AWS AWSCloudFormation documentation change
Summary
Updated terminology from 'stack instances' to 'stacks' throughout documentation. Added detailed account filtering options (Intersection/Difference/Union), clarified OU deletion behavior, restructured CLI examples, and expanded operation preference configurations.
Security assessment
Changes focus on terminology consistency and operational clarity rather than addressing security vulnerabilities. While account filtering options improve precision, they represent standard operational controls rather than new security features. No CVEs, vulnerabilities, or security advisories are referenced.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stackinstances-delete.md b/AWSCloudFormation/latest/UserGuide/stackinstances-delete.md index 1ef6dcc76..5d1c25202 100644 --- a//AWSCloudFormation/latest/UserGuide/stackinstances-delete.md +++ b//AWSCloudFormation/latest/UserGuide/stackinstances-delete.md @@ -3 +3 @@ -Delete stack instances (console)Delete stack instances (AWS CLI) +Delete stacks from your stack set (console)Delete stacks from your stack set (AWS CLI) @@ -5 +5 @@ Delete stack instances (console)Delete stack instances (AWS CLI) -# Delete stack instances from CloudFormation StackSets +# Delete stacks from CloudFormation StackSets @@ -7,3 +7 @@ Delete stack instances (console)Delete stack instances (AWS CLI) -You can delete stack instances from a stack set using either the CloudFormation console or the AWS CLI. - -For a stack set with service-managed permissions, if you delete stack instances from a top-level organizational unit (OU), the OU is removed as a target of the stack set. +You can delete stacks from StackSets using either the CloudFormation console or the AWS CLI. @@ -13 +11,3 @@ For a stack set with service-managed permissions, if you delete stack instances - * Delete stack instances (console) + * Delete stacks from your stack set (console) + + * Delete stacks from your stack set (AWS CLI) @@ -15 +14,0 @@ For a stack set with service-managed permissions, if you delete stack instances - * Delete stack instances (AWS CLI) @@ -18,0 +18 @@ For a stack set with service-managed permissions, if you delete stack instances +###### Note @@ -20 +20,3 @@ For a stack set with service-managed permissions, if you delete stack instances -## Delete stack instances (console) +Deleting stacks from a top-level organizational unit (OU) removes that OU as a stack set target. + +## Delete stacks from your stack set (console) @@ -28 +30 @@ For a stack set with service-managed permissions, if you delete stack instances - 4. With the stack set selected, choose **Delete stacks from StackSet** from the **Actions** menu. + 4. With your stack set selected, choose **Delete stacks from StackSet** from the **Actions** menu. @@ -30 +32 @@ For a stack set with service-managed permissions, if you delete stack instances - 5. On the **Set deployment options** page, choose the accounts to delete stack instances from. + 5. On the **Set deployment options** page, first choose the accounts and Regions where you want to delete the stacks. @@ -32 +34 @@ For a stack set with service-managed permissions, if you delete stack instances - 1. [Self-managed permissions] For **Accounts** , choose **Deploy stacks in accounts**. Paste your target account numbers in the text box, separating multiple numbers with commas. + 1. [Self-managed permissions] For **Accounts** , choose **Deploy stacks in accounts** or **Deploy stacks in organizational units**. @@ -34 +36 @@ For a stack set with service-managed permissions, if you delete stack instances -[Service-managed permissions] For **Organizational units (OUs)** , specify the target OU IDs. +If you choose **Deploy stacks in accounts** , paste your target account numbers in the **Account numbers** text box, separating multiple numbers with commas. @@ -36 +38 @@ For a stack set with service-managed permissions, if you delete stack instances -###### Note +If you choose **Deploy stacks in organizational units** , paste a target OU ID in the **Organization numbers** text box to target all accounts that are part of the specified organization. @@ -38 +40 @@ For a stack set with service-managed permissions, if you delete stack instances -StackSets also deletes stack instances from any child OUs of the specified target OUs. + 2. [Service-managed permissions] For **Organizational units (OUs)** , specify the target OU IDs. @@ -40 +42 @@ StackSets also deletes stack instances from any child OUs of the specified targe - 2. For **Specify regions** , choose the Regions you want to delete stack instances from. +###### Important @@ -42 +44 @@ StackSets also deletes stack instances from any child OUs of the specified targe - 3. For **Deployment options** : +CloudFormation will delete stacks from both the specified target OUs and their child OUs. @@ -44 +46 @@ StackSets also deletes stack instances from any child OUs of the specified targe - * For **Maximum concurrent accounts** , modify the maximum concurrent accounts as needed. +For **Account filter type** , you can refine which accounts will have stacks deleted by choosing one of the following options and providing account numbers. @@ -46 +48 @@ StackSets also deletes stack instances from