AWS Security ChangesHomeSearch

AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2025-05-19 · Documentation low

File: AWSCloudFormation/latest/UserGuide/aws-properties-ssmquicksetup-configurationmanager-configurationdefinition.md

Summary

Added notes clarifying IAM role requirements for organizational deployments and updated ARN pattern to include AWS partition variations

Security assessment

The changes clarify usage requirements for IAM roles in specific deployment scenarios but do not address a security vulnerability or introduce new security features. The ARN pattern update expands valid formats without indicating a security fix.

Diff

diff --git a/AWSCloudFormation/latest/UserGuide/aws-properties-ssmquicksetup-configurationmanager-configurationdefinition.md b/AWSCloudFormation/latest/UserGuide/aws-properties-ssmquicksetup-configurationmanager-configurationdefinition.md
index 4f1ce5736..edb351f17 100644
--- a//AWSCloudFormation/latest/UserGuide/aws-properties-ssmquicksetup-configurationmanager-configurationdefinition.md
+++ b//AWSCloudFormation/latest/UserGuide/aws-properties-ssmquicksetup-configurationmanager-configurationdefinition.md
@@ -55,0 +56,4 @@ The ARN of the IAM role used to administrate local configuration deployments.
+###### Note
+
+Although this element is listed as "Required: No", a value can be omitted only for organizational deployments of types other than `AWSQuickSetupType-PatchPolicy`. A value must be provided when you are running an organizational deployment for a patch policy or running any type of deployment for a single account.
+
@@ -60 +64 @@ _Required_ : No
- _Pattern_ : `^arn:aws:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@\-_/]+`
+ _Pattern_ : `arn:aws(-cn|-us-gov)?:iam::\d{12}:role/?[a-zA-Z_0-9+=,.@\-_/]+.*`
@@ -68,0 +73,4 @@ The name of the IAM role used to deploy local configurations.
+###### Note
+
+Although this element is listed as "Required: No", a value can be omitted only for organizational deployments of types other than `AWSQuickSetupType-PatchPolicy`. A value must be provided when you are running an organizational deployment for a patch policy or running any type of deployment for a single account.
+