AWS AWSCloudFormation documentation change
Summary
Updated documentation for creating self-managed StackSets, including parameter configuration details, CLI command adjustments, and operational guidance.
Security assessment
The changes clarify configuration steps for AWS Config and service-linked roles, which are security features, but there's no evidence of addressing a specific security vulnerability. The updates improve documentation accuracy for secure setups.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md b/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md index ac02736a9..54d12b5e5 100644 --- a//AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md +++ b//AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md @@ -7 +7 @@ Create a stack set with self-managed permissions (console)Create a stack set wit -With `self-managed` permissions, you can deploy stack instances to specific AWS accounts in specific Regions. To do this, you must first create the necessary IAM roles to establish a trusted relationship between the account you're administering the stack set from and the account you're deploying stack instances to. For more information, see [Grant self-managed permissions](./stacksets-prereqs-self-managed.html). +With _self-managed_ permissions, you can deploy stacks to specific AWS accounts in specific Regions. To do this, you must first create the necessary IAM roles to establish a trusted relationship between the account you're administering the stack set from and the account you're deploying stacks to. For more information, see [Grant self-managed permissions](./stacksets-prereqs-self-managed.html). @@ -40 +40 @@ The template referenced in this topic enables AWS Config in a target account wit - 8. On the **Specify StackSet details** page, for **StackSet name** , provide a name for the stack set. Stack set names must begin with an alphabetical character, and contain only letters, numbers, and hyphens. In this walkthrough, we use the name `my-awsconfig-stackset`. + 8. On the **Specify StackSet details** page, for **StackSet name** , provide a name for the stack set. stack set names must begin with an alphabetical character, and contain only letters, numbers, and hyphens. In this walkthrough, use the name `my-awsconfig-stackset`. @@ -44 +44 @@ The template referenced in this topic enables AWS Config in a target account wit - 10. For **Parameters** , review the template parameters that are used by AWS Config. + 10. Under **Parameters** , do the following: @@ -46 +46,7 @@ The template referenced in this topic enables AWS Config in a target account wit -###### Note + 1. Configure the **Recorder Configuration** parameters that are used by AWS Config. For more information about these parameters, see [Manual setup for AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/manual-setup.title.html) in the _AWS Config Developer Guide_. + + 1. For **Support all resource types** , keep the default value, **true** , to record all supported resource types. + + 2. For **Include global resource types** , keep the default value, **false** , to exclude global resources like IAM roles. + + 3. Leave **List of resource types if not all supported** set to **< All>**. Only add specific resource types if you selected **false** for **Support all resource types**. @@ -48 +54 @@ The template referenced in this topic enables AWS Config in a target account wit -For the purposes of this walkthrough, you can use the default settings in this section. + 4. For **The region containing the Config service-linked role resource** , replace **< DeployToAnyRegion>** with `us-west-2`. This means that the service-linked role named `AWSServiceRoleForConfig` will only be created if a stack is deployed to the US West (Oregon) Region. You'll choose the deployment Regions later in this procedure. @@ -50 +56 @@ For the purposes of this walkthrough, you can use the default settings in this s - 1. For **Recorder Configuration** , review the default values. For more information about these parameters, see [Setting up AWS Config with the console](https://docs.aws.amazon.com/config/latest/developerguide/gs-console.html) in the _AWS Config Developer Guide_. + 5. For **Configuration recorder recording frequency** , choose between **CONTINUOUS** or **DAILY** recording. @@ -52 +58 @@ For the purposes of this walkthrough, you can use the default settings in this s - 2. (Optional) For **Delivery Channel Configuration** , review the default values for the delivery channel for updates and notifications. For more information about the delivery channel in AWS Config, see [Managing the delivery channel](https://docs.aws.amazon.com/config/latest/developerguide/manage-delivery-channel.html) in the _AWS Config Developer Guide_. + 2. (Optional) Under **Delivery Channel Configuration** , configure the delivery channel for updates and notifications. For more information about the delivery channel in AWS Config, see [Managing the delivery channel](https://docs.aws.amazon.com/config/latest/developerguide/manage-delivery-channel.html) in the _AWS Config Developer Guide_. @@ -54 +60 @@ For the purposes of this walkthrough, you can use the default settings in this s - 3. (Optional) For **Delivery Notifications** , review the default configuration for the Amazon Simple Notification Service (SNS) notifications. + 3. (Optional) Under **Delivery Notifications** , configure Amazon Simple Notification Service (SNS) notifications. @@ -58 +64 @@ For the purposes of this walkthrough, you can use the default settings in this s - 12. On the **Configure StackSet