AWS AWSCloudFormation medium security documentation change
Summary
Restructured documentation with added sections about AMIs, helper scripts, and updated troubleshooting guidance. Updated references from EC2Config to EC2Launch v2.
Security assessment
The change explicitly requires EC2Launch v2 configuration for proper instance initialization, replacing the deprecated EC2Config service. This addresses potential security risks from using outdated bootstrapping mechanisms, though no specific CVE is mentioned. The agent update likely includes security improvements and proper configuration enforcement.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/cfn-windows-stacks-bootstrapping.md b/AWSCloudFormation/latest/UserGuide/cfn-windows-stacks-bootstrapping.md index 9dcbfd38c..d39745444 100644 --- a//AWSCloudFormation/latest/UserGuide/cfn-windows-stacks-bootstrapping.md +++ b//AWSCloudFormation/latest/UserGuide/cfn-windows-stacks-bootstrapping.md @@ -3 +3 @@ -Example of bootstrapping a Windows stackHow to manage Windows servicesHow to troubleshoot stack creation issues +Available Amazon Machine Images (AMIs)Available helper scriptsExample of bootstrapping a Windows stackManage Windows servicesTroubleshoot stack creation issues @@ -5 +5 @@ Example of bootstrapping a Windows stackHow to manage Windows servicesHow to tro -# Bootstrapping AWS CloudFormation Windows stacks +# Bootstrapping Windows-based CloudFormation stacks @@ -7 +7 @@ Example of bootstrapping a Windows stackHow to manage Windows servicesHow to tro -This topic describes how to bootstrap a Windows stack and troubleshoot stack creation issues. If you will be creating your own Windows image for use with CloudFormation, see the information at [Use the EC2Config service to perform tasks during EC2 legacy Windows operating system instance launch](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2config-service.html) in the _Amazon EC2 User Guide_ for instructions. You must set up a Windows instance with EC2Config service for it to work with the AWS CloudFormation bootstrapping tools. +This topic describes how to bootstrap a Windows stack and troubleshoot stack creation issues. @@ -9 +9,15 @@ This topic describes how to bootstrap a Windows stack and troubleshoot stack cre -## Example of bootstrapping a Windows stack +## Available Amazon Machine Images (AMIs) + +For information about available AWS Windows AMIs, see the [AWS Windows AMI Reference](https://docs.aws.amazon.com/ec2/latest/windows-ami-reference/windows-amis.html). + +###### Important + +If you are creating your own Windows AMI for use with CloudFormation, make sure that EC2Launch v2 is properly configured. EC2Launch v2 is required for CloudFormation bootstrapping tools to properly initialize and configure Windows instances during stack creation. For more information, see [Use the EC2Launch v2 agent to perform tasks during EC2 Windows instance launch](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2launch-v2.html) in the _Amazon EC2 User Guide_. + +## Available helper scripts + +CloudFormation provides the following Python helper scripts that you can use to install software and start services on an Amazon EC2 instance that you create as part of your stack: + + * `cfn-init` – Use to retrieve and interpret resource metadata, install packages, create files, and start services. + + * `cfn-signal` – Use to signal with a `CreationPolicy` or `WaitCondition`, so you can synchronize other resources in the stack when the prerequisite resource or application is ready. @@ -11 +25,12 @@ This topic describes how to bootstrap a Windows stack and troubleshoot stack cre -For the purposes of illustration, we'll examine a AWS CloudFormation single-instance SharePoint server template. + * `cfn-get-metadata` – Use to retrieve metadata for a resource or path to a specific key. + + * `cfn-hup` – Use to check for updates to metadata and execute custom hooks when changes are detected. + + + + +You call the scripts directly from your template. The scripts work in conjunction with resource metadata that's defined in the same template. The scripts run on the Amazon EC2 instance during the stack creation process. + +For more information about the helper scripts, see [CloudFormation helper scripts reference](./cfn-helper-scripts-reference.html). + +## Example of bootstrapping a Windows stack @@ -13 +38 @@ For the purposes of illustration, we'll examine a AWS CloudFormation single-inst -This example demonstrates how to: +Let's examine example snippets from a SharePoint server template that performs the following actions: @@ -15 +40 @@ This example demonstrates how to: - * Create an IAM User and security group for access to the instance. + * Creates an IAM User and security group for access to the instance. @@ -17 +42 @@ This example demonstrates how to: - * Configure initialization files: `cfn-credentials`, `cfn-hup.conf`, and `cfn-auto-reloader.conf`. + * Configures initialization files: `cfn-credentials`, `cfn-hup.conf`, and `cfn-auto-reloader.conf`. @@ -19 +44 @@ This example demonstrates how to: - * Download and install a package such as SharePoint Foundation 2010 on the server instance. + * Downloads and installs a package such as SharePoint Foundation 2010 on the server instance. @@ -21 +46 @@ This example demonstrates how to: - * Use a `WaitCondition` to ensure resources are ready. + * Uses a `WaitCondition` to ensure resources are ready. @@ -23 +48 @@ This example demonstrates how to: - * Retrieve an IP for the instance with Amazon Elastic IP (EIP). + * Retrieves an IP for the instance with Amazon Elastic IP (EIP). @@ -28 +53 @@ This example demonstrates how to: -The AWS CloudFormation helper script `cfn-init` is used to perform each of these actions, based on information in the `AWS::CloudFormation::Init` resource in the Windows