AWS AWSCloudFormation documentation change
Summary
Added documentation for partial resource scanning capabilities, including console/CLI instructions and examples. Enhanced guidance on scan types (full vs partial) and related resource discovery logic.
Security assessment
Changes focus on improving scanning functionality and user guidance without addressing specific security vulnerabilities. While security-related resources like security groups are mentioned in examples, this is part of normal feature documentation rather than security-specific content.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/iac-generator-start-resource-scan.md b/AWSCloudFormation/latest/UserGuide/iac-generator-start-resource-scan.md index 9add52f50..e61cc70cb 100644 --- a/AWSCloudFormation/latest/UserGuide/iac-generator-start-resource-scan.md +++ b/AWSCloudFormation/latest/UserGuide/iac-generator-start-resource-scan.md @@ -5 +5 @@ Start a resource scan (console)Start a resource scan (AWS CLI) -# Start a resource scan with AWS CloudFormation IaC generator +# Start a resource scan with CloudFormation IaC generator @@ -7 +7,21 @@ Start a resource scan (console)Start a resource scan (AWS CLI) -Before you create a template from existing resources, you first must initiate a scan of your resources to discover all provisioned resources and the relationship between resources. Depending on how many resources you have in your account and the specified AWS Region, this scanning process can take some time to complete. +Before you create a template from existing resources, you first must initiate a resource scan to discover your current resources and their relationships. + +You can start a resource scan using one of the following options. For first-time users of IaC generator, we recommend the first option. + + * Scan all resources (full scan) – Scans all existing resources in the current account and Region. This scanning process can take up to 10 minutes for 1,000 resources. + + * Scan specific resources (partial scan) – Manually select which resource types to scan in the current account and Region. This option provides a faster and more focused scanning process, making it ideal for iterative template development. + + + + +After the scan completes, you can choose which resources and their related resources to include when generating your template. When using partial scanning, related resources will only be available during template generation if either: + + * You specifically selected them before starting the scan, or + + * They were required to discover your selected resource types. + + + + +For example, if you select `AWS::EKS::Nodegroup` without selecting `AWS::EKS::Cluster`, IaC generator automatically includes `AWS::EKS::Cluster` resources in the scan because discovering the node group requires discovering the cluster first. In all other cases, the scan will only include the resources you specifically select. @@ -12,0 +33,9 @@ Before you continue, confirm that you have the permissions required to work with +###### Topics + + * Start a resource scan (console) + + * Start a resource scan (AWS CLI) + + + + @@ -15 +44,12 @@ Before you continue, confirm that you have the permissions required to work with -###### To start a resource scan +###### To start a resource scan of all resource types (full scan) + + 1. Open the [IaC generator page](https://console.aws.amazon.com/cloudformation/home?#iac-generator) of the CloudFormation console. + + 2. On the navigation bar at the top of the screen, choose the AWS Region that contains the resources to scan. + + 3. From the **Scans** panel, choose **Start a new scan** and then choose **Scan all resources**. + + + + +###### To start a resource scan of specific resource types (partial scan) @@ -21 +61,3 @@ Before you continue, confirm that you have the permissions required to work with - 3. From the **Scans** panel, choose **Start a new scan**. + 3. From the **Scans** panel, choose **Start a new scan** and then choose **Scan specific resources**. + + 4. In the **Start partial scan** dialog box, select up to 100 resource types, and then choose **Start scan**. @@ -28 +70 @@ Before you continue, confirm that you have the permissions required to work with -###### To start a resource scan +###### To start a resource scan of all resource types (full scan) @@ -42,0 +85,28 @@ If successful, this command returns the ARN of the scan. Note the ARN in the `Re +###### To start a resource scan of specific resource types (partial scan) + + 1. Use the following [cat](https://en.wikipedia.org/wiki/Cat_\(Unix\)) command to store the resource types you want to scan in a JSON file named `config.json` in your home directory. The following is an example scanning configuration that scans for Amazon EC2 instances, security groups, and all Amazon S3 resources. + + $ cat > config.json + [ + { + "Types":[ + "AWS::EC2::Instance", + "AWS::EC2::SecurityGroup", + "AWS::S3::*" + ] + } + + 2. Use the [start-resource-scan](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/start-resource-scan.html) command with the `--scan-filters` option, along with the `config.json` file you created, to start the partial scan. Replace `us-east-1` with the AWS Region that contains the resources to scan. + + aws cloudformation start-resource-scan --scan-filters file://config.json --region us-east-1 + +If successful, this command returns the ARN of the scan. Note the ARN in the `ResourceScanId` property. You need it to create your template. + + { + "ResourceScanId": + "arn:aws:cloudformation:region:account-id:resourceScan/0a699f15-489c-43ca-a3ef-3e6ecfa5da60" + } + + + + @@ -51 +121 @@ Use the [describe-resource-scan](https://docs.aws.amazon.com/cli/latest/referenc -If successful, this command returns the following. +If successful, this command returns output similar to the following: @@ -55,2 +125 @@ If successful, this command returns the following. - "ResourceScanId" : - "arn:aws:cloudformation:region:account-id:resourceScan/0a699f15-489c-43ca-a3ef-3e6ecfa5da60", + "ResourceScanId": "arn:aws:cloudformation:region:account-id:resourceScan/0a699f15-489c-43ca-a3ef-3e6ecfa5da60", @@ -62,2 +131,35 @@ If successful, this command returns the following. - "AWS::EKS::Cluster", - "AWS::AutoScaling::AutoScalingGroup" + "AWS::CloudFront::CachePolicy", + "AWS::CloudFront::OriginRequestPolicy", + "AWS::EC2::DHCPOptions", + "AWS::EC2::InternetGateway", + "AWS::EC2::KeyPair", + "AWS::EC2::NetworkAcl", + "AWS::EC2::NetworkInsightsPath", + "AWS::EC2::NetworkInterface", + "AWS::EC2::PlacementGroup", + "AWS::EC2::Route", + "AWS::EC2::RouteTable", + "AWS::EC2::SecurityGroup", + "AWS::EC2::Subnet", + "AWS::EC2::SubnetCidrBlock", + "AWS::EC2::SubnetNetworkAclAssociation", + "AWS::EC2::SubnetRouteTableAssociation", + ... + ], + "ResourcesRead": 676 + } + +For a partial scan, the output will look similar to the following: + + + { + "ResourceScanId": "arn:aws:cloudformation:region:account-id:resourceScan/0a699f15-489c-43ca-a3ef-3e6ecfa5da60", + "Status": "COMPLETE", + "StartTime": "2025-03-06T18:24:19.542000+00:00", + "EndTime": "2025-03-06T18:25:23.142000+00:00", + "PercentageCompleted": 100.0, + "ResourceTypes": [ + "AWS::EC2::Instance", + "AWS::EC2::SecurityGroup", + "AWS::S3::Bucket", + "AWS::S3::BucketPolicy" @@ -64,0 +167,10 @@ If successful, this command returns the following. + "ResourcesRead": 65, + "ScanFilters": [ + { + "Types": [ + "AWS::EC2::Instance", + "AWS::EC2::SecurityGroup", + "AWS::S3::*" + ] + } + ]