AWS solutions documentation change
Summary
Updated CloudFormation template URL path from '/stacks/new' to '/stacks/quickcreate', reformatted parameter documentation with inline notes, consolidated section headers, and corrected markdown formatting
Security assessment
Changes primarily involve documentation formatting and parameter description improvements. While some parameters relate to security configurations (like MFA settings and external principal sharing), the changes only reformat existing security documentation rather than addressing new vulnerabilities or adding new security features.
Diff
diff --git a/solutions/latest/network-orchestration-aws-transit-gateway/step-3-launch-the-hub-stack.md b/solutions/latest/network-orchestration-aws-transit-gateway/step-3-launch-the-hub-stack.md index 43ab28b49..6afc5991d 100644 --- a/solutions/latest/network-orchestration-aws-transit-gateway/step-3-launch-the-hub-stack.md +++ b/solutions/latest/network-orchestration-aws-transit-gateway/step-3-launch-the-hub-stack.md @@ -9,3 +9 @@ Follow the step-by-step instructions in this section to configure and deploy the - 1. Sign in to the AWS Management Console with your AWS network hub account and select the button to launch the `network-orchestration-hub.template` CloudFormation template. - -[  ](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/new?stackName=STNO-role&templateURL=https://solutions-reference.s3.amazonaws.com/network-orchestration-for-aws-transit-gateway/latest/network-orchestration-hub.template&redirectId=ImplementationGuide) + 1. Sign in to the AWS Management Console with your AWS network hub account and select the button to launch the `network-orchestration-hub.template` CloudFormation template. +{ [  ](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?stackName=STNO-role&templateURL=https://solutions-reference.s3.amazonaws.com/network-orchestration-for-aws-transit-gateway/latest/network-orchestration-hub.template&redirectId=ImplementationGuide) @@ -23 +21 @@ Parameter | Default | Description -**Account Structure Settings** +**Account Structure Settings** | | @@ -25 +23 @@ Parameter | Default | Description -**Account List or AWS Organizations ARN** | ``<Requires input>`` | To use Organizations, enter the Organization ARN to share the transit gateway with the principals. For example: +**Account List or AWS Organizations ARN** | `<Requires input>` | To use Organizations, enter the Organization ARN to share the transit gateway with the principals. For example: @@ -30,5 +28 @@ For additional guidance to identify the ARN value, refer to [Identify the Organi -**Allow External Principals** | `Yes` | Choose whether to enable or disable sharing the transit gateway with principals outside the organization. - -###### Note - -You must set this parameter to `Yes` if you’re using the `List of Accounts` value for the **Principal Type** parameter. +**Allow External Principals** | `Yes` | Choose whether to enable or disable sharing the transit gateway with principals outside the organization. NOTE: You must set this parameter to `Yes` if you’re using the `List of Accounts` value for the **Principal Type** parameter. @@ -36,6 +30,2 @@ You must set this parameter to `Yes` if you’re using the `List of Accounts` va -**Web UI Settings** -**Web User Interface** | `Yes` | Option to deploy web UI to manage and audit the changes in the network. Select `No` to skip creation of the Console bucket, CloudFront, Amazon Cognito user pool, AWS WAF, and other support resources. - -###### Note - -If you select `No` for this parameter, skip the remaining parameters in the **Web UI Settings** section. +**Web UI Settings** | | +**Web User Interface** | `Yes` | Option to deploy web UI to manage and audit the changes in the network. Select `No` to skip creation of the Console bucket, CloudFront, Amazon Cognito user pool, AWS WAF, and other support resources. NOTE: If you select `No` for this parameter, skip the remaining parameters in the **Web UI Settings** section. @@ -43,2 +33,2 @@ If you select `No` for this parameter, skip the remaining parameters in the **We -**Cognito Domain Prefix** | ``<Requires input>`` | The prefix to the Cognito hosted domain name that will be associated with the user pool. Must be unique per AWS Region and must not contain reserved word 'cognito'. -**Console Login Information Email** | ``<Requires input>`` | The email address of the administrator user for the web UI. After launch, the solution sends an email to this address with a temporary password for the web