AWS AWSCloudFormation documentation change
Summary
Updated terminology from 'stack instances' to 'stacks' in links, simplified operational constraints text, expanded deployment options documentation with concurrency modes, updated CLI examples with operation preferences, and clarified service-managed permissions requirements.
Security assessment
Changes focus on operational best practices, terminology consistency, and configuration constraints. No explicit security vulnerabilities, patches, or security feature additions are mentioned. The concurrency mode explanations and failure tolerance settings relate to reliability rather than security controls.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stacksets-update.md b/AWSCloudFormation/latest/UserGuide/stacksets-update.md index 7d9adfd10..66d99d4d6 100644 --- a//AWSCloudFormation/latest/UserGuide/stacksets-update.md +++ b//AWSCloudFormation/latest/UserGuide/stacksets-update.md @@ -9 +9 @@ You can update your stack set using either the CloudFormation console or the AWS -To add and remove accounts and Regions from a stack set, see [Add stacks to StackSets](./stackinstances-create.html) and [Delete stack instances from StackSets](./stackinstances-delete.html). To override parameter values for a stack instance, see [Override parameters on stack instances](./stackinstances-override.html). +To add and remove accounts and Regions from a stack set, see [Add stacks to StackSets](./stackinstances-create.html) and [Delete stacks from StackSets](./stackinstances-delete.html). To override parameter values for a stack, see [Override parameters on stacks](./stackinstances-override.html). @@ -50,3 +50 @@ To add and remove accounts and Regions from a stack set, see [Add stacks to Stac -If there are already running or queued operations, StackSets queues all incoming operations even if they are non-conflicting. - -You can't modify your stack set's execution configuration while there are running or queued operations for that stack set. +Remember, you can't change execution settings when operations are running or queued. @@ -72 +70,3 @@ CloudFormation will deploy stack updates in the specified accounts within the fi - 3. For **Deployment options** : + 3. For **Deployment options** , do the following: + + * For **Maximum concurrent accounts** , specify how many accounts are processed concurrently. @@ -74 +74 @@ CloudFormation will deploy stack updates in the specified accounts within the fi - * For **Maximum concurrent accounts** , modify the maximum concurrent accounts as needed. + * For **Failure tolerance** , specify how many failures are acceptable before the operation stops. @@ -76 +76 @@ CloudFormation will deploy stack updates in the specified accounts within the fi - * For **Failure tolerance** , modify the failure tolerance as needed. + * For **Region concurrency** , choose how to process Regions: **Sequential** (one Region at a time) or **Parallel** (multiple Regions concurrently). @@ -78 +78 @@ CloudFormation will deploy stack updates in the specified accounts within the fi - * For **Region concurrency** , modify the region concurrency as needed. + * For **Concurrency mode** , choose how concurrency behaves during operation execution. @@ -80 +80,3 @@ CloudFormation will deploy stack updates in the specified accounts within the fi - * For **Concurrency mode** , modify the concurrency mode as needed. + * **Strict failure tolerance** – Reduces concurrency level when failures occur, staying within **Failure tolerance** +1. + + * **Soft failure tolerance** – Maintains your specified concurrency level (the value of **Maximum concurrent accounts**) regardless of failures. @@ -95 +97 @@ CloudFormation starts applying your updates to your stack set, and displays the -When acting as a delegated administrator, you must set the `--call-as` option to `DELEGATED_ADMIN` each time you run a StackSets command. +When acting as a delegated administrator, you must set the `--call-as` option to `DELEGATED_ADMIN` each time you run a stack set command. @@ -102 +104,3 @@ When acting as a delegated administrator, you must set the `--call-as` option to -In the following example command, we are updating the stack set by using `--parameters`. Specifically, we change the default snapshot delivery frequency for delivery channel configuration from `TwentyFour_Hours` to `Twelve_Hours`. Because we are still using the current template, we add the `--use-previous-template` option. +In the following examples, we're updating the stack set by using `--parameters` option. Specifically, we change the default snapshot delivery frequency for delivery channel configuration from `TwentyFour_Hours` to `Twelve_Hours`. Because we're still using the current template, we add the `--use-previous-template` option. + +Set concurrent account processing and other deployment preferences using the `--operation-preferences` option. These examples use count-based settings. Note that `MaxConcurrentCount` must not exceed `FailureToleranceCount` \+ 1. For percentage-based settings, use `FailureTolerancePercentage` or `MaxConcurrentPercentage` instead. @@ -109,2 +113,3 @@ In the following example command, we are updating the stack set by using `--para - --accounts '["account_ID_1","account_ID_2"]' \ - --regions '["us-west-2","us-east-1"]' + --accounts account_ID_1 account_ID_2 \ + --regions us-west-2 us-east-1 \ + --operation-preferences MaxConcurrentCount=1,FailureToleranceCount=0 @@ -112 +117 @@ In the following example command, we are updating the stack set by using `--para -[Service-managed permissions] For the `--deployment-targets` option, provide the organization (root) ID, OU IDs, or AWS Organizations account IDs you want your update to target. +[Service-managed permissions] For the `--deployment-targets` option, provide the organization root ID or organizational unit (OU) IDs you want your update to target. @@ -118,7 +123,2 @@ In the following example command, we are updating the stack set by using `--para - --regions '["us-west-2","us-east-1"]' - -To specify your preferences for how CloudFormation performs this stack set operation, specify the `--operation-preferences` option, as in the following example. For the purposes of this example, we're using count, not percentage. To apply percentages instead, use `FailureTolerancePercentage` or `MaxConcurrentPercentage`. - - --operation-preferences FailureToleranceCount=0,MaxConcurrentCount=1 - -###### Note + --regions us-west-2 us-east-1 \ + --operation-preferences MaxConcurrentCount=1,FailureToleranceCount=0 @@ -126 +126 @@ To specify your preferences for how CloudFormation performs this stack set opera -The value of `MaxConcurrentCount` is dependent on the value of `FailureToleranceCount`. `MaxConcurrentCount` is at most one more than `FailureToleranceCount`. +For more information, see [UpdateStackSet](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateStackSet.html) in the _AWS CloudFormation API Reference_.