AWS AWSCloudFormation documentation change
Summary
Added notes clarifying IAM role requirements for organizational deployments and updated ARN pattern to include AWS partition variations
Security assessment
The changes clarify usage requirements for IAM roles in specific deployment scenarios but do not address a security vulnerability or introduce new security features. The ARN pattern update expands valid formats without indicating a security fix.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-ssmquicksetup-configurationmanager-configurationdefinition.md b/AWSCloudFormation/latest/UserGuide/aws-properties-ssmquicksetup-configurationmanager-configurationdefinition.md index 4f1ce5736..edb351f17 100644 --- a//AWSCloudFormation/latest/UserGuide/aws-properties-ssmquicksetup-configurationmanager-configurationdefinition.md +++ b//AWSCloudFormation/latest/UserGuide/aws-properties-ssmquicksetup-configurationmanager-configurationdefinition.md @@ -55,0 +56,4 @@ The ARN of the IAM role used to administrate local configuration deployments. +###### Note + +Although this element is listed as "Required: No", a value can be omitted only for organizational deployments of types other than `AWSQuickSetupType-PatchPolicy`. A value must be provided when you are running an organizational deployment for a patch policy or running any type of deployment for a single account. + @@ -60 +64 @@ _Required_ : No - _Pattern_ : `^arn:aws:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@\-_/]+` + _Pattern_ : `arn:aws(-cn|-us-gov)?:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@\-_/]+.*` @@ -68,0 +73,4 @@ The name of the IAM role used to deploy local configurations. +###### Note + +Although this element is listed as "Required: No", a value can be omitted only for organizational deployments of types other than `AWSQuickSetupType-PatchPolicy`. A value must be provided when you are running an organizational deployment for a patch policy or running any type of deployment for a single account. +