AWS AWSCloudFormation documentation change
Summary
Updated terminology from 'stack instances' to 'stacks', clarified deployment options, added concurrency mode details, and improved CLI command documentation
Security assessment
Changes focus on terminology consistency and operational clarifications. No evidence of addressing security vulnerabilities or introducing new security features. Updates to failure tolerance/concurrency settings improve operational reliability but don't directly relate to security controls.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.md b/AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.md index 90dacc5b1..fb7370c5b 100644 --- a//AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.md +++ b//AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.md @@ -7 +7 @@ ConsiderationsCreate a stack set with service-managed permissions (console)Creat -With `service-managed` permissions, you can deploy stack instances to accounts managed by AWS Organizations in specific Regions. With this model, you don't need to create the necessary IAM roles; StackSets creates the IAM roles on your behalf. You can also enable automatic deployments to accounts that are added to a target organization or organizational unit (OU) in the future. With automatic deployments enabled, StackSets automatically deletes stack instances from an account if it's removed from a target organization or OU. For more information, see [Activate trusted access](./stacksets-orgs-activate-trusted-access.html). +With _service-managed_ permissions, you can deploy stacks to accounts managed by AWS Organizations in specific Regions. With this model, you don't need to create the necessary IAM roles; StackSets creates the IAM roles on your behalf. You can also enable automatic deployments to accounts that are added to a target organization or organizational unit (OU) in the future. With automatic deployments enabled, StackSets automatically deletes stacks from an account if it's removed from a target organization or OU. For more information, see [Activate trusted access](./stacksets-orgs-activate-trusted-access.html). @@ -24 +24 @@ Before you create a stack set with service-managed permissions, consider the fol - * Stack sets with service-managed permissions are created in the management account, including stack sets that are created by delegated administrators. + * StackSets with service-managed permissions are created in the management account, including StackSets that are created by delegated administrators. @@ -30 +30 @@ Before you create a stack set with service-managed permissions, consider the fol - * Multiple stack sets can target the same organization or OU. + * Multiple StackSets can target the same organization or OU. @@ -36 +36 @@ Before you create a stack set with service-managed permissions, consider the fol - * StackSets doesn't deploy stack instances to the organization's management account, even if the management account is in your organization or in an OU in your organization. + * StackSets doesn't deploy stacks to the organization's management account, even if the management account is in your organization or in an OU in your organization. @@ -75,3 +75 @@ If trusted access with AWS Organizations is disabled, a banner displays. Trusted -If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. - -You can't modify your stack set's execution configuration while there are running or queued operations for that stack set. +When operations are running or queued, StackSets queues all incoming operations even if they're non-conflicting. You can't change execution settings during this time. @@ -93 +91,5 @@ You can't modify your stack set's execution configuration while there are runnin -With **Retain stacks** selected, stack instances are removed from your stack set, but the stacks and their associated resources are retained. The resources stay in their current state, but will no longer be part of the stack set. +With **Retain stacks** selected, stacks are removed from your stack set, but the stacks and their associated resources are retained. The resources stay in their current state, but will no longer be part of the stack set. + + 15. Under **Specify regions** , choose the Regions you want to deploy stacks in. + + 16. For **Deployment options** , do the following: @@ -95 +97 @@ With **Retain stacks** selected, stack instances are removed from your stack set - 15. Under **Specify regions** , choose the Regions you want to deploy stack instances in. + * For **Maximum concurrent accounts** , specify how many accounts are processed concurrently. @@ -97 +99 @@ With **Retain stacks** selected, stack instances are removed from your stack set - 16. For **Deployment options** : + * For **Failure tolerance** , specify how many failures are acceptable before the operation stops. @@ -99 +101 @@ With **Retain stacks** selected, stack instances are removed from your stack set - * For **Maximum concurrent accounts** , configure the maximum concurrent accounts as needed. + * For **Region concurrency** , choose how to process Regions: **Sequential** (one Region at a time) or **Parallel** (multiple Regions concurrently). @@ -101 +103 @@ With **Retain stacks** selected, stack instances are removed from your stack set - * For **Failure tolerance** , configure the failure tolerance as needed. + * For **Concurrency mode** , choose how concurrency behaves during operation execution. @@ -103 +105 @@ With **Retain stacks** selected, stack instances are removed from your stack set - * For **Region concurrency** , choose the region concurrency as needed. + * **Strict failure tolerance** – Reduces concurrency level when failures occur, staying within **Failure