AWS AWSCloudFormation documentation change
Summary
Updated documentation for creating StackSets with self-managed permissions, including revised IAM role requirements, simplified template selection process, restructured console/CLI instructions, and added deployment configuration options.
Security assessment
The changes emphasize creating required IAM roles for secure cross-account operations but do not address a specific vulnerability. Security documentation is added through clarified IAM setup requirements and explicit acknowledgement of IAM resource creation capabilities.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md b/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md index cacc31d03..5fe83d1a5 100644 --- a//AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md +++ b//AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create-self-managed.md @@ -5 +5 @@ -Create a stack set with self-managed permissions (console)Create a stack set with self-managed permissions (AWS CLI) +Create a StackSet with self-managed permissions (console)Create a StackSet with self-managed permissions (AWS CLI) @@ -7 +7 @@ Create a stack set with self-managed permissions (console)Create a stack set wit -# Create CloudFormation StackSets with self-managed permissions +# Create AWS CloudFormation StackSets with self-managed permissions @@ -9 +9 @@ Create a stack set with self-managed permissions (console)Create a stack set wit -With _self-managed_ permissions, you can deploy stacks to specific AWS accounts in specific Regions. To do this, you must first create the necessary IAM roles to establish a trusted relationship between the account you're administering the stack set from and the account you're deploying stacks to. For more information, see [Grant self-managed permissions](./stacksets-prereqs-self-managed.html). +This topic describes how to create StackSets with _self-managed_ permissions to deploy stacks across AWS accounts and Regions. @@ -13,3 +13 @@ With _self-managed_ permissions, you can deploy stacks to specific AWS accounts -Before you complete one of the following procedures, verify that the IAM roles `AWSCloudFormationStackSetExecutionRole` and `AWSCloudFormationStackSetAdministrationRole` exist in your administrator account. To launch stacks in accounts other than your administrator account, verify that the IAM role `AWSCloudFormationStackSetExecutionRole` exists in the target accounts. For more information, see [Give all users of the administrator account permissions to manage stacks in all target accounts](./stacksets-prereqs-self-managed.html#stacksets-prereqs-accountsetup). - -The template referenced in this topic enables AWS Config in a target account within the US West (Oregon) Region (`us-west-2`) and US East (N. Virginia) Region (`us-east-1`). The **Enable AWS Config** template is located in the following S3 bucket: [https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/EnableAWSConfig.yml](https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/EnableAWSConfig.yml). You can also choose this sample template in the StackSets console. +Before you continue, create the IAM service roles required by StackSets to establish a trusted relationship between the account you're administering the StackSet from and the account you're deploying stacks to. For more information, see [Grant self-managed permissions](./stacksets-prereqs-self-managed.html). @@ -19 +17,3 @@ The template referenced in this topic enables AWS Config in a target account wit - * Create a stack set with self-managed permissions (console) + * Create a StackSet with self-managed permissions (console) + + * Create a StackSet with self-managed permissions (AWS CLI) @@ -21 +20,0 @@ The template referenced in this topic enables AWS Config in a target account wit - * Create a stack set with self-managed permissions (AWS CLI) @@ -24,0 +24 @@ The template referenced in this topic enables AWS Config in a target account wit +## Create a StackSet with self-managed permissions (console) @@ -26 +26 @@ The template referenced in this topic enables AWS Config in a target account wit -## Create a stack set with self-managed permissions (console) +###### To create a StackSet @@ -30 +30 @@ The template referenced in this topic enables AWS Config in a target account wit - 2. On the navigation bar at the top of the screen, choose the AWS Region that you want to manage the stack set from. + 2. On the navigation bar at the top of the screen, choose the AWS Region that you want to manage the StackSet from. @@ -36,3 +36 @@ The template referenced in this topic enables AWS Config in a target account wit - 5. Skip **Permissions** to use the IAM roles named `AWSCloudFormationStackSetExecutionRole` and `AWSCloudFormationStackSetAdministrationRole` that you created previously. - - 6. Under **Prerequisite - Prepare template** , choose **Use a sample template**. + 5. Under **Permissions** , choose **Self-service permissions** and choose the IAM roles you created. @@ -40 +38 @@ The template referenced in this topic enables AWS Config in a target account wit - 7. Under **Select a sample template** , from the drop-down menu choose the **Enable AWS Config** template. Then, choose **Next**. + 6. Under **Prerequisite - Prepare template** , choose **Template is ready**. @@ -42 +40 @@ The template referenced in this topic enables AWS Config in a target account wit - 8. On the **Specify StackSet details** page, for **StackSet name** , provide a name for the stack set. stack set names must begin with an alphabetical character, and contain only letters, numbers, and hyphens. In