AWS Security ChangesHomeSearch

AWS AWSCloudFormation documentation change

Service: AWSCloudFormation · 2025-06-10 · Documentation low

File: AWSCloudFormation/latest/UserGuide/quickref-route53.md

Summary

Updated documentation for CloudFront alias record configuration with additional implementation details and explicit 'EvaluateTargetHealth: false' parameter in examples

Security assessment

The changes primarily improve configuration clarity by specifying required CloudFront hosted zone ID and demonstrating proper Fn::GetAtt usage. The addition of 'EvaluateTargetHealth: false' ensures proper DNS configuration but does not address a security vulnerability - it clarifies expected behavior for CloudFront alias records which don't support target health evaluation. No security vulnerabilities or exploits are mentioned in the changes.

Diff

diff --git a/AWSCloudFormation/latest/UserGuide/quickref-route53.md b/AWSCloudFormation/latest/UserGuide/quickref-route53.md
index d5904aa8f..05f34405f 100644
--- a//AWSCloudFormation/latest/UserGuide/quickref-route53.md
+++ b//AWSCloudFormation/latest/UserGuide/quickref-route53.md
@@ -289 +289 @@ For more information about alias resource record sets, see [Choosing between ali
-The following example creates an alias record set that routes queries to the specified CloudFront distribution.
+The following example creates an alias A record that points a custom domain name to an existing CloudFront distribution. `myHostedZoneID` is assumed to be either a reference to an actual `AWS::Route53::HostedZone` resource in the same template or a parameter. `myCloudFrontDistribution` refers to an `AWS::CloudFront::Distribution` resource within the same template. The alias record uses the standard CloudFront hosted zone ID (`Z2FDTNDATAQYW2`) and automatically resolves the distribution’s domain name using `Fn::GetAtt`. This setup allows web traffic to be routed from the custom domain to the CloudFront distribution without requiring an IP address.
@@ -293 +293 @@ The following example creates an alias record set that routes queries to the spe
-When you create alias resource record sets, you must specify `Z2FDTNDATAQYW2` for the `HostedZoneId` property, as shown in the following example. Alias resource record sets for CloudFront can't be created in a private zone.
+When you create alias resource record sets, you must specify `Z2FDTNDATAQYW2` for the `HostedZoneId` property. Alias resource record sets for CloudFront can't be created in a private zone.
@@ -318 +318,2 @@ When you create alias resource record sets, you must specify `Z2FDTNDATAQYW2` fo
-                            }
+                            },
+                            "EvaluateTargetHealth": false
@@ -330 +331 @@ When you create alias resource record sets, you must specify `Z2FDTNDATAQYW2` fo
-      Type: 'AWS::Route53::RecordSetGroup'
+      Type: AWS::Route53::RecordSetGroup
@@ -340,0 +342 @@ When you create alias resource record sets, you must specify `Z2FDTNDATAQYW2` fo
+              EvaluateTargetHealth: false