AWS AWSCloudFormation documentation change
Summary
Restructured and expanded documentation for CloudFormation pseudo parameters, including syntax clarification, parameter descriptions, and new usage examples
Security assessment
Changes focus on improving documentation clarity and providing usage examples. While some parameters like AWS::AccountId are mentioned in security contexts (IAM policies), there is no evidence of addressing a specific security vulnerability or weakness. The changes are general documentation improvements rather than security-specific updates.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.md b/AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.md index ddbdd1215..f00f30e20 100644 --- a//AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.md +++ b//AWSCloudFormation/latest/UserGuide/pseudo-parameter-reference.md @@ -5 +5 @@ -SyntaxExampleAvailable pseudo parameters +SyntaxAvailable pseudo parametersExamples @@ -9 +9,3 @@ SyntaxExampleAvailable pseudo parameters -Pseudo parameters are predefined by CloudFormation and don't require declaration in your template. Use them with the `Ref` or `Sub` intrinsic functions to access contextual information about your AWS account, Region, and other contextual data, instead of hard-coding values in your template. +Pseudo parameters are built-in variables that provide access to important AWS environment information such as account IDs, Region names, and stack details that can change between deployments or environments. + +You can use pseudo parameters instead of hard-coded values to make your templates more portable and easier to reuse across different AWS accounts and Regions. @@ -13 +15,5 @@ Pseudo parameters are predefined by CloudFormation and don't require declaration -To use pseudo parameters with the `Ref` intrinsic function, the basic syntax is: +You can reference pseudo parameters using either the `Ref` intrinsic function or the `Fn::Sub` intrinsic function. + +### Ref + +The `Ref` intrinsic function uses the following general syntax. For more information, see [Ref](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html). @@ -15 +21 @@ To use pseudo parameters with the `Ref` intrinsic function, the basic syntax is: -### JSON +#### JSON @@ -20 +26 @@ To use pseudo parameters with the `Ref` intrinsic function, the basic syntax is: -### YAML +#### YAML @@ -25 +31 @@ To use pseudo parameters with the `Ref` intrinsic function, the basic syntax is: -To use pseudo parameters with the `Sub` intrinsic function, the basic syntax is: +### Fn::Sub @@ -27 +33,3 @@ To use pseudo parameters with the `Sub` intrinsic function, the basic syntax is: -### JSON +The `Fn::Sub` intrinsic function uses a different format that includes the `${}` syntax around the pseudo parameter. For more information, see [Fn::Sub](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-sub.html). + +#### JSON @@ -32 +40 @@ To use pseudo parameters with the `Sub` intrinsic function, the basic syntax is: -### YAML +#### YAML @@ -37 +45 @@ To use pseudo parameters with the `Sub` intrinsic function, the basic syntax is: -## Example +## Available pseudo parameters @@ -39 +47 @@ To use pseudo parameters with the `Sub` intrinsic function, the basic syntax is: -The following snippet assigns the value of the `AWS::Region` pseudo parameter to an output value: +### `AWS::AccountId` @@ -41 +49 @@ The following snippet assigns the value of the `AWS::Region` pseudo parameter to -### JSON +Returns the AWS account ID of the account in which the stack is being created, such as `123456789012`. @@ -42,0 +51 @@ The following snippet assigns the value of the `AWS::Region` pseudo parameter to +This pseudo parameter is commonly used when defining IAM roles, policies, and other resource policies that involve account-specific ARNs. @@ -44,3 +53 @@ The following snippet assigns the value of the `AWS::Region` pseudo parameter to - "Outputs" : { - "MyStacksRegion" : { "Value" : { "Ref" : "AWS::Region" } } - } +### `AWS::NotificationARNs` @@ -48 +55 @@ The following snippet assigns the value of the `AWS::Region` pseudo parameter to -### YAML +Returns the list of Amazon Resource Names (ARNs) for the Amazon SNS topics that receive stack event notifications. You can specify these ARNs through the `--notification-arns` option in the AWS CLI or through the console as you are creating or updating your stack. @@ -49,0 +57 @@ The following snippet assigns the value of the `AWS::Region` pseudo parameter to +Unlike other pseudo parameters that return a single value, `AWS::NotificationARNs` returns a list of ARNs. To access a specific ARN in the list, use the `Fn::Select` intrinsic function. For more information, see [Fn::Select](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-select.html). @@ -51,3 +59 @@ The following snippet assigns the value of the `AWS::Region` pseudo parameter to - Outputs: - MyStacksRegion: - Value: !Ref "AWS::Region" +### `AWS::NoValue` @@ -55 +61 @@ The following snippet assigns the value of the `AWS::Region` pseudo parameter to -## Available pseudo parameters +Removes the corresponding resource property when specified as a return value in the `Fn::If` intrinsic function. For more information, see [Fn::If](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.html#intrinsic-function-reference-conditions-if). @@ -57 +63 @@ The following snippet assigns the value of the `AWS::Region` pseudo parameter to -### `AWS::AccountId` +This pseudo parameter is particularly useful for creating conditional resource properties that should only be