tolerance** +1. @@ -105 +107 @@ With **Retain stacks** selected, stack instances are removed from your stack set - * For **Concurrency mode** , choose the concurrency mode as needed. + * **Soft failure tolerance** – Maintains your specified concurrency level (the value of **Maximum concurrent accounts**) regardless of failures. @@ -118 +120 @@ The **StackSet details** page opens. You can view the progress and status of the -When you create stack sets using the AWS CLI, you run two separate commands. During **create-stack-set** , you upload your template, create the stack set container, and manage automatic deployments. During **create-stack-instances** , you create stack instances in specific target accounts. +When you create StackSets using the AWS CLI, you run two separate commands. During **create-stack-set** , you upload your template, create the stack set container, and manage automatic deployments. During **create-stack-instances** , you create stacks in specific target accounts. @@ -120 +122 @@ When you create stack sets using the AWS CLI, you run two separate commands. Dur -When acting as a delegated administrator, you must set the `--call-as` option to `DELEGATED_ADMIN` each time you run a StackSets command. +When acting as a delegated administrator, you must set the `--call-as` option to `DELEGATED_ADMIN` each time you run a stack set command. @@ -125 +127 @@ When acting as a delegated administrator, you must set the `--call-as` option to -Stack sets created by a delegated administrator are created in the organization's management account. +StackSets created by a delegated administrator are created in the organization's management account. @@ -137,6 +138,0 @@ In the following example, we enable automatic deployments to allow StackSets to -###### Note - -If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. - -You can't modify your stack set's execution configuration while there are running or queued operations for that stack set. - @@ -147 +143 @@ You can't modify your stack set's execution configuration while there are runnin - * If you set the `--call-as` option to `DELEGATED_ADMIN` while signed in to your member account, **list-stack-sets** returns all stack sets with service-managed permissions in the organization's management account. + * If you set the `--call-as` option to `DELEGATED_ADMIN` while signed in to your member account, **list-stack-sets** returns all StackSets with service-managed permissions in the organization's management account. @@ -149 +145 @@ You can't modify your stack set's execution configuration while there are runnin - * If you set the `--call-as` option to `SELF` while signed in to your AWS account, **list-stack-sets** returns all self-managed stack sets in your AWS account. + * If you set the `--call-as` option to `SELF` while signed in to your AWS account, **list-stack-sets** returns all self-managed StackSets in your AWS account. @@ -151 +147 @@ You can't modify your stack set's execution configuration while there are runnin - * If you set the `--call-as` option to `SELF` while signed in to the organization's management account, **list-stack-sets** returns all stack sets in the organization's management account. + * If you set the `--call-as` option to `SELF` while signed in to the organization's management account, **list-stack-sets** returns all StackSets in the organization's management account. @@ -153 +149,3 @@ You can't modify your stack set's execution configuration while there are runnin - 3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stack instances to your stack set. For the `--deployment-targets` option, specify the organization root ID to deploy to all accounts in your organization, or specify OU IDs to deploy to all accounts in those OUs. In this example, we specify OUs with `ou-rcuk-1x5j1lwo` and `ou-rcuk-slr5lh0a` IDs. + 3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stacks to your stack set. For the `--deployment-targets` option, specify the organization root ID to deploy to all accounts in your organization, or specify OU IDs to deploy to all accounts in those OUs. In this example, we specify OUs with `ou-rcuk-1x5j1lwo` and `ou-rcuk-slr5lh0a` IDs. + +Set concurrent account processing and other deployment preferences using the `--operation-preferences` option. This example uses count-based settings. Note that `MaxConcurrentCount` must not exceed `FailureToleranceCount` \+ 1. For percentage-based settings, use `FailureTolerancePercentage` or `MaxConcurrentPercentage` instead. @@ -157,3 +155,2 @@ You can't modify your stack set's execution configuration while there are runnin - --regions '["us-west-2","us-east-1"]' - -###### Important + --regions us-west-2 us-east-1 \ + --operation-preferences MaxConcurrentCount=1,FailureToleranceCount=0 @@ -161 +158 @@ You can't modify your stack set's execution configuration while there are runnin -Wait until an operation is complete before starting another one. You can run only one operation at a time. +For more information, see [CreateStackInstances](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStackInstances.html) in the _AWS CloudFormation API Reference_. @@ -163 +160 @@ Wait until an operation is complete before starting another one. You can run onl - 4. Using the `operation-id` that was returned as part of the **create-stack-instances** output, use the following [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) command to verify that your stack instances were created successfully. + 4. Using the `operation-id` that was returned as part of the **create-stack-instances** output, use the following [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) command to verify that your stacks were created successfully.