AWS cdk documentation change
Summary
Formatting updates, command placeholder syntax standardization, and structural adjustments to improve documentation clarity. Changes include markdown header formatting, angle brackets for placeholders, typographical fixes, and table/list reorganizations.
Security assessment
The changes are primarily documentation formatting and syntax improvements (e.g., adding angle brackets to denote placeholders, markdown header styling). While the document contains security-related content (e.g., IAM roles, KMS permissions), the diff itself does not introduce new security fixes or vulnerabilities. The Security Hub findings section (KMS.2) only receives formatting updates, not substantive security changes. No concrete evidence of addressing a specific security vulnerability exists in the diff.
Diff
diff --git a/cdk/v2/guide/bootstrapping-env.md b/cdk/v2/guide/bootstrapping-env.md index c47d08db2..f99c2c407 100644 --- a//cdk/v2/guide/bootstrapping-env.md +++ b//cdk/v2/guide/bootstrapping-env.md @@ -24 +24 @@ You can use the AWS CDK Command Line Interface (AWS CDK CLI) or your preferred A -### Use the CDK CLI +**Use the CDK CLI** @@ -26 +26,2 @@ You can use the AWS CDK Command Line Interface (AWS CDK CLI) or your preferred A -You can use the CDK CLI `cdk bootstrap` command to bootstrap your environment. This is the method that we recommend if you don't require significant modifications to bootstrapping. + +You can use the CDK CLI `cdk bootstrap` command to bootstrap your environment. This is the method that we recommend if you don’t require significant modifications to bootstrapping. @@ -34 +35 @@ To bootstrap from any working directory, provide the environment to bootstrap as - $ cdk bootstrap aws://123456789012/us-east-1 + $ cdk bootstrap <aws://123456789012/us-east-1> @@ -38 +39 @@ To bootstrap from any working directory, provide the environment to bootstrap as -If you don't have your AWS account number, you can get it from the AWS Management Console. You can also use the following AWS CLI command to display your default account information, including your account number: +If you don’t have your AWS account number, you can get it from the AWS Management Console. You can also use the following AWS CLI command to display your default account information, including your account number: @@ -46 +47 @@ If you have named profiles in your AWS `config` and `credentials` files, use the - $ aws sts get-caller-identity --profile prod + $ aws sts get-caller-identity --profile <prod> @@ -52 +53 @@ To display the default Region, use the `aws configure get` command: - $ aws configure get region --profile prod + $ aws configure get region --profile <prod> @@ -57 +58 @@ When providing an argument, the `aws://` prefix is optional. The following is va - $ cdk bootstrap 123456789012/us-east-1 + $ cdk bootstrap <123456789012/us-east-1> @@ -62 +63 @@ To bootstrap multiple environments at the same time, provide multiple arguments: - $ cdk bootstrap aws://123456789012/us-east-1 aws://123456789012/us-east-2 + $ cdk bootstrap <aws://123456789012/us-east-1> <aws://123456789012/us-east-2> @@ -74 +75 @@ To bootstrap an environment that is specified in your `config` and `credentials` - $ cdk bootstrap --profile prod + $ cdk bootstrap --profile <prod> @@ -78 +79,2 @@ For more information on the `cdk bootstrap` command and supported options, see [ -### Use any AWS CloudFormation tool +**Use any AWS CloudFormation tool** + @@ -107 +109 @@ To deploy this template using the CDK CLI, you can run the following: - $ cdk bootstrap --template bootstrap-template.yaml + $ cdk bootstrap --template <bootstrap-template.yaml> @@ -117 +119 @@ macOS/Linux - --template-body file://path/to/bootstrap-template.yaml \ + --template-body file://<path/to/>bootstrap-template.yaml \ @@ -119 +121 @@ macOS/Linux - --region us-west-1 + --region <us-west-1> @@ -127 +129 @@ Windows - --template-body file://path/to/bootstrap-template.yaml ^ + --template-body file://<path/to/>bootstrap-template.yaml ^ @@ -129 +131 @@ Windows - --region us-west-1 + --region <us-west-1> @@ -135 +137 @@ For information on using CloudFormation StackSets to bootstrap multiple environm -You must bootstrap each AWS environment before you deploy into the environment. We recommend that you proactively bootstrap each environment that you plan to use. You can do this before you plan on actually deploying CDK apps into the environment. By proactively bootstrapping your environments, you prevent potential future issues such as Amazon S3 bucket name conflicts or deploying CDK apps into environments that haven't been bootstrapped. +You must bootstrap each AWS environment before you deploy into the environment. We recommend that you proactively bootstrap each environment that you plan to use. You can do this before you plan on actually deploying CDK apps into the environment. By proactively bootstrapping your environments, you prevent potential future issues such as Amazon S3 bucket name conflicts or deploying CDK apps into environments that haven’t been bootstrapped. @@ -148 +150,2 @@ If you attempt to deploy a CDK stack into an environment that hasn’t been boot -### Update your bootstrap stack +**Update your bootstrap stack** + @@ -154 +157,2 @@ Periodically, the CDK team