options** page, add a tag by specifying a key and value pair. In this walkthrough, we create a tag called **Stage** , with a value of **Test**. Tags that you apply to stack sets are applied to all resources that are created by your stacks. For more information about how tags are used in AWS, see [Organizing and tracking costs using AWS cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing and Cost Management User Guide_. + 12. On the **Configure StackSet options** page, add a tag by specifying a key and value pair. In this walkthrough, we create a tag called **Stage** , with a value of **Test**. Tags that you apply to StackSets are applied to all resources that are created by your stacks. For more information about how tags are used in AWS, see [Organizing and tracking costs using AWS cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing and Cost Management User Guide_. @@ -64,3 +70 @@ For the purposes of this walkthrough, you can use the default settings in this s -If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. - -You can't modify your stack set's execution configuration while there are running or queued operations for that stack set. +When operations are running or queued, StackSets queues all incoming operations even if they're non-conflicting. You can't change execution settings during this time. @@ -80 +84 @@ By default, CloudFormation will deploy stacks in the specified accounts within t - 19. For **Deployment options** : + 19. For **Deployment options** , do the following: @@ -90 +94 @@ This means that a maximum of one stack deployment can fail in one of your specif - * For **Region concurrency** , select **Sequential** or **Parallel** to determine StackSets deployment order for specified Regions. By default, **Sequential** is selected. + * For **Region concurrency** , choose **Sequential** (default) or **Parallel** to determine StackSets deployment order for specified Regions. @@ -107 +111 @@ CloudFormation starts creating your stack set. View the progress and status of t -When you create stack sets by using AWS CLI commands, you run two separate commands: **create-stack-set** to upload your template and create the stack set container, and **create-stack-instances** to create the stacks within your stack set. +When you create StackSets by using AWS CLI commands, you run two separate commands: **create-stack-set** to upload your template and create the stack set container, and **create-stack-instances** to create the stacks within your stack set. @@ -114,7 +118 @@ When you create stack sets by using AWS CLI commands, you run two separate comma - --parameters ParameterKey=RecordingFrequency,ParameterValue="DAILY" - -###### Note - -If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. - -You can't modify your stack set's execution configuration while there are running or queued operations for that stack set. + --parameters ParameterKey=ServiceLinkedRoleRegion,ParameterValue="us-west-2" ParameterKey=RecordingFrequency,ParameterValue="DAILY" @@ -126 +124,3 @@ You can't modify your stack set's execution configuration while there are runnin - 3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stack instances to your stack set. In this walkthrough, we use `us-west-2` and `us-east-1` as the values of the `--regions` option. + 3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stacks to your stack set. In this walkthrough, we use `us-west-2` and `us-east-1` as the values of the `--regions` option. + +Set concurrent account processing and other deployment preferences using the `--operation-preferences` option. This example uses count-based settings. Note that `MaxConcurrentCount` must not exceed `FailureToleranceCount` \+ 1. For percentage-based settings, use `FailureTolerancePercentage` or `MaxConcurrentPercentage` instead. @@ -131,11 +131,2 @@ You can't modify your stack set's execution configuration while there are runnin - --regions us-west-2 us-east-1 - -To specify your preferences for how CloudFormation performs this stack set operation, specify the `--operation-preferences` option, as in the following example. For the purposes of this example, we're using count, not percentage. To apply percentages instead, use `FailureTolerancePercentage` or `MaxConcurrentPercentage`. - - --operation-preferences FailureToleranceCount=0,MaxConcurrentCount=1 - -###### Note - -The value of `MaxConcurrentCount` is dependent on the value of `FailureToleranceCount`. `MaxConcurrentCount` is at most one more than `FailureToleranceCount`. - -###### Important + --regions us-west-2 us-east-1 \ + --operation-preferences MaxConcurrentCount=1,FailureToleranceCount=0 @@ -143 +134 @@ The value of `MaxConcurrentCount` is dependent on the value of `FailureTolerance -Wait until an operation is complete before starting another one. You can run only one operation at a time. +For more information, see [CreateStackInstances](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStackInstances.html) in the _AWS CloudFormation API Reference_. @@ -145 +136 @@ Wait until an operation is complete before starting another one. You can run onl - 4. Using the `operation-id` that was returned as part of the **create-stack-instances** output, use the following [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) command to verify that your stack instances were created successfully. + 4. Using the `operation-id` that was returned as part of the **create-stack-instances** output, use the following [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) command to verify that your stacks were created successfully.