AWS AWSCloudFormation documentation change
Summary
Updated terminology from 'stack set' to 'StackSet' for consistency, added explicit failure tolerance behavior details, fixed CLI syntax examples, and restructured delegated admin note formatting.
Security assessment
Changes focus on terminology consistency, operational clarity, and documentation structure. The clarification about failure tolerance limits and delegated admin command syntax improves operational reliability but does not address a specific security vulnerability or introduce new security features. The --call-as DELEGATED_ADMIN note existed previously and was only reformatted.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stackinstances-override.md b/AWSCloudFormation/latest/UserGuide/stackinstances-override.md index 28cce49eb..240231921 100644 --- a//AWSCloudFormation/latest/UserGuide/stackinstances-override.md +++ b//AWSCloudFormation/latest/UserGuide/stackinstances-override.md @@ -7 +7 @@ Override parameters on stacks (console)Override parameters on stacks (AWS CLI) -# Override parameter values on stacks within your CloudFormation stack set +# Override parameter values on stacks within your CloudFormation StackSet @@ -9 +9 @@ Override parameters on stacks (console)Override parameters on stacks (AWS CLI) -In certain cases, you might want stacks in certain Regions or accounts to have different property values than those specified in the stack set itself. For example, you might want to specify a different value for a given parameter based on whether an account is used for development or production. For these situations, CloudFormation allows you to override parameter values in stacks by account and Region. You can override template parameter values when you first create the stacks, and you can override parameter values for existing stacks. You can only set parameters you've previously overridden in stacks back to the values specified in the stack set. +In certain cases, you might want stacks in certain Regions or accounts to have different property values than those specified in the StackSet itself. For example, you might want to specify a different value for a given parameter based on whether an account is used for development or production. For these situations, CloudFormation allows you to override parameter values in stacks by account and Region. You can override template parameter values when you first create the stacks, and you can override parameter values for existing stacks. You can only set parameters you've previously overridden in stacks back to the values specified in the StackSet. @@ -11 +11 @@ In certain cases, you might want stacks in certain Regions or accounts to have d -Parameter value overrides apply to stacks in the accounts and Regions you select. During stack set updates, any parameter values overridden for a stack aren't updated, but retain their overridden value. +Parameter value overrides apply to stacks in the accounts and Regions you select. During StackSet updates, any parameter values overridden for a stack aren't updated, but retain their overridden value. @@ -13 +13 @@ Parameter value overrides apply to stacks in the accounts and Regions you select -You can only override parameter _values_ that are specified in the stack set; to add or delete a parameter itself, you need to update the stack set template. If you add a parameter to a stack set template, then before you can override that parameter value in a stack you must first update all stacks with the new parameter and value specified in the stack set. Once all stacks have been updated with the new parameter, you can then override the parameter value in individual stacks as desired. +You can only override parameter _values_ that are specified in the StackSet; to add or delete a parameter itself, you need to update the StackSet template. If you add a parameter to a StackSet template, then before you can override that parameter value in a stack you must first update all stacks with the new parameter and value specified in the StackSet. Once all stacks have been updated with the new parameter, you can then override the parameter value in individual stacks as desired. @@ -15 +15 @@ You can only override parameter _values_ that are specified in the stack set; to -To learn how to override stack set parameter values when you create stacks, see [Add stacks to StackSets](./stackinstances-create.html). +To learn how to override StackSet parameter values when you create stacks, see [Add stacks to StackSets](./stackinstances-create.html). @@ -27,0 +28,2 @@ To learn how to override stack set parameter values when you create stacks, see +###### To override parameters for specific stacks + @@ -30 +32 @@ To learn how to override stack set parameter values when you create stacks, see - 2. On the navigation bar at the top of the screen, choose the AWS Region you created the stack set in. + 2. On the navigation bar at the top of the screen, choose the AWS Region you created the StackSet in. @@ -32 +34 @@ To learn how to override stack set parameter values when you create stacks, see - 3. From the navigation pane, choose **StackSets**. On the StackSets page, select your stack set. + 3. From the navigation pane, choose **StackSets**. On the StackSets page, select your StackSet. @@ -34 +36 @@ To learn how to override stack set parameter values when you create stacks, see - 4. With the stack set selected, choose **Override StackSet parameters** from the **Actions** menu. + 4. With the StackSet selected, choose **Override StackSet parameters** from the **Actions** menu. @@ -40 +42 @@ By default, CloudFormation will deploy stacks in the specified accounts within t - 1. [Self-managed permissions] For **Deployment locations** , choose **Deploy stacks in accounts**. Paste