AWS AWSCloudFormation medium security documentation change

Service: AWSCloudFormation · 2025-05-22 · Security-related medium

File: AWSCloudFormation/latest/UserGuide/aws-resource-datazone-environmentblueprintconfiguration.md

Summary

Added EnvironmentRolePermissionBoundary property with IAM policy ARN pattern validation and ProvisioningConfigurations array. Changed parameter reference from RegionalParameter to LakeFormationConfiguration.

Security assessment

The EnvironmentRolePermissionBoundary addition enforces IAM permission boundaries through ARN pattern validation (^arn:aws[^:]*:iam::(aws|\d{12}):policy/[\w+=,.@-]*$), which is a security control mechanism to limit privilege escalation risks. This directly relates to security configuration enforcement.

Diff

diff --git a/AWSCloudFormation/latest/UserGuide/aws-resource-datazone-environmentblueprintconfiguration.md b/AWSCloudFormation/latest/UserGuide/aws-resource-datazone-environmentblueprintconfiguration.md
index 4c3d3fc3e..c43571ae1 100644
--- a//AWSCloudFormation/latest/UserGuide/aws-resource-datazone-environmentblueprintconfiguration.md
+++ b//AWSCloudFormation/latest/UserGuide/aws-resource-datazone-environmentblueprintconfiguration.md
@@ -21,0 +22 @@ To declare this entity in your AWS CloudFormation template, use the following sy
+          "EnvironmentRolePermissionBoundary" : String,
@@ -22,0 +24 @@ To declare this entity in your AWS CloudFormation template, use the following sy
+          "ProvisioningConfigurations" : [ [ProvisioningConfiguration](./aws-properties-datazone-environmentblueprintconfiguration-provisioningconfiguration.html), ... ],
@@ -37,0 +40 @@ To declare this entity in your AWS CloudFormation template, use the following sy
+      EnvironmentRolePermissionBoundary: String
@@ -38,0 +42,2 @@ To declare this entity in your AWS CloudFormation template, use the following sy
+      ProvisioningConfigurations: 
+        - [ProvisioningConfiguration](./aws-properties-datazone-environmentblueprintconfiguration-provisioningconfiguration.html)
@@ -88,0 +94,13 @@ _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/
+`EnvironmentRolePermissionBoundary`
+    
+
+The environment role permission boundary.
+
+_Required_ : No
+
+ _Type_ : String
+
+ _Pattern_ : `^arn:aws[^:]*:iam::(aws|\d{12}):policy/[\w+=,.@-]*$`
+
+_Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+
@@ -101,0 +120,11 @@ _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormat
+`ProvisioningConfigurations`
+    
+
+The provisioning configuration of a blueprint.
+
+_Required_ : No
+
+ _Type_ : Array of [ProvisioningConfiguration](./aws-properties-datazone-environmentblueprintconfiguration-provisioningconfiguration.html)
+
+ _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+
@@ -170 +199 @@ AwsConsoleLinkParameters
-RegionalParameter
+LakeFormationConfiguration