AWS AWSCloudFormation documentation change
Summary
Updated documentation links, terminology (changed 'AWS CloudFormation' to 'CloudFormation' in multiple instances), and clarified helper script references
Security assessment
Changes primarily involve branding updates (removing 'AWS' prefix) and documentation URL corrections. No specific security vulnerabilities or mitigations are mentioned. The update to 'Use the latest helper scripts' is a general best practice but not a new security feature.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/best-practices.md b/AWSCloudFormation/latest/UserGuide/best-practices.md index 8e6dbb18e..d00db7748 100644 --- a//AWSCloudFormation/latest/UserGuide/best-practices.md +++ b//AWSCloudFormation/latest/UserGuide/best-practices.md @@ -0,0 +1,2 @@ +[](/pdfs/AWSCloudFormation/latest/UserGuide/cfn-ug.pdf#best-practices "Open PDF") + @@ -3 +5 @@ -Shorten the feedback loop to improve delivery velocityOrganize your stacks by lifecycle and ownershipUse cross-stack references to export shared resourcesVerify quotas for all resource typesReuse templates to replicate stacks in multiple environmentsUse modules to reuse resource configurationsUse AWS-specific parameter typesUse parameter constraintsUse pseudo parameters to promote portabilityUse AWS::CloudFormation::Init to deploy software applications on Amazon EC2 instancesUse the latest helper scriptsValidate templates before using themManage all stack resources through AWS CloudFormationCreate change sets before updating your stacksUse stack policiesUse code reviews and revision controls to manage your templatesUpdate your Amazon EC2 instances regularly +Shorten the feedback loop to improve delivery velocityOrganize your stacks by lifecycle and ownershipUse cross-stack references to export shared resourcesVerify quotas for all resource typesReuse templates to replicate stacks in multiple environmentsUse modules to reuse resource configurationsUse AWS-specific parameter typesUse parameter constraintsUse pseudo parameters to promote portabilityUse AWS::CloudFormation::Init to deploy software applications on Amazon EC2 instancesUse the latest helper scriptsValidate templates before using themManage all stack resources through CloudFormationCreate change sets before updating your stacksUse stack policiesUse code reviews and revision controls to manage your templatesUpdate your Amazon EC2 instances regularly @@ -5 +7 @@ Shorten the feedback loop to improve delivery velocityOrganize your stacks by li -# AWS CloudFormation best practices +# CloudFormation best practices @@ -7 +9 @@ Shorten the feedback loop to improve delivery velocityOrganize your stacks by li -Best practices are recommendations that can help you use AWS CloudFormation more effectively and securely throughout its entire workflow. Learn how to plan and organize your stacks, create templates that describe your resources and the software applications that run on them, and manage your stacks and their resources. The following best practices are based on real-world experience from current CloudFormation customers. +Best practices are recommendations that can help you use CloudFormation more effectively and securely throughout its entire workflow. Learn how to plan and organize your stacks, create templates that describe your resources and the software applications that run on them, and manage your stacks and their resources. The following best practices are based on real-world experience from current CloudFormation customers. @@ -52 +54 @@ Best practices are recommendations that can help you use AWS CloudFormation more - * Manage all stack resources through AWS CloudFormation + * Manage all stack resources through CloudFormation @@ -71 +73 @@ Adopt practices and tools that help you shorten the feedback loop for your infra -Tooling choices that help you achieve fail-fast practices include the [AWS CloudFormation Linter](https://github.com/aws-cloudformation/cfn-lint) (`cfn-lint`) and [TaskCat](https://github.com/aws-ia/taskcat) command line tools. The `cfn-lint` tool gives you the ability to validate your CloudFormation templates against the [AWS CloudFormation Resource Specification](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-resource-specification.html). This includes checking valid values for resource properties, as well as best practices. Plugins for `cfn-lint` are [available for a number of code editors](https://github.com/aws-cloudformation/cfn-lint#editor-plugins); this gives you the ability to visualize issues within your editor and to get direct linter feedback. You can also choose to integrate `cfn-lint` in your source code repository’s configuration, so that you can perform template validation when you commit your contributions. For more information, see [Git pre-commit validation of AWS CloudFormation templates with `cfn-lint`](https://aws.amazon.com/blogs/mt/git-pre-commit-validation-of-aws-cloudformation-templates-with-cfn-lint/). Once you have performed your initial linting—and fixed any issues `cfn-lint` might have raised—you can use TaskCat to test your templates by programmatically creating stacks in AWS Regions you choose. TaskCat also generates a report with a pass/fail grades for each Region you chose. +Tooling choices that help you achieve fail-fast practices include the [AWS CloudFormation Linter](https://github.com/aws-cloudformation/cfn-lint) (`cfn-lint`) and [TaskCat](https://github.com/aws-ia/taskcat) command line tools. The `cfn-lint` tool gives you the ability to validate your CloudFormation templates against the [AWS CloudFormation Resource Specification](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/cfn-resource-specification.html). This includes checking valid values for resource properties, as well as best practices. Plugins for `cfn-lint` are [available for a number of code editors](https://github.com/aws-cloudformation/cfn-lint#editor-plugins); this gives you the ability to visualize issues within your editor and to get direct linter feedback. You can also choose to integrate `cfn-lint` in your source code repository’s configuration, so that you can perform template validation when you commit your contributions. For more information, see [Git pre-commit validation of AWS CloudFormation templates with `cfn-lint`](https://aws.amazon.com/blogs/mt/git-pre-commit-validation-of-aws-cloudformation-templates-with-cfn-lint/). Once