AWS cdk documentation change
Summary
Updated documentation formatting, added termination protection instructions, and adjusted command placeholders. Removed redundant topic list and fixed typographical errors.
Security assessment
The change adds a section titled 'To enable termination protection' with AWS CLI commands to enable CloudFormation stack termination protection. Termination protection prevents accidental deletion of critical infrastructure, which is a security best practice. However, there is no evidence this addresses a specific security vulnerability or incident.
Diff
diff --git a/cdk/v2/guide/bootstrapping-customizing.md b/cdk/v2/guide/bootstrapping-customizing.md index 3fddb94de..c78ca14ee 100644 --- a//cdk/v2/guide/bootstrapping-customizing.md +++ b//cdk/v2/guide/bootstrapping-customizing.md @@ -5 +5 @@ -Use the CDK CLI to customize bootstrappingModify the default bootstrap templateThe bootstrap contract +Use the CDK CLI to customize bootstrappingModify the default bootstrap templateFollow the bootstrap contract @@ -15,11 +14,0 @@ For an introduction to bootstrapping, see [AWS CDK bootstrapping](./bootstrappin -###### Topics - - * Use the CDK CLI to customize bootstrapping - - * Modify the default bootstrap template - - * Follow the bootstrap contract - - - - @@ -98 +87 @@ Use the `--trust-for-lookup` option to specify AWS accounts that are allowed to -If a bootstrap stack is deleted, the AWS resources that were originally provisioned in the environment will also be deleted. After your environment is bootstrapped, we recommend that you don't delete and recreate the environment’s bootstrap stack, unless you are intentionally doing so. Instead, try to update the bootstrap stack to a new version by running the `cdk bootstrap` command again. +If a bootstrap stack is deleted, the AWS resources that were originally provisioned in the environment will also be deleted. After your environment is bootstrapped, we recommend that you don’t delete and recreate the environment’s bootstrap stack, unless you are intentionally doing so. Instead, try to update the bootstrap stack to a new version by running the `cdk bootstrap` command again. @@ -104 +93,2 @@ After enabling termination protection, you can use the AWS CLI or AWS CloudForma -###### To enable termination protection +**To enable termination protection** + @@ -112 +102 @@ After enabling termination protection, you can use the AWS CLI or AWS CloudForma - $ aws cloudformation describe-stacks --stack-name CDKToolkit --query "Stacks[0].EnableTerminationProtection" + $ aws cloudformation describe-stacks --stack-name <CDKToolkit> --query "Stacks[0].EnableTerminationProtection" @@ -122 +112,2 @@ When you need more customization than the CDK CLI can provide, you can modify th -###### To modify and deploy the default bootstrap template +**To modify and deploy the default bootstrap template** + @@ -126 +117 @@ When you need more customization than the CDK CLI can provide, you can modify th - $ cdk bootstrap --show-template > my-bootstrap-template.yaml + $ cdk bootstrap --show-template > <my-bootstrap-template.yaml> @@ -134 +125 @@ To ensure that your customizations are not accidentally overwritten later by som - $ cdk bootstrap --template my-bootstrap-template.yaml + $ cdk bootstrap --template <my-bootstrap-template.yaml> @@ -141 +132 @@ To ensure that your customizations are not accidentally overwritten later by som -For your CDK apps to properly deploy, the CloudFormation templates produced during synthesis must correctly specify the resources created during bootstrapping. These resources are commonly referred to as _bootstrap resources_. Bootstrapping creates resources in your AWS environment that are used by the AWS CDK to perform deployments and manage application assets. Synthesis produces CloudFormation templates from each CDK stack in your application. These templates don't just define the AWS resources that will be provisioned from your application. They also specify the bootstrap resources to use during deployment. +For your CDK apps to properly deploy, the CloudFormation templates produced during synthesis must correctly specify the resources created during bootstrapping. These resources are commonly referred to as _bootstrap resources_. Bootstrapping creates resources in your AWS environment that are used by the AWS CDK to perform deployments and manage application assets. Synthesis produces CloudFormation templates from each CDK stack in your application. These templates don’t just define the AWS resources that will be provisioned from your application. They also specify the bootstrap resources to use during deployment. @@ -143 +134 @@ For your CDK apps to properly deploy, the CloudFormation templates produced duri -During synthesis, the CDK CLI doesn't know specifically how your AWS environment has been bootstrapped. Instead, the CDK CLI produces CloudFormation templates based on the synthesizer that you configure. Therefore, when you customize bootstrapping, you may need to customize synthesis. For instructions on customizing synthesis, see [Customize CDK stack synthesis](./configure-synth.html#bootstrapping-custom-synth). The purpose is to ensure that your synthesized CloudFormation templates are compatible with your bootstrapped environment. This compatibility is referred to as the _bootstrap contract_. +During synthesis, the CDK CLI doesn’t know specifically how your AWS environment has been bootstrapped. Instead, the CDK CLI produces CloudFormation templates based on the synthesizer that you configure. Therefore, when you customize bootstrapping, you may need to customize synthesis. For instructions on customizing synthesis, see [Customize CDK stack synthesis](./configure-synth.html#bootstrapping-custom-synth). The purpose is to ensure that your synthesized CloudFormation templates are compatible with your bootstrapped environment. This compatibility is referred to as the _bootstrap contract_. @@ -151 +142 @@ When you customize bootstrapping, follow the bootstrap template contract to rema -The bootstrap template should contain a resource to create an Amazon EC2 Systems Manager (SSM) parameter with a well-known name and an output to reflect the template's version: +The bootstrap template should contain a resource to create an Amazon EC2 Systems Manager (SSM) parameter with a well-known name and an output to reflect the template’s version: @@ -175 +166 @@ The `DefaultStackSynthesizer` requires five IAM roles for five different purpose - * The _file publishing role_ and the _image publishing role_ are assumed by the CDK CLI and by AWS CodeBuild projects to publish assets into an environment. They're used to write to the Amazon S3 bucket and the Amazon ECR repository, respectively. These roles require write access to these resources. + * The _file publishing role_ and the _image publishing role_ are assumed by the CDK CLI and by AWS CodeBuild projects to publish assets into an environment. They’re used to write to the Amazon S3 bucket and the Amazon ECR repository, respectively. These roles require write access to these resources.