AWS Security ChangesHomeSearch

AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2025-04-11 · Documentation low

File: AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md

Summary

Updated documentation for creating self-managed StackSets, including parameter configuration details, CLI command adjustments, and operational guidance.

Security assessment

The changes clarify configuration steps for AWS Config and service-linked roles, which are security features, but there's no evidence of addressing a specific security vulnerability. The updates improve documentation accuracy for secure setups.

Diff

diff --git a/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md b/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md
index ac02736a9..54d12b5e5 100644
--- a//AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md
+++ b//AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md
@@ -7 +7 @@ Create a stack set with self-managed permissions (console)Create a stack set wit
-With `self-managed` permissions, you can deploy stack instances to specific AWS accounts in specific Regions. To do this, you must first create the necessary IAM roles to establish a trusted relationship between the account you're administering the stack set from and the account you're deploying stack instances to. For more information, see [Grant self-managed permissions](./stacksets-prereqs-self-managed.html).
+With _self-managed_ permissions, you can deploy stacks to specific AWS accounts in specific Regions. To do this, you must first create the necessary IAM roles to establish a trusted relationship between the account you're administering the stack set from and the account you're deploying stacks to. For more information, see [Grant self-managed permissions](./stacksets-prereqs-self-managed.html).
@@ -40 +40 @@ The template referenced in this topic enables AWS Config in a target account wit
-  8. On the **Specify StackSet details** page, for **StackSet name** , provide a name for the stack set. Stack set names must begin with an alphabetical character, and contain only letters, numbers, and hyphens. In this walkthrough, we use the name `my-awsconfig-stackset`.
+  8. On the **Specify StackSet details** page, for **StackSet name** , provide a name for the stack set. stack set names must begin with an alphabetical character, and contain only letters, numbers, and hyphens. In this walkthrough, use the name `my-awsconfig-stackset`.
@@ -44 +44 @@ The template referenced in this topic enables AWS Config in a target account wit
-  10. For **Parameters** , review the template parameters that are used by AWS Config.
+  10. Under **Parameters** , do the following:
@@ -46 +46,7 @@ The template referenced in this topic enables AWS Config in a target account wit
-###### Note
+    1. Configure the **Recorder Configuration** parameters that are used by AWS Config. For more information about these parameters, see [Manual setup for AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/manual-setup.title.html) in the _AWS Config Developer Guide_. 
+
+      1. For **Support all resource types** , keep the default value, **true** , to record all supported resource types.
+
+      2. For **Include global resource types** , keep the default value, **false** , to exclude global resources like IAM roles.
+
+      3. Leave **List of resource types if not all supported** set to **< All>**. Only add specific resource types if you selected **false** for **Support all resource types**.
@@ -48 +54 @@ The template referenced in this topic enables AWS Config in a target account wit
-For the purposes of this walkthrough, you can use the default settings in this section.
+      4. For **The region containing the Config service-linked role resource** , replace **< DeployToAnyRegion>** with `us-west-2`. This means that the service-linked role named `AWSServiceRoleForConfig` will only be created if a stack is deployed to the US West (Oregon) Region. You'll choose the deployment Regions later in this procedure.
@@ -50 +56 @@ For the purposes of this walkthrough, you can use the default settings in this s
-    1. For **Recorder Configuration** , review the default values. For more information about these parameters, see [Setting up AWS Config with the console](https://docs.aws.amazon.com/config/latest/developerguide/gs-console.html) in the _AWS Config Developer Guide_.
+      5. For **Configuration recorder recording frequency** , choose between **CONTINUOUS** or **DAILY** recording.
@@ -52 +58 @@ For the purposes of this walkthrough, you can use the default settings in this s
-    2. (Optional) For **Delivery Channel Configuration** , review the default values for the delivery channel for updates and notifications. For more information about the delivery channel in AWS Config, see [Managing the delivery channel](https://docs.aws.amazon.com/config/latest/developerguide/manage-delivery-channel.html) in the _AWS Config Developer Guide_. 
+    2. (Optional) Under **Delivery Channel Configuration** , configure the delivery channel for updates and notifications. For more information about the delivery channel in AWS Config, see [Managing the delivery channel](https://docs.aws.amazon.com/config/latest/developerguide/manage-delivery-channel.html) in the _AWS Config Developer Guide_. 
@@ -54 +60 @@ For the purposes of this walkthrough, you can use the default settings in this s
-    3. (Optional) For **Delivery Notifications** , review the default configuration for the Amazon Simple Notification Service (SNS) notifications. 
+    3. (Optional) Under **Delivery Notifications** , configure Amazon Simple Notification Service (SNS) notifications. 
@@ -58 +64 @@ For the purposes of this walkthrough, you can use the default settings in this s