some or all the target account IDs that you used to create your stack set. + 1. [Self-managed permissions] For **Deployment locations** , choose **Deploy stacks in accounts**. Paste some or all the target account IDs that you used to create your StackSet. @@ -44 +46 @@ By default, CloudFormation will deploy stacks in the specified accounts within t - * Choose **Deploy to organizational units (OUs)**. Enter one or more of the target OUs that you used to create your stack set. The overridden parameter values only apply to the accounts that are currently in the target OUs and their child OUs. Accounts added to the target OUs and their child OUs in the future will use the stack set default values and not the overridden values. + * Choose **Deploy to organizational units (OUs)**. Enter one or more of the target OUs that you used to create your StackSet. The overridden parameter values only apply to the accounts that are currently in the target OUs and their child OUs. Accounts added to the target OUs and their child OUs in the future will use the StackSet default values and not the overridden values. @@ -46 +48 @@ By default, CloudFormation will deploy stacks in the specified accounts within t - * Choose **Deploy to accounts**. Paste some or all the target OU IDs or account IDs that you used to create your stack set. + * Choose **Deploy to accounts**. Paste some or all the target OU IDs or account IDs that you used to create your StackSet. @@ -48 +50 @@ By default, CloudFormation will deploy stacks in the specified accounts within t - 2. For **Specify regions** , add one or more of the Regions into which you have deployed stacks for this stack set. + 2. For **Specify regions** , add one or more of the Regions into which you have deployed stacks for this StackSet. @@ -56 +58 @@ If you add multiple Regions, the order of the Regions under **Specify regions** - * For **Failure tolerance** , specify how many failures are acceptable before the operation stops. + * For **Failure tolerance** , specify the maximum number of account failures allowed per Region. The operation will stop and won't proceed to other Regions once this limit is reached. @@ -62 +64 @@ If you add multiple Regions, the order of the Regions under **Specify regions** - * **Strict failure tolerance** – Reduces concurrency level when failures occur, staying within **Failure tolerance** +1. + * **Strict failure tolerance** – Reduces account concurrency level when failures occur, staying within **Failure tolerance** +1. @@ -74 +76 @@ If you add multiple Regions, the order of the Regions under **Specify regions** -To set any overridden parameters back to using the value specified in the stack set, check all parameters and choose **Set to StackSet value** from the **Edit override value** menu. Doing so removes all overridden values once you update the stacks. +To set any overridden parameters back to using the value specified in the StackSet, check all parameters and choose **Set to StackSet value** from the **Edit override value** menu. Doing so removes all overridden values once you update the stacks. @@ -80 +82 @@ To set any overridden parameters back to using the value specified in the stack -CloudFormation starts updating your stacks. View the progress and status of the stacks in the stack set details page that opens when you choose **Submit**. +CloudFormation starts updating your stacks. View the progress and status of the stacks in the StackSet details page that opens when you choose **Submit**. @@ -87 +89 @@ CloudFormation starts updating your stacks. View the progress and status of the -When acting as a delegated administrator, you must set the `--call-as` option to `DELEGATED_ADMIN` each time you run a stack set command. +###### Note @@ -88,0 +91 @@ When acting as a delegated administrator, you must set the `--call-as` option to +When acting as a delegated administrator, you must include `--call-as DELEGATED_ADMIN` in the command. @@ -90 +93 @@ When acting as a delegated administrator, you must set the `--call-as` option to - --call-as DELEGATED_ADMIN +###### To override parameters for specific stacks @@ -100 +103 @@ When acting as a delegated administrator, you must set the `--call-as` option to -[Service-managed permissions] For the `--deployment-targets` option, provide the organization root ID, OU IDs, or AWS Organizations account IDs for which you want to override parameters on stacks. In this example, we override parameter values for stacks in all accounts in the OU with the- `ou-rcuk-1x5j1lwo` ID. +[Service-managed permissions] For the `--deployment-targets` option, provide the organization root ID, OU IDs, or AWS Organizations account IDs for which you want to override parameters on stacks. In this example, we override parameter values for stacks in all accounts in the OU with the ``ou-rcuk-1x5j1lwo`` ID. @@ -102 +105 @@ When acting as a delegated administrator, you must set the `--call-as` option to -The overridden parameter values only apply to the accounts that are currently in the target OU and its child OUs. Accounts added to the target OU and its child OUs in the future will use the stack set default values and not the overridden values. +The overridden parameter values only apply to the accounts that are currently in the target OU and its child OUs. Accounts added to the target OU and its child OUs in the future will use the StackSet default values and not the overridden values. @@ -106 +109 @@ The overridden parameter values only apply to the accounts that are currently in - --deployment-targets OrganizationalUnitIds='["ou-rcuk-1x5j1lwo"]' \ + --deployment-targets OrganizationalUnitIds=ou-rcuk-1x5j1lwo \ @@ -124 +127 @@ Add stacks to StackSets -Enable-disable automatic deployments +Delete stacks from StackSets