AWS cloudformation-cli documentation change
Summary
Added multiple examples demonstrating how to use Include and Exclude lists with wildcard patterns for stack names and roles in CloudFormation Hook configurations
Security assessment
The changes provide additional examples of configuration options but do not address any specific security vulnerabilities or introduce new security features
Diff
diff --git a/cloudformation-cli/latest/hooks-userguide/wildcard-hook-targets.md index b45ba53b4..a77d1d04d 100644 --- a/cloudformation-cli/latest/hooks-userguide/wildcard-hook-targets.md +++ b/cloudformation-cli/latest/hooks-userguide/wildcard-hook-targets.md @@ -112,0 +113,232 @@ The following example configuration invokes the Hook for `CREATE` and `UPDATE` o +###### Example : `Include` specific stacks + +The following examples specifies an `Include` list. The Hook is only invoked if the stack names begins with `stack-test-`. + + + { + "CloudFormationConfiguration": { + "HookConfiguration": { + "HookInvocationStatus": "ENABLED", + "TargetOperations": [ + "STACK", + "RESOURCE" + ], + "FailureMode": "WARN", + "Properties": {}, + "StackFilters": { + "FilteringCriteria": "ALL", + "StackNames": { + "Include": [ + "stack-test-*" + ] + } + } + } + } + } + +###### Example : `Exclude` specific stacks + +The following examples specifies an `Exclude` list. The Hook is invoked on any stack that does not begin with `stack-test-`. + + + { + "CloudFormationConfiguration": { + "HookConfiguration": { + "HookInvocationStatus": "ENABLED", + "TargetOperations": [ + "STACK", + "RESOURCE" + ], + "FailureMode": "WARN", + "Properties": {}, + "StackFilters": { + "FilteringCriteria": "ALL", + "StackNames": { + "Exclude": [ + "stack-test-*" + ] + } + } + } + } + } + +###### Example : Combining `Include` and `Exclude` for specific stacks + +If `Include` and `Exclude` lists are specified, the Hook is only invoked on stacks matching in the `Include` that do not match in the `Exclude` list. In the following example, the Hook is invoked on all stacks that begin with `stack-test-` except for stacks named `stack-test-1`, `stack-test-2`, and `stack-test-3`. + + + { + "CloudFormationConfiguration": { + "HookConfiguration": { + "HookInvocationStatus": "ENABLED", + "TargetOperations": [ + "STACK", + "RESOURCE" + ], + "FailureMode": "WARN", + "Properties": {}, + "StackFilters": { + "FilteringCriteria": "ALL", + "StackNames": { + "Include": [ + "stack-test-*" + ], + "Exclude": [ + "stack-test-1", + "stack-test-2", + "stack-test-3" + ] + } + } + } + } + } + +###### Example : `Include` specific roles + +The following example specifies an `Include` list with two wildcard patterns. The first entry will run the Hook for any role that begins with `hook-role` in any `partition` and `account-id`. The second entry will run any for any role in any `partition` that belongs to `account-id` `123456789012`. + + + { + "CloudFormationConfiguration": { + "HookConfiguration": { + "HookInvocationStatus": "ENABLED", + "TargetOperations": [ + "STACK", + "RESOURCE" + ], + "FailureMode": "WARN", + "Properties": {}, + "StackFilters": { + "FilteringCriteria": "ALL", + "StackRoles": { + "Include": [ + "arn:*:iam::*:role/hook-role*", + "arn:*:iam::123456789012:role/* + ] + } + } + } + } + } + +###### Example : `Exclude` specific roles + +The following examples specifies an `Exclude` list with two wildcard patterns. The first entry will skip Hook execution when a role has `exempt` in its name in any `partition` and any `account-id`. The second entry will skip Hook execution when a role belonging to `account-id` `123456789012` is used with the stack operation. + + + { + "CloudFormationConfiguration": { + "HookConfiguration": { + "HookInvocationStatus": "ENABLED", + "TargetOperations": [ + "STACK", + "RESOURCE" + ], + "FailureMode": "WARN", + "Properties": {}, + "StackFilters": { + "FilteringCriteria": "ALL", + "StackRoles": { + "Exclude": [ + "arn:*:iam::*:role/*exempt*", + "arn:*:iam::123456789012:role/* + ] + } + } + } + } + } + +###### Example : Combining `Include` and `Exclude` for specific role ARN patterns + +If `Include` and `Exclude` lists are specified, the Hook is only invoked on stacks used with roles that match those in `Include` that do not match in the `Exclude` list. In the following example, the Hook is invoked on stack operations with any `partition`, `account-id`, and `role` name, except if the role belongs to `account-id` `123456789012`. + + + { + "CloudFormationConfiguration": { + "HookConfiguration": { + "HookInvocationStatus": "ENABLED", + "TargetOperations": [ + "STACK", + "RESOURCE" + ], + "FailureMode": "WARN", + "Properties": {}, + "StackFilters": { + "FilteringCriteria": "ALL", + "StackRoles": { + "Include": [ + "arn:*:iam::*:role/*" + ], + "Exclude": [ + "arn:*:iam::123456789012:role/*" + ] + } + } + } + } + } + +###### Example : Combining stack names and roles with all criteria + +The following Hook includes one stack name wildcard and one stack role wildcard. Because the `FilteringCriteria` is specified as `ALL`, the Hook is only invoked for stacks that have both, the matching `StackName` and matching `StackRoles`. + + + { + "CloudFormationConfiguration": { + "HookConfiguration": { + "HookInvocationStatus": "ENABLED", + "TargetOperations": [ + "STACK", + "RESOURCE" + ], + "FailureMode": "WARN", + "Properties": {}, + "StackFilters": { + "FilteringCriteria": "ALL", + "StackNames": { + "Include": [ + "stack-test-*" + ] + }, + "StackRoles": {