AWS Security ChangesHomeSearch

AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2025-03-19 · Documentation medium

File: AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md

Summary

Added detailed documentation for LinkFilter property including filtering syntax, examples, and sharing controls for metrics/logs

Security assessment

Documents granular access controls for data sharing with monitoring accounts, enhancing security documentation but not addressing a specific vulnerability

Diff

diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md b/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md
index 296d6e30b..a9c322ed2 100644
--- a/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md
+++ b/AWSCloudFormation/latest/UserGuide/aws-properties-oam-link-linkfilter.md
@@ -7 +7,3 @@ SyntaxProperties
-The `LinkFilter` property type specifies Property description not available. for an [AWS::Oam::Link](./aws-resource-oam-link.html).
+When used in `MetricConfiguration` this field specifies which metric namespaces are to be shared with the monitoring account
+
+When used in `LogGroupConfiguration` this field specifies which log groups are to share their log events with the monitoring account. Use the term `LogGroupName` and one or more of the following operands.
@@ -32 +34,41 @@ To declare this entity in your AWS CloudFormation template, use the following sy
-Property description not available.
+When used in `MetricConfiguration` this field specifies which metric namespaces are to be shared with the monitoring account
+
+When used in `LogGroupConfiguration` this field specifies which log groups are to share their log events with the monitoring account. Use the term `LogGroupName` and one or more of the following operands.
+
+Use single quotation marks (') around log group names and metric namespaces.
+
+The matching of log group names and metric namespaces is case sensitive. Each filter has a limit of five conditional operands. Conditional operands are `AND` and `OR`.
+
+  * `=` and `!=`
+
+  * `AND`
+
+  * `OR`
+
+  * `LIKE` and `NOT LIKE`. These can be used only as prefix searches. Include a `%` at the end of the string that you want to search for and include.
+
+  * `IN` and `NOT IN`, using parentheses `( )`
+
+
+
+
+Examples:
+
+  * `Namespace NOT LIKE 'AWS/%'` includes only namespaces that don't start with `AWS/`, such as custom namespaces.
+
+  * `Namespace IN ('AWS/EC2', 'AWS/ELB', 'AWS/S3')` includes only the metrics in the EC2, Elastic Load Balancing, and Amazon S3 namespaces. 
+
+  * `Namespace = 'AWS/EC2' OR Namespace NOT LIKE 'AWS/%'` includes only the EC2 namespace and your custom namespaces.
+
+  * `LogGroupName IN ('This-Log-Group', 'Other-Log-Group')` includes only the log groups with names `This-Log-Group` and `Other-Log-Group`.
+
+  * `LogGroupName NOT IN ('Private-Log-Group', 'Private-Log-Group-2')` includes all log groups except the log groups with names `Private-Log-Group` and `Private-Log-Group-2`.
+
+  * `LogGroupName LIKE 'aws/lambda/%' OR LogGroupName LIKE 'AWSLogs%'` includes all log groups that have names that start with `aws/lambda/` or `AWSLogs`.
+
+
+
+
+###### Note
+
+If you are updating a link that uses filters, you can specify `*` as the only value for the `filter` parameter to delete the filter and share all log groups with the monitoring account.