AWS AWSCloudFormation medium security documentation change
Summary
Restructured documentation for CloudFormation Rules section with updated syntax examples, added field descriptions, and revised cross-parameter validation examples. Changed AMI IDs in examples and improved rule function documentation.
Security assessment
The changes enhance documentation around parameter validation rules that enforce security configurations. Specific security relevance comes from the cross-parameter validation example requiring SSL certificate and domain name when SSL is enabled (Fn::Not [Fn::Equals] checks for non-empty values), which prevents insecure configurations. The 'All subnets must be in the VPC' assertion fix improves validation accuracy.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/rules-section-structure.md b/AWSCloudFormation/latest/UserGuide/rules-section-structure.md index 76f1f993c..f121762ac 100644 --- a//AWSCloudFormation/latest/UserGuide/rules-section-structure.md +++ b//AWSCloudFormation/latest/UserGuide/rules-section-structure.md @@ -0,0 +1,2 @@ +[](/pdfs/AWSCloudFormation/latest/UserGuide/cfn-ug.pdf#rules-section-structure "Open PDF") + @@ -3 +5 @@ -Working with rulesRule-specific intrinsic functionsSyntaxExamplesCross-parameter validation +SyntaxRule-specific intrinsic functionsExamples @@ -7,34 +9 @@ Working with rulesRule-specific intrinsic functionsSyntaxExamplesCross-parameter -The optional `Rules` section validates a parameter or a combination of parameters passed to a template during a stack creation or stack update. To use template rules, explicitly declare `Rules` in your template followed by an assertion. Use the rules section to validate parameter values before creating or updating resources. - -## Working with rules - -Each template rule consists of two properties: - - * _Rule condition_ (optional) – determines when a rule takes effect. - - * _Assertions_ (required) – describes what values users can specify for a particular parameter. - - - - -A rule can include a `RuleCondition` property and must include an `Assertions` property. For each rule, you can define only one rule condition. You can define one or more asserts within the `Assertions` property. If you don't define a rule condition, the rule's assertions always take effect. - -## Rule-specific intrinsic functions - -To define a rule condition and assertions, use _rule-specific intrinsic functions_ , which are functions that can only be used in the `Rules` section of a template. You can nest functions, but the final result of a rule condition or assertion must be either true or false. - -You can use the following rule-specific intrinsic functions to define rule conditions and assertions: - - * [Fn::And](./intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-and) - - * [Fn::Contains](./intrinsic-function-reference-rules.html#fn-contains) - - * [Fn::EachMemberEquals](./intrinsic-function-reference-rules.html#fn-eachmemberequals) - - * [Fn::EachMemberIn](./intrinsic-function-reference-rules.html#fn-eachmemberin) - - * [Fn::Equals](./intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-equals) - - * [Fn::If](./intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-if) - - * [Fn::Not](./intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-not) +The `Rules` section is an optional part of a CloudFormation template that enables custom validation logic. When included, this section contains rule functions that validate parameter values before CloudFormation creates or updates any resources. @@ -42,12 +11 @@ You can use the following rule-specific intrinsic functions to define rule condi - * [Fn::Or](./intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-or) - - * [Fn::RefAll](./intrinsic-function-reference-rules.html#fn-refall) - - * [Fn::ValueOf](./intrinsic-function-reference-rules.html#fn-valueof) - - * [Fn::ValueOfAll](./intrinsic-function-reference-rules.html#fn-valueofall) - - - - -Rule-specific intrinsic functions are used in the condition or assertions of a rule. The condition property determines if CloudFormation applies the assertions. If the condition evaluates to `true`, CloudFormation evaluates the assertions to verify whether a parameter value is valid when a provisioned product is created or updated. If a parameter value is invalid, CloudFormation does not create or update the stack. If the condition evaluates to `false`, CloudFormation doesn't check the parameter value and proceeds with the stack operation. +Rules are useful when standard parameter constraints are insufficient. For example, if SSL is enabled, both a certificate and domain name must be provided. @@ -56,0 +15,2 @@ Rule-specific intrinsic functions are used in the condition or assertions of a r +The `Rules` section uses the following syntax: + @@ -59 +19 @@ Rule-specific intrinsic functions are used in the condition or assertions of a r -The `Rules` section of a template consists of the key name `Rules`, followed by a single colon. You must use braces to enclose all rule declarations. If you declare multiple rules, they are delimited by commas. For each rule, you declare a logical name in quotation marks followed by a colon and braces that enclose the rule condition and assertions. +The `Rules` section of a template consists of the key name `Rules`, followed by a single colon. You must use braces to enclose all rule declarations. If you declare multiple