UI. +**Cognito Domain Prefix** | `<Requires input>` | The prefix to the Cognito hosted domain name that will be associated with the user pool. Must be unique per AWS Region and must not contain reserved word 'cognito'. +**Console Login Information Email** | `<Requires input>` | The email address of the administrator user for the web UI. After launch, the solution sends an email to this address with a temporary password for the web UI. @@ -47 +37 @@ If you select `No` for this parameter, skip the remaining parameters in the **We -**Set MFA for Cognito to ‘ON’ or ‘OPTIONAL’** | `OPTIONAL` | `ON` – Amazon Cognito users will need to set up multi-factor authentication (MFA) on first login. `OPTIONAL` – Amazon Cognito users may opt to set up MFA. +**Set MFA for Cognito to '`ON' or '`OPTIONAL'** | `OPTIONAL` | `ON` \- Amazon Cognito users will need to set up multi-factor authentication (MFA) on first login. `OPTIONAL` \- Amazon Cognito users may opt to set up MFA. @@ -50 +40 @@ If you select `No` for this parameter, skip the remaining parameters in the **We -**Transit Gateway Settings** +**Transit Gateway Settings** | | @@ -55,34 +45,8 @@ If you’re updating the solution, provide a value. -**(Optional) Do you wish to register the transit gateway with a global network?** | `Yes` | Choose whether to register the transit gateway with the global network. - -###### Note - -You must set this parameter to `No` if either of the following is true: - * The transit gateway managed by the solution is already registered with an existing global network. - * The global network is not available in your selected AWS Region. Refer to [Region availability](https://docs.aws.amazon.com/network-manager/latest/tgwnm/what-are-global-networks.html#nm-available-regions) in the _AWS Global Networks for Transit Gateways User Guide_. -**(Optional) Do you wish to use an existing global network? If yes, you must provide the global network id below.** | _< Optional input>_ | You can skip this section if you chose `No` for the previous parameter. The existing global network ID. To register the transit gateway ID (see previous parameter), provide an existing global network ID. For example, `global-network-01231231231231231`. If you don’t provide a value, the solution creates a new global network. If you do provide a value, ensure that the existing transit gateway provided in the **(Optional) Do you wish to use an existing transit gateway? If yes, you must provide the transit gateway id below.** parameter isn’t already registered with the existing global network ID. - -###### Note - -If you use this solution in more than one Region, we recommended using the global network created by the first solution deployment to register all the transit gateways deployed by the solution in all the Regions with the same global network. -**VPC Route Table Settings** -**Choose the type of destination for target Transit Gateway** | `All-traffic (0/0)` | Specify the default route setting for the route table associated with the tagged subnets. Choose from `All-traffic (0/0)`, `RFC-1918 (10/8, 172.16/12, 192.168/16)`, `Custom-Destinations`, or `Configure-Manually`. - -###### Note - -If the route already exists, the solution will not overwrite it. -**If selected ‘Custom-Destinations’, provide a comma separated list of CIDR Blocks.** | _< Optional Input>_ | Option to provide CIDR block(s). For example, `192.168.1.0/24, 192.168.2.0/24`. - -###### Note - -Optional if providing prefix list ID(s). -**If selected ‘Custom-Destinations’, provide a comma separated list of Customer-managed Prefix List IDs.** | _< Optional input>_ | Option to provide customer-managed prefix list ID(s). For example, `pl-abcd1234, pl-efgh5678`. - -###### Note - -Optional if providing CIDR block(s). -**Tag Settings** -**Tag key for subnets - Adds subnet to VPC attachment and add routes to route table associated with the tagged subnet.** | `Attach-to-tgw` | Specify a custom tag key name to initiate the transit gateway attachment workflow. - -###### Note - -After initial deployment, don’t change this solution’s default parameter. If you change this parameter after deployment, you must manually update the tags on your VPCs. +**(Optional) Do you wish to register the transit gateway with a global network?** | `Yes` | Choose whether to register the transit gateway with the global network. NOTE: You must set this parameter to `No` if either of the following is true: **The transit gateway managed by the solution is already registered with an existing global network.