AWS AWSCloudFormation medium security documentation change
Summary
Updated AWS::Oam::Link with LinkConfiguration to restrict shared metric/log data.
Security assessment
Limiting shared data to specific namespaces/log groups reduces exposure risks, addressing potential over-permission issues. This directly documents a security control mechanism.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/ReleaseHistory.md b/AWSCloudFormation/latest/UserGuide/ReleaseHistory.md index 2f583910f..e1eec095e 100644 --- a//AWSCloudFormation/latest/UserGuide/ReleaseHistory.md +++ b//AWSCloudFormation/latest/UserGuide/ReleaseHistory.md @@ -11,5 +10,0 @@ Change| Description| Date -[Updated resource](./aws-template-resource-type-ref.html#AWS_CloudTrail)| The following structure was added: AWS::CloudTrail::EventDataStore ContextKeySelector - -[AWS::CloudTrail::EventDataStore ContextKeySelector](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudtrail-eventdatastore-contextkeyselector.html) - A structure that defines criteria for filtering events based on specific context key values in the event record. -| May 19, 2025 @@ -50,0 +46,5 @@ Change| Description| Date +[Updated resource](./aws-template-resource-type-ref.html#AWS_Kinesis)| The following resource was updated: AWS::Kinesis::StreamConsumer + +[AWS::Kinesis::StreamConsumer](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kinesis-streamconsumer.html) + Use the `Tag` property to specify up to 50 tag key-value pairs for your Kinesis resources. +| April 29, 2025 @@ -86 +86,4 @@ Change| Description| Date -[Updated resource](./aws-template-resource-type-ref.html#AWS_Kinesis)| The following resource was updated: AWS::Kinesis::StreamConsumer +[Updated resource](./aws-template-resource-type-ref.html#AWS_Batch)| The following resources were added or updated: `AWS::Batch::JobDefinition FirelensConfiguration` and `AWS::Batch::JobDefinition TaskContainerProperties`.The following resources were added or updated: + + * [`AWS::Batch::JobDefinition FirelensConfiguration`. ](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-batch-consumableresource.html) Configure Firelens logging. + * [ AWS::Batch::JobDefinition TaskContainerProperties](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-batch-jobdefinition-consumableresourceproperties.html) Configure Firelens logging for a container. @@ -88,2 +90,0 @@ Change| Description| Date -[AWS::Kinesis::StreamConsumer](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-kinesis-streamconsumer.html) - Use the `Tag` property to specify up to 50 tag key-value pairs for your Kinesis resources. @@ -90,0 +92,9 @@ Change| Description| Date +[New resources](./aws-template-resource-type-ref.html#AWS_MemoryDB)| The following resources were added for the IPv6 update: AWS::MemoryDB::Cluster and AWS::MemoryDB::SubnetGroup.SupportedNetworkTypes. + +[AWS::MemoryDB::SubnetGroup.SupportedNetworkTypes](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-memorydb-subnetgroup.html) + Use the `SupportedNetworkTypes` resource to list network types for the subnet group. +[AWS::MemoryDB::Cluster.IpDiscovery](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-memorydb-cluster.html#cfn-memorydb-cluster-ipdiscovery) + Use the `IpDiscovery` resource to discover IP addresses for the cluster. +[AWS::MemoryDB::Cluster.NetworkType](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-memorydb-cluster.html#cfn-memorydb-cluster-networktype) + Use the `NetworkType` to choose the IP address type for the cluster. +| April 10, 2025 @@ -146,0 +157,7 @@ IaC generator supports partial scanning| You can now choose specific resource ty +[Updated resource](./aws-template-resource-type-ref.html#AWS_Batch)| The following resources were added or updated: `AWS::Batch::ConsumableResource` and `AWS::Batch:JobDefinition`.The following resources were added or updated: + + * [`AWS::Batch::ConsumableResource`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-batch-consumableresource.html) + * [ AWS::Batch::JobDefinition ConsumableResourceProperties](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-batch-jobdefinition-consumableresourceproperties.html) Contains a list of consumable resources required by a job. + * [ AWS::Batch::JobDefinition ConsumableResourceRequirement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-batch-jobdefinition-consumableresourcerequirement.html) Information about a consumable resource required to run a job. + +| February 27, 2025 @@ -171,0 +189 @@ IaC generator supports partial scanning| You can now choose specific resource ty +[Rebrand update](./aws-template-resource-type-ref.html#AWS_Chatbot)| AWS Chatbot is now Amazon Q Developer. Mentions of the name AWS Chatbot still appear in this guide.