Single Server Sharepoint Foundation template. +The CloudFormation helper script `cfn-init` is used to perform each of these actions, based on information in the `AWS::CloudFormation::Init` resource in the template. @@ -30 +55 @@ The AWS CloudFormation helper script `cfn-init` is used to perform each of these -The `AWS::CloudFormation::Init` section is named `SharePointFoundation`, and begins with a standard declaration: +The `AWS::CloudFormation::Init` section is named `SharePointFoundation` and begins with a standard declaration: @@ -78 +103 @@ There is also a file that's downloaded to the server: `SharePointFoundation.exe` -Because paths on Windows use a backslash ('\') character, you must always remember to properly escape all backslashes by prepending another backslash whenever you refer to a Windows path in the AWS CloudFormation template. +Because paths on Windows use a backslash ('\') character, you must always remember to properly escape all backslashes by prepending another backslash whenever you refer to a Windows path in the CloudFormation template. @@ -118 +143 @@ Next is the `Properties` section: -In this section, the `UserData` property contains a `cmd.exe` script that will be executed by `cfn-init`, surrounded by `<script>` tags. You can use a Windows Powershell script here instead by surrounding your script with `<powershell>` tags. For Windows stacks, you must base64 encode the wait condition handle URL again. +In this section, the `UserData` property contains a `cmd.exe` script that will be executed by `cfn-init`, surrounded by `<script>` tags. You can use a Windows PowerShell script here instead by surrounding your script with `<powershell>` tags. For Windows stacks, you must base64 encode the wait condition handle URL again. @@ -120 +145 @@ In this section, the `UserData` property contains a `cmd.exe` script that will b -SharePointFoundationWaitHandle is referenced here and run with `cfn-signal`. The `WaitConditionHandle` and associated `WaitCondition` are declared next in the template: +`SharePointFoundationWaitHandle` is referenced here and run with `cfn-signal`. The `WaitConditionHandle` and associated `WaitCondition` are declared next in the template: @@ -147 +172 @@ If all goes well, an Elastic IP is used to provide access to the SharePoint inst -Once stack creation is complete, the IP address supplied by EIP will be displayed in the **Outputs** tab of the AWS CloudFormation console. However, before you can access the instance you will need to retrieve the generated temporary Administrator password for the instance. For more information, see [Connect to your Windows instance using RDP](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connecting_to_windows_instance.html) in the _Amazon EC2 User Guide_. +Once stack creation is complete, the IP address supplied by EIP will be displayed in the **Outputs** tab of the CloudFormation console. However, before you can access the instance you will need to retrieve the generated temporary Administrator password for the instance. For more information, see [Connect to your Windows instance using RDP](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connecting_to_windows_instance.html) in the _Amazon EC2 User Guide_. @@ -149 +174 @@ Once stack creation is complete, the IP address supplied by EIP will be displaye -## How to manage Windows services +## Manage Windows services @@ -164 +189 @@ You manage Windows services in the same way as Linux services, except that you u -You can manage other Windows services in the same way by using the name – not the display name – to reference the service. +You can manage other Windows services in the same way by using the name—not the display name—to reference the service. @@ -166 +191 @@ You can manage other Windows services in the same way by using the name – not -## How to troubleshoot stack creation issues +## Troubleshoot stack creation issues @@ -168 +193 @@ You can manage other Windows services in the same way by using the name – not -If your stack fails during creation, the default behavior is to Rollback on failure. While this is normally a good default because it avoids unnecessary charges, it makes it difficult to debug why your stack creation is failing. +If your stack fails during creation, the default behavior is to rollback on failure. While this is normally a good default because it avoids unnecessary charges, it makes it difficult to debug why your stack creation is failing. @@ -170 +195 @@ If your stack fails during creation, the default behavior is to Rollback on fail -To turn this behavior off, choose **Show Advanced Options** when creating your stack with the AWS CloudFormation console, and select the **No** selector next to **Rollback on failure**. This will allow you to log into your instance and view the log files to pinpoint issues encountered when running your startup scripts. +To turn this behavior off when creating or updating your stack with the CloudFormation console, choose the **Preserve successfully provisioned resources** option under **Stack failure options**. For more information, see [Choose how to handle failures when provisioning resources](./stack-failure-options.html). This allows you to log into your instance and view the log files to pinpoint issues encountered when running your startup scripts. @@ -174 +199 @@ Important logs to look at are: - * The EC2 configuration log at `C:\Program Files\Amazon\Ec2ConfigService\Logs\Ec2ConfigLog.txt` + * The EC2 configuration log at `%ProgramData%\Amazon\EC2Launch\log\agent.log` @@ -181 +206 @@ Important logs to look at are: -See these EC2 guides for more logs: +For more logs, see the following topics in the _Amazon EC2 User Guide_ : @@ -196 +221 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Windows AMIs and templates +Deploy Windows-based stacks