** The global network is not available in your selected AWS Region. Refer to [Region availability](https://docs.aws.amazon.com/network-manager/latest/tgwnm/what-are-global-networks.html#nm-available-regions) in the _AWS Global Networks for Transit Gateways User Guide_. +**(Optional) Do you wish to use an existing global network? If yes, you must provide the global network id below.** | _< Optional input>_ | You can skip this section if you chose `No` for the previous parameter. The existing global network ID. To register the transit gateway ID (see previous parameter), provide an existing global network ID. For example, `global-network-01231231231231231`. If you don’t provide a value, the solution creates a new global network. If you do provide a value, ensure that the existing transit gateway provided in the **(Optional) Do you wish to use an existing transit gateway? If yes, you must provide the transit gateway id below.** parameter isn’t already registered with the existing global network ID.NOTE: If you use this solution in more than one Region, we recommended using the global network created by the first solution deployment to register all the transit gateways deployed by the solution in all the Regions with the same global network. +**VPC Route Table Settings** | | +**Choose the type of destination for target Transit Gateway** | `All-traffic (0/0)` | Specify the default route setting for the route table associated with the tagged subnets. Choose from `All-traffic (0/0)`, `RFC-1918 (10/8, 172.16/12, 192.168/16)`, `Custom-Destinations`, or `Configure-Manually`. NOTE: If the route already exists, the solution will not overwrite it. +**If selected '`Custom-Destinations', provide a comma separated list of CIDR Blocks.** | _< Optional Input>_ | Option to provide CIDR block(s). For example, `192.168.1.0/24, 192.168.2.0/24`. NOTE: Optional if providing prefix list ID(s). +**If selected '`Custom-Destinations', provide a comma separated list of Customer-managed Prefix List IDs.** | _< Optional input>_ | Option to provide customer-managed prefix list ID(s). For example, `pl-abcd1234, pl-efgh5678`. NOTE: Optional if providing CIDR block(s). +**Tag Settings** | | +**Tag key for subnets - Adds subnet to VPC attachment and add routes to route table associated with the tagged subnet.** | `Attach-to-tgw` | Specify a custom tag key name to initiate the transit gateway attachment workflow. NOTE: After initial deployment, don’t change this solution’s default parameter. If you change this parameter after deployment, you must manually update the tags on your VPCs. @@ -90,10 +54,2 @@ After initial deployment, don’t change this solution’s default parameter. If -**Tag key for TGW Route Table Association with TGW Attachment** | `Associate-with` | Specify a custom tag key name to initiate the transit gateway route table association with the transit gateway attachment workflow. - -###### Note - -After initial deployment, don’t change this solution’s default parameter. If you change this parameter after deployment, you must manually update the tags on your VPCs. -**Tag key for Route Propagation to TGW Route Table(s)** | `Propagate-to` | Specify a custom tag key name to initiate the route propagation to the transit gateway route table(s) workflow. - -###### Note - -After initial deployment, don’t change this solution’s default parameter. If you change this parameter after deployment, you must manually update the tags on your VPCs. +**Tag key for TGW Route Table Association with TGW Attachment** | `Associate-with` | Specify a custom tag key name to initiate the transit gateway route table association with the transit gateway attachment workflow. NOTE: After initial deployment, don’t change this solution’s default parameter. If you change this parameter after deployment, you must manually update the tags on your VPCs. +**Tag key for Route Propagation to TGW Route Table(s)** | `Propagate-to` | Specify a custom tag key name to initiate the route propagation to the transit gateway route table(s) workflow. NOTE: After initial deployment, don’t change this solution’s default parameter. If you change this parameter after deployment, you must manually update the tags on your VPCs. @@ -102 +58 @@ After initial deployment, don’t change this solution’s default parameter. If -**Notification Settings** +**Notification Settings** | | @@ -131 +87 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Step 2: (Optional) Launch the service-linked-role hub stack +Step 2: (Optional) Launch the service-linked role for AWS RAM hub stack