rules, they're delimited by commas. For each rule, you declare a logical name in quotation marks followed by a colon and braces that enclose the rule condition and assertions. @@ -64 +24 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - "Rule01": { + "LogicalRuleName1": { @@ -66 +26 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - "rule-specific intrinsic function": "Value01" + "rule-specific intrinsic function": "Value" @@ -71 +31 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - "rule-specific intrinsic function": "Value02" + "rule-specific intrinsic function": "Value" @@ -77 +37 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - "rule-specific intrinsic function": "Value03" + "rule-specific intrinsic function": "Value" @@ -83 +43 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - "Rule02": { + "LogicalRuleName2": { @@ -87 +47 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - "rule-specific intrinsic function": "Value04" + "rule-specific intrinsic function": "Value" @@ -100 +60 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - Rule01: + LogicalRuleName1: @@ -102 +62 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - rule-specific intrinsic function: Value01 + rule-specific intrinsic function: Value @@ -105 +65 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - rule-specific intrinsic function: Value02 + rule-specific intrinsic function: Value @@ -108 +68 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - rule-specific intrinsic function: Value03 + rule-specific intrinsic function: Value @@ -110 +70 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - Rule02: + LogicalRuleName2: @@ -113 +73 @@ The `Rules` section of a template consists of the key name `Rules`, followed by - rule-specific intrinsic function: Value04 + rule-specific intrinsic function: Value @@ -115,0 +76,62 @@ The `Rules` section of a template consists of the key name `Rules`, followed by +### Rules fields + +The `Rules` section can include the following fields. + +**Logical ID (also called _logical name_)** + + +A unique identifier for each rule. + +**`RuleCondition` (optional)** + + +A property that determines when a rule takes effect. If you don't define a rule condition, the rule's assertions always take effect. For each rule, you can define only one rule condition. + +**`Assertions` (required)** + + +One or more statements that specify the acceptable values for a particular parameter. + +**`Assert`** + + +A condition that must evaluate to `true`. + +**`AssertDescription`** + + +A message displayed when an assertion fails. + +## Rule-specific intrinsic functions + +To define your rules, you must use _rule-specific functions_ , which are functions that can only be used in the `Rules` section of a template. While these functions can be nested, the final result of a rule condition or assertion must be either `true` or `false`. + +The following rule functions are available: + + * [Fn::And](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-and) + + * [Fn::Contains](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-rules.html#fn-contains) + + * [Fn::EachMemberEquals](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-rules.html#fn-eachmemberequals) + + * [Fn::EachMemberIn](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-rules.html#fn-eachmemberin) + + * [Fn::Equals](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-equals) + + * [Fn::If](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-if) + + * [Fn::Not](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-not) + + * [Fn::Or](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-or) + + * [Fn::RefAll](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-rules.html#fn-refall) + + * [Fn::ValueOf](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-rules.html#fn-valueof) + + * [Fn::ValueOfAll](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-rules.html#fn-valueofall) + + + + +These functions are used in the condition or assertions of a rule. The condition property determines if CloudFormation applies the assertions. If the condition evaluates to `true`, CloudFormation evaluates the assertions to verify whether a parameter value is valid when a provisioned product is created or updated. If a parameter value is invalid, CloudFormation does not create or update the stack. If the condition evaluates to `false`, CloudFormation doesn't check the parameter value and proceeds with the stack operation. + @@ -117,0 +140,9 @@ The `Rules` section of a template consists of the key name `Rules`, followed by +###### Topics + + * Conditionally verify a parameter value + + * Cross-parameter validation + + + + @@ -122 +153 @@ In the following example, the two rules check the value of the `InstanceType` pa -#### Example JSON +#### JSON @@ -130,3 +161 @@ In the following example, the two rules check the value of the `InstanceType` pa - { - "Ref": "Environment" - }, + {"Ref": "Environment"}, @@ -140,6 +169,2 @@ In the following example, the two rules check the value of the `InstanceType` pa - [ - "a1.medium" - ], - { - "Ref": "InstanceType" - } + ["a1.medium"], + {"Ref": "InstanceType"} @@ -155,3 +180 @@ In the following example, the two rules check the value of the `InstanceType` pa - { - "Ref": "Environment" - }, + {"Ref": "Environment"}, @@ -165,6 +188,2 @@ In the following example, the two rules check the value of the `InstanceType` pa - [ - "a1.large"