AWS AWSCloudFormation documentation change
Summary
Updated IaC generator documentation with clarifications on permissions handling, quota changes (increased scan limits for smaller accounts), terminology consistency ('CloudFormation' branding), and documentation links
Security assessment
Added explicit clarification that missing permissions during scans exclude resources without failing the scan. This improves documentation about security-related access control behavior but doesn't address a specific vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/generate-IaC.md b/AWSCloudFormation/latest/UserGuide/generate-IaC.md index 8d3d4a004..7cdeacff6 100644 --- a/AWSCloudFormation/latest/UserGuide/generate-IaC.md +++ b/AWSCloudFormation/latest/UserGuide/generate-IaC.md @@ -35 +35 @@ The IaC generation process consists of the following steps: -The IaC generator feature is available in all commercial Regions and supports many common AWS resource types. For a full list, see [Resource type support](./resource-import-supported-resources.html). +The IaC generator feature is available in all commercial Regions and supports many common AWS resource types. For a full list of supported resources, see [Resource type support](./resource-import-supported-resources.html). @@ -47 +47 @@ The IaC generator feature is available in all commercial Regions and supports ma - * [Start a resource scan with AWS CloudFormation IaC generator](./iac-generator-start-resource-scan.html) + * [Start a resource scan with CloudFormation IaC generator](./iac-generator-start-resource-scan.html) @@ -62 +62 @@ The IaC generator feature is available in all commercial Regions and supports ma -You can generate JSON or YAML templates for AWS resources published to the CloudFormation registry, for resources for which you have Read permissions. The templates for the IaC generator capability models cloud resources reliably and quickly without having to describe a resource property by property. +You can generate JSON or YAML templates for AWS resources that you have read access to. The templates for the IaC generator capability models cloud resources reliably and quickly without having to describe a resource property by property. @@ -66,9 +66,9 @@ The following table lists the quotas available for the IaC generation feature. -Name | Value ----|--- -Maximum number of resources that can be processed in an account scan | 100000 -Number of scans per day (for accounts with less than 10,000 resources) | 3 -Number of scans per day (for accounts with more than 10,000 resources) | 1 -Concurrent number of templates generating per account | 5 -Concurrent number of resources modeled for one template generation. | 5 -Total number of resources that can be modeled in one template | 500 -Maximum number of generated templates per account | 1,000 +Name | Full scan | Partial scan +---|---|--- +Maximum number of resources that can be processed in a scan | 100,000 | 100,000 +Number of scans per day (for scans with less than 10,000 resources) | 10 | 10 +Number of scans per day (for scans with more than 10,000 resources) | 1 | 1 +Concurrent number of templates generating per account | 5 | 5 +Concurrent number of resources modeled for one template generation | 5 | 5 +Total number of resources that can be modeled in one template | 500 | 500 +Maximum number of generated templates per account | 1,000 | 1,000 @@ -78 +78 @@ Maximum number of generated templates per account | 1,000 -IaC generator only supports resources that are supported by Cloud Control API in your Region. For more information, see [Determining if a resource type supports Cloud Control API](https://docs.aws.amazon.com/cloudcontrolapi/latest/userguide/resource-types.html#resource-types-determine-support) in the _Cloud Control API User Guide_ +IaC generator only supports AWS resources that are supported by Cloud Control API in your Region. For more information, see [Resource type support](./resource-import-supported-resources.html). @@ -91 +91 @@ To scan resources with IaC generator, your IAM principal (user, role, or group) -The scan scope is limited to resources you have read access to. +The scan scope is limited to resources you have read access to. Missing permissions won't cause scan failure but will exclude those resources.