any child OUs of the specified targe - * For **Failure tolerance** , modify the failure tolerance as needed. + * **None** (default) – Delete stacks from all accounts in the specified OUs. @@ -48 +50 @@ StackSets also deletes stack instances from any child OUs of the specified targe - * For **Retain stacks** , choose whether to enable this option to remove the stack instances from your stack set, but save the stacks and their associated resources. When you save stacks from a stack set by enabling the **Retain stacks** option, the stack's resources stay in their current state, but the stack is no longer part of the stack set. To reassociate a stack or add an existing stack to a stack set, see [Import stacks into CloudFormation StackSets](./stacksets-import.html). + * **Intersection** – Delete stacks only from specific individual accounts within the selected OUs. @@ -50 +52 @@ StackSets also deletes stack instances from any child OUs of the specified targe - * For **Region concurrency** , modify the region concurrency as needed. + * **Difference** – Delete stacks from all accounts in the selected OUs except for specific accounts. @@ -52 +54 @@ StackSets also deletes stack instances from any child OUs of the specified targe - * For **Concurrency mode** , modify the concurrency mode as needed. + * **Union** – Delete stacks from the specified OUs plus additional individual accounts. @@ -54 +56 @@ StackSets also deletes stack instances from any child OUs of the specified targe - 4. Choose **Next**. + 3. For **Specify regions** , choose the Regions from which you want to delete stacks within the target accounts. @@ -56 +58 @@ StackSets also deletes stack instances from any child OUs of the specified targe - 6. On the **Review** page, review your choices. To make changes, choose **Edit** on the related section. + 6. For **Deployment options** , do the following: @@ -58 +60 @@ StackSets also deletes stack instances from any child OUs of the specified targe - 7. When you are ready to remove the stack instances from your stack set, choose **Submit**. + * For **Maximum concurrent accounts** , specify how many accounts are processed concurrently. @@ -60 +62 @@ StackSets also deletes stack instances from any child OUs of the specified targe -After stack deletion is finished, you can verify that stack instances were deleted from your stack set in the StackSet detail page, on the **Stack instances** tab. + * For **Failure tolerance** , specify how many failures are acceptable before the operation stops. @@ -61,0 +64 @@ After stack deletion is finished, you can verify that stack instances were delet + * For **Retain stacks** , enable this option to save the stacks and their associated resources when removing them from your stack set. The resources stay in their current state but are no longer part of the stack set. @@ -62,0 +66 @@ After stack deletion is finished, you can verify that stack instances were delet + * For **Region concurrency** , choose how to process Regions: **Sequential** (one Region at a time) or **Parallel** (multiple Regions concurrently). @@ -63,0 +68 @@ After stack deletion is finished, you can verify that stack instances were delet + * For **Concurrency mode** , choose how concurrency behaves during operation execution. @@ -65 +70 @@ After stack deletion is finished, you can verify that stack instances were delet -## Delete stack instances (AWS CLI) + * **Strict failure tolerance** – Reduces concurrency level when failures occur, staying within **Failure tolerance** +1. @@ -67 +72 @@ After stack deletion is finished, you can verify that stack instances were delet -When acting as a delegated administrator, you must set the `--call-as` option to `DELEGATED_ADMIN` each time you run a StackSets command. + * **Soft failure tolerance** – Maintains your specified concurrency level (the value of **Maximum concurrent accounts**) regardless of failures. @@ -68,0 +74 @@ When acting as a delegated administrator, you must set the `--call-as` option to + 7. Choose **Next**. @@ -70 +76 @@ When acting as a delegated administrator, you must set the `--call-as` option to - --call-as DELEGATED_ADMIN + 8. On the **Review** page, review your choices. To make changes, choose **Edit** on the related section. @@ -72 +78 @@ When acting as a delegated administrator, you must set the `--call-as` option to - 1. Use the **delete-stack-instances** command. For `--stack-set-name`, specify the stack set name. + 9. When you are ready to remove the stacks from your stack set, choose **Submit**. @@ -74 +80 @@ When acting as a delegated administrator, you must set the `--call-as` option to -Because `--retain-stacks` is required for the **delete-stack-instances** command, if you don't want to retain (save) stacks, add `--no-retain-stacks`. In this example, we add the `--no-retain-stacks` option, because we aren't retaining any stacks. +After stack deletion is finished, you can verify that stacks were deleted from your stack set in the stack set detail page, on the **Stack instances** tab. @@ -76 +81,0 @@ Because `--retain-stacks` is required for the **delete-stack-instances** command -For `--regions`, specify the regions you want to delete stack instances from. In this example, US West (Oregon) Region