AWS AWSCloudFormation documentation change
Summary
Updated documentation about StackSets account gating with clearer terminology, requirements emphasis, and template references. Changed section headers to be more action-oriented and updated failure tolerance documentation links.
Security assessment
The changes primarily improve clarity and documentation structure for an existing security feature (account gating). While account gating itself is a security control, there's no evidence of addressing a specific vulnerability. Updates emphasize proper Lambda function naming ('AWSCloudFormationStackSetAccountGate') and execution role permissions requirements, which are preventive security measures but don't indicate a newly discovered issue.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stacksets-account-gating.md b/AWSCloudFormation/latest/UserGuide/stacksets-account-gating.md index c23f34cca..21f49ba22 100644 --- a//AWSCloudFormation/latest/UserGuide/stacksets-account-gating.md +++ b//AWSCloudFormation/latest/UserGuide/stacksets-account-gating.md @@ -5 +5 @@ -Setup requirementsSample Lambda account gating functions +RequirementsCloudFormation templates for creating Lambda functions @@ -7 +7 @@ Setup requirementsSample Lambda account gating functions -# Configuring a target account gate in StackSets +# Prevent failed StackSets deployments using target account gates @@ -9 +9 @@ Setup requirementsSample Lambda account gating functions -An account gate is an optional feature that lets you specify an AWS Lambda function to verify that a target account meets certain requirements before AWS CloudFormation StackSets begins stack operations in that account. A common example of an account gate is verifying that there are no CloudWatch alarms active or unresolved on the target account. StackSets invokes the function each time you start stack operations in the target account, and only continues if the function returns a `SUCCEEDED` code. If the Lambda function returns a status of `FAILED`, StackSets does not continue with your requested operation. If you do not have an account gating Lambda function configured, StackSets skips the check, and continues with your operation. +An account gate is an optional feature that helps you verify that a target account meets certain requirements before CloudFormation begins StackSets operations in that account. This verification is performed through an AWS Lambda function that acts as a prerequisite check. @@ -11 +11 @@ An account gate is an optional feature that lets you specify an AWS Lambda funct -If your target account fails an account gate check, the failed operation counts toward your specified failure tolerance number or percentage of stacks. For more information about failure tolerance, see [Stack set operation options](./what-is-cfnstacksets.html#stackset-ops-options). +A common example of an account gate is verifying that there are no CloudWatch alarms active or unresolved on the target account. CloudFormation invokes the Lambda function each time you start stack operations in the target account, and only continues if the function returns a `SUCCEEDED` code. If the Lambda function returns a status of `FAILED`, CloudFormation doesn't continue with your requested operation. If you don't have an account gating Lambda function configured, CloudFormation skips the check, and continues with your operation. @@ -13 +13 @@ If your target account fails an account gate check, the failed operation counts -Account gating is only available for StackSets operations. This functionality is not available for other AWS CloudFormation operations outside of StackSets. +If your target account fails an account gate check, the failed operation counts toward your specified failure tolerance number or percentage of stacks. For more information about failure tolerance, see [StackSet operation options](./stacksets-concepts.html#stackset-ops-options). @@ -15 +15 @@ Account gating is only available for StackSets operations. This functionality is -## Setup requirements +Account gating is only available for StackSets operations. This feature isn't available for other CloudFormation operations outside of StackSets. @@ -17 +17 @@ Account gating is only available for StackSets operations. This functionality is -The following list describes setup requirements for account gating. +## Requirements @@ -19 +19 @@ The following list describes setup requirements for account gating. - * To work with the StackSets account gating functionality, your Lambda function must be named **AWSCloudFormationStackSetAccountGate**. +The following requirements must be met for account gating: @@ -21 +21,3 @@ The following list describes setup requirements for account gating. - * The **AWSCloudFormationStackSetExecutionRole** needs permissions to invoke your Lambda function. Without these permissions, StackSets skips the account gating check, and continues with stack operations. + * Your Lambda function must be named `AWSCloudFormationStackSetAccountGate` to use this feature. + + * The **AWSCloudFormationStackSetExecutionRole** must have permissions to invoke your Lambda function. Without these permissions, CloudFormation will skip the account gating check and proceed with stack operations. @@ -41 +43 @@ The following list describes setup requirements for account gating. -## Sample Lambda account gating functions +## CloudFormation templates for creating Lambda functions @@ -43 +45 @@ The following list describes setup requirements for account gating. -The following sample AWS CloudFormation templates are available for you to create Lambda **AWSCloudFormationStackSetAccountGate** functions. For more information about how to create a new stack using either of these templates, see [Create a stack from the CloudFormation console](./cfn-console-create-stack.html). +Use the following sample templates to create Lambda `AWSCloudFormationStackSetAccountGate` functions. To create a new stack using either of these templates, see [Create a stack from the CloudFormation console](./cfn-console-create-stack.html).