-  12. On the **Configure StackSet options** page, add a tag by specifying a key and value pair. In this walkthrough, we create a tag called **Stage** , with a value of **Test**. Tags that you apply to stack sets are applied to all resources that are created by your stacks. For more information about how tags are used in AWS, see [Organizing and tracking costs using AWS cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing and Cost Management User Guide_.
+  12. On the **Configure StackSet options** page, add a tag by specifying a key and value pair. In this walkthrough, we create a tag called **Stage** , with a value of **Test**. Tags that you apply to StackSets are applied to all resources that are created by your stacks. For more information about how tags are used in AWS, see [Organizing and tracking costs using AWS cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing and Cost Management User Guide_.
@@ -64,3 +70 @@ For the purposes of this walkthrough, you can use the default settings in this s
-If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting.
-
-You can't modify your stack set's execution configuration while there are running or queued operations for that stack set.
+When operations are running or queued, StackSets queues all incoming operations even if they're non-conflicting. You can't change execution settings during this time.
@@ -80 +84 @@ By default, CloudFormation will deploy stacks in the specified accounts within t
-  19. For **Deployment options** :
+  19. For **Deployment options** , do the following:
@@ -90 +94 @@ This means that a maximum of one stack deployment can fail in one of your specif
-     * For **Region concurrency** , select **Sequential** or **Parallel** to determine StackSets deployment order for specified Regions. By default, **Sequential** is selected.
+     * For **Region concurrency** , choose **Sequential** (default) or **Parallel** to determine StackSets deployment order for specified Regions. 
@@ -107 +111 @@ CloudFormation starts creating your stack set. View the progress and status of t
-When you create stack sets by using AWS CLI commands, you run two separate commands: **create-stack-set** to upload your template and create the stack set container, and **create-stack-instances** to create the stacks within your stack set. 
+When you create StackSets by using AWS CLI commands, you run two separate commands: **create-stack-set** to upload your template and create the stack set container, and **create-stack-instances** to create the stacks within your stack set. 
@@ -114,7 +118 @@ When you create stack sets by using AWS CLI commands, you run two separate comma
-      --parameters ParameterKey=RecordingFrequency,ParameterValue="DAILY"
-
-###### Note
-
-If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting.
-
-You can't modify your stack set's execution configuration while there are running or queued operations for that stack set.
+      --parameters ParameterKey=ServiceLinkedRoleRegion,ParameterValue="us-west-2" ParameterKey=RecordingFrequency,ParameterValue="DAILY"
@@ -126 +124,3 @@ You can't modify your stack set's execution configuration while there are runnin
-  3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stack instances to your stack set. In this walkthrough, we use `us-west-2` and `us-east-1` as the values of the `--regions` option.
+  3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stacks to your stack set. In this walkthrough, we use `us-west-2` and `us-east-1` as the values of the `--regions` option.
+
+Set concurrent account processing and other deployment preferences using the `--operation-preferences` option. This example uses count-based settings. Note that `MaxConcurrentCount` must not exceed `FailureToleranceCount` \+ 1. For percentage-based settings, use `FailureTolerancePercentage` or `MaxConcurrentPercentage` instead. 
@@ -131,11 +131,2 @@ You can't modify your stack set's execution configuration while there are runnin
-      --regions us-west-2 us-east-1
-
-To specify your preferences for how CloudFormation performs this stack set operation, specify the `--operation-preferences` option, as in the following example. For the purposes of this example, we're using count, not percentage. To apply percentages instead, use `FailureTolerancePercentage` or `MaxConcurrentPercentage`.
-    
-        --operation-preferences FailureToleranceCount=0,MaxConcurrentCount=1
-
-###### Note
-
-The value of `MaxConcurrentCount` is dependent on the value of `FailureToleranceCount`. `MaxConcurrentCount` is at most one more than `FailureToleranceCount`.
-
-###### Important
+      --regions us-west-2 us-east-1 \
+      --operation-preferences MaxConcurrentCount=1,FailureToleranceCount=0
@@ -143 +134 @@ The value of `MaxConcurrentCount` is dependent on the value of `FailureTolerance
-Wait until an operation is complete before starting another one. You can run only one operation at a time.
+For more information, see [CreateStackInstances](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStackInstances.html) in the _AWS CloudFormation API Reference_.
@@ -145 +136 @@ Wait until an operation is complete before starting another one. You can run onl
-  4. Using the `operation-id` that was returned as part of the **create-stack-instances** output, use the following [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) command to verify that your stack instances were created successfully.
+  4. Using the `operation-id` that was returned as part of the **create-stack-instances** output, use the following [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) command to verify that your stacks were created successfully.