and US East (N. Virginia) Region. @@ -78 +82,0 @@ For `--regions`, specify the regions you want to delete stack instances from. In -[Self-managed permissions] For the `--accounts` option, specify the accounts you used to create your stack set. @@ -80,3 +83,0 @@ For `--regions`, specify the regions you want to delete stack instances from. In - aws cloudformation delete-stack-instances --stack-set-name my-stackset \ - --accounts '["account_ID_1","account_ID_2"]' --regions '["us-west-2","us-east-1"]' \ - --no-retain-stacks @@ -84 +85 @@ For `--regions`, specify the regions you want to delete stack instances from. In -[Service-managed permissions] For `--deployment-targets`, specify the organization (root) ID or OU IDs you created stack instances in. +## Delete stacks from your stack set (AWS CLI) @@ -86,3 +87 @@ For `--regions`, specify the regions you want to delete stack instances from. In - aws cloudformation delete-stack-instances --stack-set-name my-stackset \ - --deployment-targets OrganizationalUnitIds='["ou-rcuk-1x5jlwo", "ou-rcuk-slr5lh0a"]' --regions '["us-west-2","us-east-1"]' \ - --no-retain-stacks +When acting as a delegated administrator, you must set the `--call-as` option to `DELEGATED_ADMIN` each time you run a stack set command. @@ -90 +88,0 @@ For `--regions`, specify the regions you want to delete stack instances from. In -###### Note @@ -92 +90,3 @@ For `--regions`, specify the regions you want to delete stack instances from. In -StackSets also deletes stack instances from any child OUs of the specified target OUs. + --call-as DELEGATED_ADMIN + + 1. Use the **delete-stack-instances** command with your stack set name. @@ -94 +94 @@ StackSets also deletes stack instances from any child OUs of the specified targe -To specify your preferences for how CloudFormation performs this stack set operation, specify the `--operation-preferences` option, as in the following example. For the purposes of this example, we're using count, not percentage. To apply percentages instead, use `FailureTolerancePercentage` or `MaxConcurrentPercentage`. +In these examples, we use the `--no-retain-stacks` option because we aren't retaining any stacks. Use `--retain-stacks` instead of `--no-retain-stacks` if you want to keep the stacks and their resources. @@ -96 +96 @@ To specify your preferences for how CloudFormation performs this stack set opera - --operation-preferences FailureToleranceCount=0,MaxConcurrentCount=1 +For `--regions`, specify the AWS Regions you want to delete stacks from, for example, `us-west-2` and `us-east-1`. @@ -98 +98,21 @@ To specify your preferences for how CloudFormation performs this stack set opera -###### Note +Set concurrent account processing and other preferences using the `--operation-preferences` option. These examples use count-based settings. Note that `MaxConcurrentCount` must not exceed `FailureToleranceCount` \+ 1. For percentage-based settings, use `FailureTolerancePercentage` or `MaxConcurrentPercentage` instead. + +[Self-managed permissions] For the `--accounts` option, specify the IDs of the account to delete stacks from. + + aws cloudformation delete-stack-instances --stack-set-name my-stackset \ + --accounts account_ID_1 account_ID_2 \ + --regions us-west-2 us-east-1 \ + --no-retain-stacks \ + --operation-preferences MaxConcurrentCount=1,FailureToleranceCount=0 + +[Service-managed permissions] For `--deployment-targets`, specify the organization root ID or organizational unit (OU) IDs to delete stacks from. + +###### Important + +CloudFormation will delete stacks from both the specified target OUs and their child OUs. + + aws cloudformation delete-stack-instances --stack-set-name my-stackset \ + --deployment-targets OrganizationalUnitIds='["ou-rcuk-1x5jlwo", "ou-rcuk-slr5lh0a"]' \ + --regions us-west-2 us-east-1 \ + --no-retain-stacks \ + --operation-preferences MaxConcurrentCount=1,FailureToleranceCount=0 @@ -100 +120 @@ To specify your preferences for how CloudFormation performs this stack set opera -The value of `MaxConcurrentCount` is dependent on the value of `FailureToleranceCount`. `MaxConcurrentCount` is at most one more than `FailureToleranceCount`. +For more information, see [DeleteStackInstances](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_DeleteStackInstances.html) in the _AWS CloudFormation API Reference_. @@ -102 +122 @@ The value of `MaxConcurrentCount` is dependent on the value of `FailureTolerance - 2. Optionally, after stack deletion is finished, verify that stack instances were deleted from your stack set by running the **describe-stack-set-operation** command to show the status and results of the delete stacks operation. For `--operation-id`, use the operation ID that was returned by your **delete-stack-instances** command. + 2. Optionally, after stack deletion is finished, verify that stacks were deleted from your stack set by running the **describe-stack-set-operation** command to show the status and results of the delete stacks operation. For `--operation-id`, use the operation ID that was returned by your **delete-stack-instances** command. @@ -116 +136 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Manage automatic deployments (service-managed permissions) +Enable-disable automatic deployments