included under certain conditions. @@ -59 +65 @@ The following snippet assigns the value of the `AWS::Region` pseudo parameter to -Returns the AWS account ID of the account in which the stack is being created, such as `123456789012`. +### `AWS::Partition` @@ -61 +67,33 @@ Returns the AWS account ID of the account in which the stack is being created, s -### `AWS::NotificationARNs` +Returns the partition that the resource is in. For standard AWS Regions, the partition is `aws`. For resources in other partitions, the partition is `aws-``partitionname`. For example, the partition for resources in the China (Beijing and Ningxia) Regions is `aws-cn` and the partition for resources in the AWS GovCloud (US-West) Region is `aws-us-gov`. + +The partition forms part of the ARN for resources. Using `AWS::Partition` ensures your templates work correctly across different AWS partitions. + +### `AWS::Region` + +Returns a string representing the Region in which the encompassing resource is being created, such as `us-west-2`. + +This is one of the most commonly used pseudo parameters, as it allows templates to adapt to different AWS Regions without modification. + +### `AWS::StackId` + +Returns the ID (ARN) of the stack, such as `arn:aws:cloudformation:us-west-2:123456789012:stack/teststack/51af3dc0-da77-11e4-872e-1234567db123`. + +### `AWS::StackName` + +Returns the name of the stack, such as `teststack`. + +The stack name is commonly used to create unique resource names that are easily identifiable as belonging to a specific stack. + +### `AWS::URLSuffix` + +Returns the suffix for the AWS domain in the AWS Region where the stack is deployed. The suffix is typically `amazonaws.com`, but for the China (Beijing) Region, the suffix is `amazonaws.com.cn`. + +This parameter is particularly useful when constructing URLs for AWS service endpoints. + +## Examples + +###### Topics + + * Basic usage + + * Using AWS::NotificationARNs @@ -63 +101 @@ Returns the AWS account ID of the account in which the stack is being created, s -Returns the list of notification Amazon Resource Names (ARNs) for the current stack. + * Conditional properties with AWS::NoValue @@ -65 +103,62 @@ Returns the list of notification Amazon Resource Names (ARNs) for the current st -To get a single ARN from the list, use `Fn::Select`. For more information, see the [Fn::Select](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-select.html) reference. + + + +### Basic usage + +The following examples create two resources: an Amazon SNS topic and a CloudWatch alarm that sends notifications to that topic. They use `AWS::StackName`, `AWS::Region`, and `AWS::AccountId` to dynamically insert the stack name, current AWS Region, and account ID into resource names, descriptions, and ARNs. + +#### JSON + + + { + "Resources": { + "MyNotificationTopic": { + "Type": "AWS::SNS::Topic", + "Properties": { + "DisplayName": { "Fn::Sub": "Notifications for ${AWS::StackName}" } + } + }, + "CPUAlarm": { + "Type": "AWS::CloudWatch::Alarm", + "Properties": { + "AlarmDescription": { "Fn::Sub": "Alarm for high CPU in ${AWS::Region}" }, + "AlarmName": { "Fn::Sub": "${AWS::StackName}-HighCPUAlarm" }, + "MetricName": "CPUUtilization", + "Namespace": "AWS/EC2", + "Statistic": "Average", + "Period": 300, + "EvaluationPeriods": 1, + "Threshold": 80, + "ComparisonOperator": "GreaterThanThreshold", + "AlarmActions": [{ "Fn::Sub": "arn:aws:sns:${AWS::Region}:${AWS::AccountId}:${MyNotificationTopic}" }] + } + } + } + } + +#### YAML + + + Resources: + MyNotificationTopic: + Type: AWS::SNS::Topic + Properties: + DisplayName: !Sub Notifications for ${AWS::StackName} + CPUAlarm: + Type: AWS::CloudWatch::Alarm + Properties: + AlarmDescription: !Sub Alarm for high CPU in ${AWS::Region} + AlarmName: !Sub ${AWS::StackName}-HighCPUAlarm + MetricName: CPUUtilization + Namespace: AWS/EC2 + Statistic: Average + Period: 300 + EvaluationPeriods: 1 + Threshold: 80 + ComparisonOperator: GreaterThanThreshold + AlarmActions: + - !Sub arn:aws:sns:${AWS::Region}:${AWS::AccountId}:${MyNotificationTopic} + +### Using AWS::NotificationARNs + +The following examples configure an Auto Scaling group to send notifications for instance launch events and launch errors. The configuration uses the `AWS::NotificationARNs` pseudo parameter, which provides a list of Amazon SNS topic ARNs that were specified during stack creation. The `Fn::Select` function chooses the first ARN from that list. @@ -70 +169 @@ To get a single ARN from the list, use `Fn::Select`. For more information, see t - "myASGrpOne" : { + "myASG": { @@ -72 +170,0 @@ To get a single ARN from the list, use `Fn::Select`. For more information, see t - "Version" : "2009-05-15", @@ -74,4 +172,11 @@ To get a single ARN from the list, use `Fn::Select`. For more information, see t - "AvailabilityZones" : [ "us-east-1a" ], - "LaunchConfigurationName" : { "Ref" : "MyLaunchConfiguration" }, - "MinSize" : "0", - "MaxSize" : "0", + "LaunchTemplate": { + "LaunchTemplateId": { "Ref": "myLaunchTemplate" }, + "Version": { "Fn::GetAtt": [ "myLaunchTemplate", "LatestVersionNumber" ] } + }, + "MaxSize": "1", + "MinSize": "1", + "VPCZoneIdentifier": [ + "subnetIdAz1", + "subnetIdAz2", + "subnetIdAz3" + ], @@ -88 +193 @@ To get a single ARN from the list, use `Fn::Select`. For more information, see t - myASGrpOne: + myASG: @@ -90 +194,0 @@ To get a single ARN from the list, use `Fn::Select`. For more information, see t - Version: '2009-05-15' @@ -92,6 +196,9 @@ To get a single ARN from the list, use `Fn::Select`. For more information, see t