you have performed your initial linting—and fixed any issues `cfn-lint` might have raised—you can use TaskCat to test your templates by programmatically creating stacks in the AWS Regions you choose. TaskCat also generates a report with a pass/fail grades for each Region you chose. @@ -105 +107 @@ As your infrastructure grows, common patterns can emerge in which you declare th -These building blocks can be for a single resource, like best practices for defining an Amazon Elastic Compute Cloud (Amazon EC2) instance, or they can be for multiple resources, to define common patterns of application architecture. These building blocks can be nested into other modules, so you can stack your best practices into higher-level building blocks. CloudFormation modules are available in the [CloudFormation registry](./registry.html), so you can use them just like a native resource. When you use a CloudFormation module, the module template is expanded into the consuming template, which makes it possible for you to access the resources inside the module using a [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html) or [Fn::GetAtt](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html). For more information, see [Create reusable resource configurations that can be included across templates with CloudFormation modules](./modules.html). +These building blocks can be for a single resource, like best practices for defining an Amazon Elastic Compute Cloud (Amazon EC2) instance, or they can be for multiple resources, to define common patterns of application architecture. These building blocks can be nested into other modules, so you can stack your best practices into higher-level building blocks. CloudFormation modules are available in the [CloudFormation registry](./registry.html), so you can use them just like a native resource. When you use a CloudFormation module, the module template is expanded into the consuming template, which makes it possible for you to access the resources inside the module using a [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html) or [Fn::GetAtt](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html). For more information, see [Create reusable resource configurations that can be included across templates with CloudFormation modules](./modules.html). @@ -109 +111 @@ These building blocks can be for a single resource, like best practices for defi -If your template requires inputs for existing AWS-specific values, such as existing Amazon Virtual Private Cloud IDs or an Amazon EC2 key pair name, use AWS-specific parameter types. For example, you can specify a parameter as type `AWS::EC2::KeyPair::KeyName`, which takes an existing key pair name that's in your AWS account and in the Region where you are creating the stack. AWS CloudFormation can quickly validate values for AWS-specific parameter types before creating your stack. Also, if you use the CloudFormation console, CloudFormation shows a drop down list of valid values, so you don't have to look up or memorize the correct VPC IDs or key pair names. For more information, see [Specify existing resources at runtime with CloudFormation-supplied parameter types](./cloudformation-supplied-parameter-types.html). +If your template requires inputs for existing AWS-specific values, such as existing Amazon Virtual Private Cloud IDs or an Amazon EC2 key pair name, use AWS-specific parameter types. For example, you can specify a parameter as type `AWS::EC2::KeyPair::KeyName`, which takes an existing key pair name that's in your AWS account and in the Region where you are creating the stack. CloudFormation can quickly validate values for AWS-specific parameter types before creating your stack. Also, if you use the CloudFormation console, CloudFormation shows a drop down list of valid values, so you don't have to look up or memorize the correct VPC IDs or key pair names. For more information, see [Specify existing resources at runtime with CloudFormation-supplied parameter types](./cloudformation-supplied-parameter-types.html). @@ -117 +119 @@ With constraints, you can describe allowed input values so that CloudFormation c -You can use [pseudo parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.html) in your templates as arguments for [intrinsic functions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference.html), such as `Ref` and `Fn::Sub`. Pseudo parameters are parameters that are predefined by CloudFormation. You don't declare them in your template. Using pseudo parameters in intrinsic functions increases the portability of your stack templates across Regions and accounts. +You can use [pseudo parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/pseudo-parameter-reference.html) in your templates as arguments for [intrinsic functions](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference.html), such as `Ref` and `Fn::Sub`. Pseudo parameters are parameters that are predefined by CloudFormation. You don't declare them in your template. Using pseudo parameters in intrinsic functions increases the portability of your stack templates across Regions and accounts. @@ -133 +135 @@ In your template, specify installation and configuration states in the `AWS::Clo -The helper scripts are updated periodically. Be sure you include the following command in the `UserData` property of your template before you call the helper scripts to ensure that your launched instances get the latest helper scripts: +The CloudFormation helper scripts are updated periodically. Be sure you include the following command in the `UserData` property of your template before you call the helper scripts to ensure that your launched instances get the latest helper scripts: @@ -138 +140 @@ The helper scripts are updated periodically. Be sure you include the following c -For more information about getting the latest helper scripts, see the [CloudFormation helper scripts reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-helper-scripts-reference.html). +For more information about getting the latest helper scripts, see the [CloudFormation helper scripts reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/cfn-helper-scripts-reference.html) in the __. @@ -156 +158 @@ For more information, see the [cfn-guard](https://github.com/aws-cloudformation/ -## Manage all stack resources through AWS CloudFormation +## Manage all stack resources through CloudFormation