AWS AWSCloudFormation documentation change
Summary
Added new SAML provider properties (AddPrivateKey, AssertionEncryptionMode, PrivateKeyList, RemovePrivateKey) and updated documentation
Security assessment
Adds documentation about SAML assertion encryption modes and private key management features, which are security-related capabilities but does not indicate a specific security issue being addressed
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-resource-iam-samlprovider.md index cdb23aa78..1d0f755ef 100644 --- a/AWSCloudFormation/latest/UserGuide/aws-resource-iam-samlprovider.md +++ b/AWSCloudFormation/latest/UserGuide/aws-resource-iam-samlprovider.md @@ -28,0 +29,2 @@ To declare this entity in your AWS CloudFormation template, use the following sy + "AddPrivateKey" : String, + "AssertionEncryptionMode" : String, @@ -29,0 +32,2 @@ To declare this entity in your AWS CloudFormation template, use the following sy + "PrivateKeyList" : [ [SAMLPrivateKey](./aws-properties-iam-samlprovider-samlprivatekey.html), ... ], + "RemovePrivateKey" : String, @@ -40,0 +45,2 @@ To declare this entity in your AWS CloudFormation template, use the following sy + AddPrivateKey: String + AssertionEncryptionMode: String @@ -41,0 +48,3 @@ To declare this entity in your AWS CloudFormation template, use the following sy + PrivateKeyList: + - [SAMLPrivateKey](./aws-properties-iam-samlprovider-samlprivatekey.html) + RemovePrivateKey: String @@ -48,0 +58,30 @@ To declare this entity in your AWS CloudFormation template, use the following sy +`AddPrivateKey` + + +Specifies the new private key from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions. + +_Required_ : No + + _Type_ : String + + _Pattern_ : `[\u0009\u000A\u000D\u0020-\u00FF]+` + +_Minimum_ : `1` + + _Maximum_ : `16384` + + _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) + +`AssertionEncryptionMode` + + +Specifies the encryption setting for the SAML provider. + +_Required_ : No + + _Type_ : String + + _Allowed values_ : `Allowed | Required` + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + @@ -67,0 +107,30 @@ _Minimum_ : `1` +`PrivateKeyList` + + +The private key metadata for the SAML provider. + +_Required_ : No + + _Type_ : Array of [SAMLPrivateKey](./aws-properties-iam-samlprovider-samlprivatekey.html) + + _Maximum_ : `2` + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + +`RemovePrivateKey` + + +The Key ID of the private key to remove. + +_Required_ : No + + _Type_ : String + + _Pattern_ : `[A-Z0-9]+` + +_Minimum_ : `22` + + _Maximum_ : `64` + + _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) + @@ -75 +144 @@ For more information, see [About SAML 2.0-based federation](https://docs.aws.ama -_Required_ : Yes +_Required_ : No @@ -122,0 +192,5 @@ Returns the Amazon Resource Name (ARN) for the specified `AWS::IAM::SAMLProvider +`SamlProviderUUID` + + +The unique identifier assigned to the SAML provider. + @@ -131 +205 @@ AWS::IAM::RolePolicy -Tag +SAMLPrivateKey