[Learn more](https://docs.aws.amazon.com/chatbot/latest/adminguide/service-rename.html)| February 17, 2025 @@ -211,0 +230,5 @@ IaC generator supports partial scanning| You can now choose specific resource ty +[Updated resource](./aws-template-resource-type-ref.html#AWS_QBusiness)| The following resource was updated: `AWS::QBusiness::WebExperience`. + +[AWS::QBusiness::WebExperience](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-webexperience.html) + Use the `BrowserExtensionConfiguration` property to configure the browser extension for your Amazon Q Business application environment. +| January 28, 2025 @@ -337,2 +360,2 @@ AWS::NotificationsContacts::EmailContact -[ AWS::QBusiness::DataAccessor](https://docs.aws.amazon.com/AWSCloudFormation/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-dataaccessor.html) - Use the `AWS::QBusiness::DataAccessor` resource to create an Amazon Q Business data accessor. For more information, see [Data Accessors](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/data-accessors.html.html). +[ AWS::QBusiness::DataAccessor](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-qbusiness-dataaccessor.html) + Use the `AWS::QBusiness::DataAccessor` resource to create an Amazon Q Business data accessor. For more information, see [Data Accessors](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/data-accessors.html). @@ -431,0 +455,9 @@ AWS::NotificationsContacts::EmailContact +[New resource added and properties updated](./aws-template-resource-type-ref.html#AWS_Chatbot)| The following resource and properties were updated: AWS::Chatbot::CustomAction AWS::Chatbot::SlackChannelConfiguration AWS::Chatbot::MicrosoftTeamsChannelConfiguration + +[AWS::Chatbot::CustomAction](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-chatbot-customaction.html) + Use the `AWS::Chatbot::CustomAction` resource to configure a custom action with Amazon Q Developer. +[AWS::Chatbot::SlackChannelConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-chatbot-slackchannelconfiguration.html) + Use the `CustomizationResourceArns` property to link a of list resource ARNs (for example, custom actions) with a Slack channel configuration for Amazon Q Developer. +[AWS::Chatbot::MicrosoftTeamsChannelConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-chatbot-microsoftteamschannelconfiguration.html.html) + Use the `CustomizationResourceArns` property to link a list resource ARNs (for example, custom actions) with a Microsoft Teams channel configuration for Amazon Q Developer. +| November 22, 2024 @@ -436,0 +469,5 @@ AWS::NotificationsContacts::EmailContact +[New resource](./aws-template-resource-type-ref.html#AWS_ResourceGroups)| The following resource was added: AWS::ResourceGroups::TagSyncTask + +[AWS::ResourceGroups::TagSyncTask](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-resourcegroups-group.html) + Use the `AWS::ResourceGroups::TagSyncTask` resource to onboard and sync resources tagged with a specific tag key-value pair to an application. +| November 22, 2024 @@ -991,0 +1029,5 @@ AWS CloudTrail event stack operation root causes| AWS CloudFormation improves th +[Updated resource](./aws-template-resource-type-ref.html#AWS_Oam)| The following resources was updated: AWS::Oam::Link. + +[AWS::Oam::Link](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-oam-link.html) + The `AWS::Oam::Link` resource was updated with a `LinkConfiguration` structure. You can use this structure to specify that only a subset of metric namespaces or log groups are to be shared with the monitoring account. +| April 26, 2024 @@ -1949,0 +1992,5 @@ AWS CloudTrail event stack operation root causes| AWS CloudFormation improves th +[Updated resource](./aws-template-resource-type-ref.html#AWS_NetworkManager)| AWS::NetworkManager::ConnectPeer was updated. + +[AWS::NetworkManager::ConnectPeer](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkmanager-connectpeer.html) + Use the `SubnetArn` property to specify the subnet ARN of a Connect peer. +| August 23, 2023 @@ -4250,4 +4297,4 @@ CloudFormation registry| AWS CloudFormation announces the general availability o -[AWS::Chatbot::SlackChannelConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Chatbot.html) - Use the `GuardrailPolicies` property to list policy ARNs applied as channel guardrails for Amazon Q Developer in chat applications. -[AWS::Chatbot::SlackChannelConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Chatbot.html) - Use the `UserRoleRequired` property to enable the use of a user role requirement in Amazon Q Developer in chat applications configurations. +[AWS::Chatbot::SlackChannelConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-chatbot-slackchannelconfiguration.html) + Use the `GuardrailPolicies` property to list policy ARNs applied as channel guardrails for Amazon Q Developer. +[AWS::Chatbot::SlackChannelConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-chatbot-slackchannelconfiguration.html) + Use the `UserRoleRequired` property to enable the use of a user role requirement in Amazon Q Developer configurations. @@ -5008 +5055 @@ Publish public third-party extensions| Use public extensions provided by third-p - You can use the ZeppelinApplicationConfiguration property to create Studio notebook applications that use Apache Zeppelin. You can use the notebook interactively, and you can deploy it as a continuously running streaming application with durable state and autoscaling features. + You can use the ZeppelinApplicationConfiguration property to create Studio notebook applications that use Apache Zeppelin. You can use the notebook interactively, and you can deploy it as a continuously running streaming application with durable state and auto-scaling features. @@ -7051,2 +7098,2 @@ AWS CloudFormation StackSets Region availability| AWS CloudFormation StackSets i -[AWS::Chatbot::SlackChannelConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/AWS_Chatbot.html) - Use the `AWS::Chatbot::SlackChannelConfiguration` resource to configure a Slack channel with Amazon Q Developer in chat applications. +[AWS::Chatbot::SlackChannelConfiguration](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-chatbot-slackchannelconfiguration.html) + Use the `AWS::Chatbot::SlackChannelConfiguration` resource to configure a Slack channel with Amazon Q Developer.