AWS AWSCloudFormation documentation change
Summary
Added troubleshooting section for AMI mapping errors with guidance to use SSM parameters for dynamic AMI resolution
Security assessment
The new guidance recommends using Systems Manager parameters to automatically reference the latest AMIs, which helps maintain up-to-date system patches. While this improves security posture, there's no indication it fixes a specific security flaw.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/walkthrough-crossstackref.md b/AWSCloudFormation/latest/UserGuide/walkthrough-crossstackref.md index 49c0d2f94..9ff63a00f 100644 --- a//AWSCloudFormation/latest/UserGuide/walkthrough-crossstackref.md +++ b//AWSCloudFormation/latest/UserGuide/walkthrough-crossstackref.md @@ -5 +5 @@ -Step 1: Use a sample template to create a network stackStep 2: Use a sample template to create a web application stackStep 3: Verify the stack works as designedStep 4: Clean up your resources +Use a sample template to create a network stackUse a sample template to create a web application stackVerify the stack works as designedTroubleshoot AMI mapping errorsClean up your resources @@ -21 +21,16 @@ CloudFormation is a free service. However, you are charged for the AWS resources -## Step 1: Use a sample template to create a network stack +###### Topics + + * Use a sample template to create a network stack + + * Use a sample template to create a web application stack + + * Verify the stack works as designed + + * Troubleshoot AMI mapping errors + + * Clean up your resources + + + + +## Use a sample template to create a network stack @@ -60 +75 @@ It might take several minutes for CloudFormation to create your stack. Wait unti -## Step 2: Use a sample template to create a web application stack +## Use a sample template to create a web application stack @@ -91 +106 @@ It might take several minutes for CloudFormation to create your stack. -## Step 3: Verify the stack works as designed +## Verify the stack works as designed @@ -99 +114,38 @@ Use the console to view the stack outputs and the example website URL to verify -## Step 4: Clean up your resources +## Troubleshoot AMI mapping errors + +If you receive the error `Template error: Unable to get mapping for AWSRegionArch2AMI::[region]::HVM64`, the template doesn't include an AMI mapping for your AWS Region. Instead of updating the mapping, we recommend using Systems Manager public parameters to dynamically reference the latest AMIs: + + 1. Download the `SampleWebAppCrossStack` template to your local machine from: [https://s3.amazonaws.com/cloudformation-examples/user-guide/cross-stack/SampleWebAppCrossStack.template](https://s3.amazonaws.com/cloudformation-examples/user-guide/cross-stack/SampleWebAppCrossStack.template). + + 2. Delete the entire `AWSRegionArch2AMI` mapping section. + + 3. Add the following Systems Manager parameter: + + "LatestAmiId": { + "Description": "The latest Amazon Linux 2 AMI from the Parameter Store", + "Type": "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>", + "Default": "/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2" + } + + 4. Replace the existing `ImageId` reference: + + "ImageId": { "Fn::FindInMap": [ "AWSRegionArch2AMI", { "Ref": "AWS::Region" } , "HVM64" ] }, + +With: + + "ImageId": { "Ref": "LatestAmiId" }, + +This parameter automatically resolves to the latest Amazon Linux 2 AMI for the region where you deploy the stack. + +For other Linux distributions, use the appropriate parameter path. For more information, see [Discovering public parameters in Parameter Store](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-finding-public-parameters.html) in the _AWS Systems Manager User Guide_. + + 5. Upload the modified template to an S3 bucket in your account: + + aws s3 cp SampleWebAppCrossStack.template s3://amzn-s3-demo-bucket/ + + 6. When creating the stack, specify your S3 template URL instead of the example URL. + + + + +## Clean up your resources