AWS AWSCloudFormation documentation change
Summary
Restructured documentation with updated terminology ('stacks' instead of 'stack instances'), added 'Considerations' section, and clarified automatic deployment behavior regarding account-level targets
Security assessment
Changes focus on terminology updates and operational guidance rather than addressing specific security vulnerabilities. The added consideration about automatic deployments continuing to use account-level filters warns about potential unintended deployments, but this is presented as a configuration consideration rather than a security fix.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.md b/AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.md index 3bac02ce1..7d96645ee 100644 --- a//AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.md +++ b//AWSCloudFormation/latest/UserGuide/stacksets-orgs-manage-auto-deployment.md @@ -3,14 +3 @@ -How automatic deployments workManage automatic deployments (console)Manage automatic deployments (AWS CLI) - -# Manage automatic deployments for CloudFormation StackSets that use service-managed permissions - -StackSets can automatically deploy additional stack instances to new AWS Organizations accounts when they're added to your target organization or organizational units (OUs). You can enable automatic deployments and choose whether to delete or retain stacks and their associated resources when accounts are removed from target OUs. These settings can be modified anytime. - -###### Topics - - * How automatic deployments work - - * Manage automatic deployments (console) - - * Manage automatic deployments (AWS CLI) - +How automatic deployments workConsiderationsEnable or disable automatic deployments (console)Enable or disable automatic deployments (AWS CLI) @@ -17,0 +5 @@ StackSets can automatically deploy additional stack instances to new AWS Organiz +# Enable or disable automatic deployments for StackSets in AWS Organizations @@ -18,0 +7 @@ StackSets can automatically deploy additional stack instances to new AWS Organiz +StackSets can automatically deploy additional stacks to new AWS Organizations accounts when they're added to your target organization or organizational units (OUs). You can enable automatic deployments and choose whether to delete or retain stacks and their associated resources when accounts are removed from target OUs. These settings can be modified anytime for StackSets that use service-managed permissions. @@ -26 +15 @@ For example, consider `StackSet1` that targets `OU1` in the `us-east-1` Region a -If we move `AccountA` from `OU1` to `OU2` with automatic deployments enabled, StackSets automatically runs a delete operation to remove the `StackSet1` instance from `AccountA` and queues a create operation that adds the `StackSet2` instance to `AccountA`. +If we move `AccountA` from `OU1` to `OU2` with automatic deployments enabled, StackSets automatically runs a delete operation to remove the `StackSet1` stack from `AccountA` and queues a create operation that adds the `StackSet2` stack to `AccountA`. @@ -28 +17 @@ If we move `AccountA` from `OU1` to `OU2` with automatic deployments enabled, St -###### Note +## Considerations @@ -30 +19 @@ If we move `AccountA` from `OU1` to `OU2` with automatic deployments enabled, St -Be aware of the following when setting up automatic deployments: +The following are considerations when using automatic deployments: @@ -36,5 +25 @@ Be aware of the following when setting up automatic deployments: - * When account level targets are used with an automatic deployment, StackSets will continue to use the account level filter defined in the last deployment, and continue to deploy to new accounts added to the deployed Organizations. - -If you want to prevent this, choose **Deactivated** for **Automatic deployment** in the console, or set `--auto-deployment Enabled=` to `false` in the CLI. - -For more information on account level targets, see [Account level targets for service-managed StackSets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/account-level-targets.html). + * If you use account level targets and enable automatic deployments, StackSets will continue to use the account level filter defined in the last deployment while also deploying to newly added accounts within the deployed organization. To prevent deployments to newly added accounts, disable automatic deployments. For more information about using account level targets, see [Account level targets for service-managed StackSets](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/account-level-targets.html). @@ -45 +30 @@ For more information on account level targets, see [Account level targets for se -## Manage automatic deployments (console) +## Enable or disable automatic deployments (console) @@ -68 +53 @@ For more information on account level targets, see [Account level targets for se -## Manage automatic deployments (AWS CLI) +## Enable or disable automatic deployments (AWS CLI) @@ -82 +67 @@ Alternatively, to disable automatic deployments, specify `Enabled=false` as the - 2. Using the operation ID that was returned as part of the **update-stack-set** output in step 2, run [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) to verify that your stack set was updated successfully. + 2. Using the operation ID that was returned as part of the **update-stack-set** output, run [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) to verify that your stack set was updated successfully. @@ -95 +80 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Override parameters on stack instances +Override parameters on stacks @@ -97 +82 @@ Override parameters on stack instances -Delete stack instances from StackSets +Delete stacks from StackSets