AWS AWSCloudFormation documentation change
Summary
Updated documentation formatting, corrected IAM role references, added link to VPC peering IAM guide, and standardized section headers
Security assessment
Added reference to VPC peering identity and access management documentation, which enhances security documentation but does not address a specific disclosed vulnerability
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/peer-with-vpc-in-another-account.md index ae7126cb0..84914bbcb 100644 --- a/AWSCloudFormation/latest/UserGuide/peer-with-vpc-in-another-account.md +++ b/AWSCloudFormation/latest/UserGuide/peer-with-vpc-in-another-account.md @@ -3 +3 @@ -PrerequisitesStep 1: Create a VPC and a cross-account roleStep 2: Create a template that includes AWS::EC2::VPCPeeringConnectionCreating a template with a highly restrictive policy +PrerequisitesStep 1: Create a VPC and a cross-account roleStep 2: Create a template that includes AWS::EC2::VPCPeeringConnectionCreate a template with a highly restrictive policy @@ -15,3 +15 @@ For more information about VPC peering and its limitations, see the [Amazon VPC -Perform the following operations before you peer your VPC with a VPC in another AWS account. - - 1. You need a peer VPC ID, a peer AWS account ID, and a [cross-account access role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html#roles-creatingrole-user-cli) for the peering connection. + 1. You need a peer VPC ID, a peer AWS account ID, and a [cross-account access role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_aws-accounts.html) for the peering connection. @@ -23 +21 @@ This walkthrough refers to two accounts: First is an account that allows cross-a - 2. To accept the VPC peering connection, the cross-account access role must be assumable by you. The resource behaves the same way as a VPC peering connection resource in the same account. For information about how an IAM administrator grants permissions to assume the cross-account role, see [Grant a user permissions to switch roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html) _[IAM User Guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/)_. + 2. To accept the VPC peering connection, the cross-account access role must be assumable by you. The resource behaves the same way as a VPC peering connection resource in the same account. For information about how an IAM administrator grants permissions to assume the cross-account role, see [Grant a user permissions to switch roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_permissions-to-switch.html) in the _IAM User Guide_. @@ -125 +123 @@ In this step, you'll create the VPC and role in the _accepter account_. - Type: 'AWS::EC2::VPC' + Type: AWS::EC2::VPC @@ -132 +130 @@ In this step, you'll create the VPC and role in the _accepter account_. - Type: 'AWS::IAM::Role' + Type: AWS::IAM::Role @@ -254 +252 @@ Now that you've created the VPC and cross-account role, you can peer with the VP - Type: 'AWS::EC2::VPC' + Type: AWS::EC2::VPC @@ -261 +259 @@ Now that you've created the VPC and cross-account role, you can peer with the VP - Type: 'AWS::EC2::VPCPeeringConnection' + Type: AWS::EC2::VPCPeeringConnection @@ -284 +282 @@ Now that you've created the VPC and cross-account role, you can peer with the VP -## Creating a template with a highly restrictive policy +## Create a template with a highly restrictive policy @@ -303,0 +301 @@ The following example template shows how to change the VPC peer owner template ( + "Type":"AWS::IAM::Role", @@ -352,2 +350 @@ The following example template shows how to change the VPC peer owner template ( - }, - "Type": "AWS::IAM::Role" + } @@ -355,0 +353 @@ The following example template shows how to change the VPC peer owner template ( + "Type":"AWS::EC2::VPC", @@ -361,2 +359 @@ The following example template shows how to change the VPC peer owner template ( - }, - "Type": "AWS::EC2::VPC" + } @@ -391,0 +389 @@ The following example template shows how to change the VPC peer owner template ( + Type: AWS::IAM::Role @@ -420 +417,0 @@ The following example template shows how to change the VPC peer owner template ( - Type: 'AWS::IAM::Role' @@ -421,0 +419 @@ The following example template shows how to change the VPC peer owner template ( + Type: AWS::EC2::VPC @@ -427 +424,0 @@ The following example template shows how to change the VPC peer owner template ( - Type: 'AWS::EC2::VPC' @@ -439,0 +437,2 @@ To access the VPC, you can use the same requester template as in Step 2 above. +For more information, see [Identity and access management for VPC peering](https://docs.aws.amazon.com/vpc/latest/peering/security-iam.html) in the _Amazon VPC Peering Guide_. +