AWS AWSCloudFormation documentation change
Summary
Updated documentation for CloudFormation package/deploy commands with clearer prerequisites, added details about .zip file creation from folders, MD5 checksum usage for artifact names, and deployment instructions for large templates
Security assessment
The change adds documentation about using MD5 checksums for artifact integrity verification and emphasizes S3 bucket requirements, which are security-adjacent best practices. However, there's no evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/using-cfn-cli-package.md b/AWSCloudFormation/latest/UserGuide/using-cfn-cli-package.md index 4b696fe69..3551c10e9 100644 --- a//AWSCloudFormation/latest/UserGuide/using-cfn-cli-package.md +++ b//AWSCloudFormation/latest/UserGuide/using-cfn-cli-package.md @@ -2,0 +3,2 @@ +PrerequisitesPackage and deploy a template with local artifacts + @@ -5 +7,16 @@ -For some resource properties that require an Amazon S3 location (a bucket name and file name), you can specify local references instead. For example, you might specify the S3 location of your AWS Lambda function's source code or an Amazon API Gateway REST API's OpenAPI (formerly Swagger) file. Instead of manually uploading the files to an S3 bucket and then adding the location to your template, you can specify local references, called local artifacts, in your template and then use the [package](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/package.html) CLI command to quickly upload them. A local artifact is a path to a file or folder that the **package** command uploads to Amazon S3. For example, an artifact can be a local path to your AWS Lambda function's source code or an Amazon API Gateway REST API's OpenAPI file. +You can use the AWS CLI to upload local artifacts that are referenced by a CloudFormation template to an Amazon S3 bucket. Local artifacts are files that you reference in your template. Instead of manually uploading files to an S3 bucket and then adding their locations to your template, you can specify local artifacts in your template and use the [package](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/package.html) command to upload them quickly. + +A local artifact is a path to a file or folder that the **package** command uploads to Amazon S3. For example, an artifact can be a local path to your AWS Lambda function's source code or an Amazon API Gateway REST API's OpenAPI file. + +When using the **package** command: + + * If you specify a file, the command directly uploads it to the S3 bucket. + + * If you specify a folder, the command creates a `.zip` file for the folder, and then uploads the `.zip` file. + + * If you don't specify a path, the command creates a `.zip` file for the working directory and uploads it. + + + + +You can specify an absolute or relative path, where the relative path is relative to your template's location. @@ -7 +24 @@ For some resource properties that require an Amazon S3 location (a bucket name a -If you specify a file, the command directly uploads it to the S3 bucket. After uploading the artifacts, the command returns a copy of your template, replacing references to local artifacts with the S3 location where the command uploaded the artifacts. Then, you can use the returned template to create or update a stack. +After uploading the artifacts, the command returns a copy of your template, replacing references to local artifacts with the S3 location where the command uploaded the artifacts. You can then use the returned template to create or update a stack. @@ -9 +26 @@ If you specify a file, the command directly uploads it to the S3 bucket. After u -If you specify a folder, the command creates a `.zip` file for the folder, and then uploads the `.zip` file. If you don't specify a path, the command creates a `.zip` file for the working directory, and uploads it. You can specify an absolute or relative path, where the relative path is relative to your template's location. +###### Note @@ -13 +30,7 @@ You can use local artifacts only for resource properties that the **package** co -The following template specifies the local artifact for a Lambda function's source code. The source code is stored in the user's `/home/user/code/lambdafunction` folder. +## Prerequisites + +Before you begin, you must have an existing Amazon S3 bucket. + +## Package and deploy a template with local artifacts + +The following template specifies the local artifact for a Lambda function's source code. The source code is stored in the `/home/user/code/lambdafunction` folder. @@ -33 +56 @@ The following template specifies the local artifact for a Lambda function's sour -The following **package** command creates a `.zip` file containing the function's source code folder, and then uploads the `.zip` file to the root folder of the ``amzn-s3-demo-bucket`` bucket. +The following [package](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/package.html) command creates and uploads a `.zip` file of the function's source code folder to the root of the specified bucket. @@ -35 +57,0 @@ The following **package** command creates a `.zip` file containing the function' -**`package` command** @@ -37,2 +59,2 @@ The following **package** command creates a `.zip` file containing the function' - - aws cloudformation package --s3-bucket amzn-s3-demo-bucket \ + aws cloudformation package \ + --s3-bucket amzn-s3-demo-bucket \ @@ -43 +65 @@ The following **package** command creates a `.zip` file containing the function' -The command saves the template that it generates to the path specified by the `--output-template-file` option. The command replaces the artifact with the Amazon S3 location, as shown in the following example: +The command generates a new template at the path specified by `--output-template-file`. It replaces the artifact reference with the Amazon S3 location, as shown below. The `.zip` file is named using the MD5 checksum of the folder contents, rather than using the folder name itself. @@ -57 +79 @@ The command saves the template that it generates to the path specified by the `- - "CodeUri": "s3://amzn-s3-demo-bucket/<md5 checksum>" + "CodeUri": "s3://amzn-s3-demo-bucket/md5 checksum" @@ -62,0 +85,15 @@ The command saves the template that it generates to the path specified by the `- +After you package your template’s artifacts, deploy the processed template using the [deploy](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/deploy/) command. + + + aws cloudformation deploy \ + --template-file packaged-template.json \ + --stack-name stack-name + +When deploying templates larger than 51,200 bytes, use the **deploy** command with the `--s3-bucket` option to upload your template to S3, as in the following example. + + + aws cloudformation deploy \ + --template-file packaged-template.json \ + --stack-name stack-name \ + --s3-bucket amzn-s3-demo-bucket +