this walkthrough, use the name `my-awsconfig-stackset`. + 7. Under **Specify template** , choose to either specify the URL for the S3 bucket that contains your stack template or upload a stack template file. Then, choose **Next**. @@ -44 +42 @@ The template referenced in this topic enables AWS Config in a target account wit - 9. For **StackSet description** , provide a description for the stack set. + 8. On the **Specify StackSet details** page, provide a name for the StackSet, specify any parameters, and then choose **Next**. @@ -46 +44 @@ The template referenced in this topic enables AWS Config in a target account wit - 10. Under **Parameters** , do the following: + 9. Choose **Next** to continue. @@ -48 +46 @@ The template referenced in this topic enables AWS Config in a target account wit - 1. Configure the **Recorder Configuration** parameters that are used by AWS Config. For more information about these parameters, see [Manual setup for AWS Config](https://docs.aws.amazon.com/config/latest/developerguide/manual-setup.title.html) in the _AWS Config Developer Guide_. + 10. On the **Configure StackSet options** page, under **Tags** , specify any tags to apply to resources in your stack. For more information about how tags are used in AWS, see [Organizing and tracking costs using AWS cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing and Cost Management User Guide_. @@ -50 +48 @@ The template referenced in this topic enables AWS Config in a target account wit - 1. For **Support all resource types** , keep the default value, **true** , to record all supported resource types. + 11. For **Execution configuration** , choose **Active** to enable CloudFormation's optimized operation handling: @@ -52 +50 @@ The template referenced in this topic enables AWS Config in a target account wit - 2. For **Include global resource types** , keep the default value, **false** , to exclude global resources like IAM roles. + * Non-conflicting operations run concurrently for faster deployment times. @@ -54 +52 @@ The template referenced in this topic enables AWS Config in a target account wit - 3. Leave **List of resource types if not all supported** set to **< All>**. Only add specific resource types if you selected **false** for **Support all resource types**. + * Conflicting operations are automatically queued and processed in the order they were requested. @@ -56 +54 @@ The template referenced in this topic enables AWS Config in a target account wit - 4. For **The region containing the Config service-linked role resource** , replace **< DeployToAnyRegion>** with `us-west-2`. This means that the service-linked role named `AWSServiceRoleForConfig` will only be created if a stack is deployed to the US West (Oregon) Region. You'll choose the deployment Regions later in this procedure. +While operations are running or queued, CloudFormation queues all incoming operations even if they're non-conflicting. You can't change execution settings during this time. @@ -58 +56 @@ The template referenced in this topic enables AWS Config in a target account wit - 5. For **Configuration recorder recording frequency** , choose between **CONTINUOUS** or **DAILY** recording. + 12. If your template contains IAM resources, for **Capabilities** , choose **I acknowledge that this template may create IAM resources** to specify that you want to use IAM resources in the template. For more information, see [Acknowledging IAM resources in CloudFormation templates](./control-access-with-iam.html#using-iam-capabilities). @@ -60 +58 @@ The template referenced in this topic enables AWS Config in a target account wit - 2. (Optional) Under **Delivery Channel Configuration** , configure the delivery channel for updates and notifications. For more information about the delivery channel in AWS Config, see [Managing the delivery channel](https://docs.aws.amazon.com/config/latest/developerguide/manage-delivery-channel.html) in the _AWS Config Developer Guide_. + 13. Choose **Next**. @@ -62 +60 @@ The template referenced in this topic enables AWS Config in a target account wit - 3. (Optional) Under **Delivery Notifications** , configure Amazon Simple Notification Service (SNS) notifications. + 14. On the **Set deployment options** page, for **Add stacks to StackSet** , choose **Deploy new stacks**. @@ -64,5 +62 @@ The template referenced in this topic enables AWS Config in a target account wit - 11. Choose **Next** to continue. - - 12. On the **Configure StackSet options** page, add a tag by specifying a key and value pair. In this walkthrough, we create a tag called **Stage** , with a value of **Test**. Tags that you apply to StackSets are applied to all resources that are created by your stacks. For more information about how tags are used in AWS, see [Organizing and tracking costs using AWS cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing and Cost Management User Guide_. - - 13. For **Execution configuration** , choose **Active** so that StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. + 15. For **Accounts** , choose **Deploy stacks in accounts**. Paste your target AWS account numbers in the text box, separating multiple numbers with commas. @@ -72 +66,3 @@ The template referenced in this topic enables AWS Config in a target account wit -When operations are running or queued, StackSets queues all incoming operations even if they're non-conflicting. You can't change execution settings during this time. +You can include your administrator account ID if you want to deploy stacks in that account as well. + + 16. Under **Specify regions** , choose the