value is still stored in plaintext in the CloudFormation service.
Parameters:
DatabasePassword:
Type: String
NoEcho: true
Description: Database password
Sensitive data handling: For truly sensitive data, use AWS Systems Manager Parameter Store or Secrets Manager:
Resources:
Database:
Type: AWS::RDS::DBInstance
Properties:
MasterUserPassword: !Sub '{{resolve:secretsmanager:${DatabaseSecret}:SecretString:password}}'
NoEcho provides basic UI protection but isn't sufficient for highly sensitive data that requires encryption at rest and proper access controls.
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why there's no diagram: “”
The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓
The diagram below the answer is the concept . Jump to it ↓