will update the bootstrap template to a new version. -### IAM roles created during bootstrapping +**IAM roles created during bootstrapping** + @@ -200 +204,2 @@ This IAM role grants `readOnly` permission to look up [context values](./context -### Resource IDs created during bootstrapping +**Resource IDs created during bootstrapping** + @@ -202 +207 @@ This IAM role grants `readOnly` permission to look up [context values](./context -When you deploy the default bootstrap template, physical IDs for bootstrap resources are created using the following structure: `cdk-`qualifier`-`description`-`account-ID`-`Region``. +When you deploy the default bootstrap template, physical IDs for bootstrap resources are created using the following structure: `cdk-<qualifier>-<description>-<account-ID>-<Region>`. @@ -256 +261 @@ For more information on customizing bootstrapping, see [Customize AWS CDK bootst -If you are using CDK Pipelines to deploy into another account's environment, and you receive a message like the following: +If you are using CDK Pipelines to deploy into another account’s environment, and you receive a message like the following: @@ -263 +268,2 @@ This error message means that the appropriate IAM roles do not exist in the othe -### Protecting your bootstrap stack from deletion +**Protecting your bootstrap stack from deletion** + @@ -286 +292 @@ Template version | AWS CDK version | Changes -**4** | 1.61.0 | AWS KMS permissions are now implicit via Amazon S3 and no longer require `FileAsetKeyArn`. Add `CdkBootstrapVersion` SSM parameter so the bootstrap stack version can be verified without knowing the stack name. +**4** | 1.61.0 | AWS KMS permissions are now implicit via Amazon S3 and no longer require `FileAssetKeyArn`. Add `CdkBootstrapVersion` SSM parameter so the bootstrap stack version can be verified without knowing the stack name. @@ -295 +301 @@ Template version | AWS CDK version | Changes -**12** | 2.20.0 | Adds support for experimental **cdk import**. +**12** | 2.20.0 | Adds support for experimental `cdk import`. @@ -301 +307 @@ Template version | AWS CDK version | Changes -**18** | 2.80.0 | Reverted changes made for version 16 as they don't work in all partitions and are are not recommended. +**18** | 2.80.0 | Reverted changes made for version 16 as they don’t work in all partitions and are are not recommended. @@ -319 +325 @@ Feature | Legacy (v1 only) | Modern (v1 and v2) -**AWS CloudFormation Permissions** | Deploys using current user's permissions (determined by AWS profile, environment variables, etc.) | Deploys using the permissions specified when the bootstrap stack was provisioned (for example, by using `--trust`) +**AWS CloudFormation Permissions** | Deploys using current user’s permissions (determined by AWS profile, environment variables, etc.) | Deploys using the permissions specified when the bootstrap stack was provisioned (for example, by using `--trust`) @@ -321,5 +327,10 @@ Feature | Legacy (v1 only) | Modern (v1 and v2) -**Resources** * | Amazon S3 bucket | Amazon S3 bucket -AWS KMS key -IAM roles -Amazon ECR repository -SSM parameter for versioning +**Resources*** | Amazon S3 bucket | + + * Amazon S3 bucket + * AWS KMS key + * IAM roles + * Amazon ECR repository + * SSM parameter for versioning + + +**AWS KMS key** | IAM roles | Amazon ECR repository @@ -337 +351,2 @@ If you are using AWS Security Hub, you may see findings reported on some of the -### [KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys +**[KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys** + @@ -381 +396,2 @@ The following is a snippet of these two statements in the _deploy role_ from the -#### Why does Security Hub flag this? +**Why does Security Hub flag this?** + @@ -385 +401,2 @@ The policies contain a `Resource: *` combined with a `Condition` clause. Securit -#### Do I need to fix this finding? +**Do I need to fix this finding?** + @@ -389 +406,2 @@ As long as you have not modified the AWS KMS key on your bootstrap template to b -#### What if I want to fix this finding? +**What if I want to fix this finding?** + @@ -393 +411,2 @@ How you fix this finding depends on whether or not you will be using CDK Pipelin -###### To fix the Security Hub finding and use CDK Pipelines for cross-account deployments +**To fix the Security Hub finding and use CDK Pipelines for cross-account deployments** + @@ -409 +428,2 @@ How you fix this finding depends on whether or not you will be using CDK Pipelin - $ cdk bootstrap aws://account-id/region --template bootstrap-template.yaml + $ cdk bootstrap aws://<account-id>/<region> --template bootstrap-template.yaml + @@ -412,0 +433 @@ How you fix this finding depends on whether or not you will be using CDK Pipelin +**To fix the Security Hub finding if you’re not using CDK Pipelines for cross-account deployments** @@ -414 +434,0 @@ How you fix this finding depends on whether or not you will be using CDK Pipelin -###### To fix the Security Hub finding if you’re not using CDK Pipelines for cross-account deployments @@ -424 +444 @@ How you fix this finding depends on whether or not you will be using CDK Pipelin - $ cdk bootstrap aws://account-id/region --template bootstrap-template.yaml + $ cdk bootstrap aws://<account-id>/<region> --template bootstrap-template.yaml