If you really want access to the execution engine, looks like one team found a way. https://orca.security/resources/blog/aws-cloudformation-vuln...