Regions you want to deploy stacks in. @@ -74 +70 @@ When operations are running or queued, StackSets queues all incoming operations - 14. If your template contains IAM resources, for **Capabilities** , choose **I acknowledge that this template may create IAM resources** to specify that you want to use IAM resources in the template. For more information, see [Acknowledging IAM resources in CloudFormation templates](./control-access-with-iam.html#using-iam-capabilities). + 17. For **Deployment options** , do the following: @@ -76 +72 @@ When operations are running or queued, StackSets queues all incoming operations - 15. Choose **Next**. + * For **Maximum concurrent accounts** , specify how many accounts are processed concurrently. @@ -78 +74 @@ When operations are running or queued, StackSets queues all incoming operations - 16. On the **Set deployment options** page, for **Add stacks to stack set** , choose **Deploy new stacks**. + * For **Failure tolerance** , specify the maximum number of account failures allowed per Region. The operation will stop and won't proceed to other Regions once this limit is reached. @@ -80 +76 @@ When operations are running or queued, StackSets queues all incoming operations - 17. For **Accounts** , choose **Deploy stacks in accounts**. Paste your target AWS account numbers in the text box, separating multiple numbers with commas. + * For **Region concurrency** , choose how to process Regions: **Sequential** (one Region at a time) or **Parallel** (multiple Regions concurrently). @@ -82 +78 @@ When operations are running or queued, StackSets queues all incoming operations - 18. For **Specify regions** , choose US East (N. Virginia) Region. Repeat for the US West (Oregon) Region. Select the up arrow next to US West (Oregon) Region to move it to be the first entry in the list. The order of the Regions under **Specify regions** determines their deployment order. + * For **Concurrency mode** , choose how concurrency behaves during operation execution. @@ -84 +80 @@ When operations are running or queued, StackSets queues all incoming operations -By default, CloudFormation will deploy stacks in the specified accounts within the first Region, then moves on to the next, and so on, as long as a Region's deployment failures do not exceed a specified failure tolerance. + * **Strict failure tolerance** – Reduces account concurrency level when failures occur, staying within **Failure tolerance** +1. @@ -86 +82 @@ By default, CloudFormation will deploy stacks in the specified accounts within t - 19. For **Deployment options** , do the following: + * **Soft failure tolerance** – Maintains your specified concurrency level (the value of **Maximum concurrent accounts**) regardless of failures. @@ -88 +84 @@ By default, CloudFormation will deploy stacks in the specified accounts within t - * For **Maximum concurrent accounts** , keep the defaults of **Number** and **1**. + 18. Choose **Next**. @@ -90 +86 @@ By default, CloudFormation will deploy stacks in the specified accounts within t -This means that CloudFormation deploys your stack in only one account at one time. + 19. On the **Review** page, review your choices. To make changes, choose **Edit** on the related section. @@ -92 +88 @@ This means that CloudFormation deploys your stack in only one account at one tim - * For **Failure tolerance** , keep the defaults of **Number** and **0**. + 20. When you are ready to create your StackSet, choose **Submit**. @@ -94 +90 @@ This means that CloudFormation deploys your stack in only one account at one tim -This means that a maximum of one stack deployment can fail in one of your specified Regions before CloudFormation stops deployment in the current Region, and cancels deployment in remaining Regions. +CloudFormation starts creating your StackSet. View the progress and status of the creation of the stacks in your StackSet in the StackSet details page that opens when you choose **Submit**. @@ -96 +91,0 @@ This means that a maximum of one stack deployment can fail in one of your specif - * For **Region concurrency** , choose **Sequential** (default) or **Parallel** to determine StackSets deployment order for specified Regions. @@ -98 +92,0 @@ This means that a maximum of one stack deployment can fail in one of your specif - * For **Concurrency mode** , update the **Concurrency mode** as needed, or skip to the next step. @@ -100 +93,0 @@ This means that a maximum of one stack deployment can fail in one of your specif - 20. Choose **Next**. @@ -102 +95 @@ This means that a maximum of one stack deployment can fail in one of your specif - 21. On the **Review** page, review your choices. To make changes, choose **Edit** on the related section. +## Create a StackSet with self-managed permissions (AWS CLI) @@ -104 +97 @@ This means that a maximum of one stack deployment can fail in one of your specif - 22. When you are ready to create your stack set, choose **Submit**. +Follow the steps in this section to use the AWS CLI to: @@ -106 +99 @@ This means that a maximum of one stack deployment can fail in one of your specif -CloudFormation starts creating your stack set. View the progress and status of the creation of the stacks in your stack set in the stack set details page that opens when you choose **Submit**. + * Create the StackSet container. @@ -107,0 +101 @@ CloudFormation starts creating your stack set. View the progress and status of t + * Deploy stack instances. @@ -111 +104,0 @@ CloudFormation starts creating your stack set. View the progress and status of t -## Create a stack set with self-managed permissions (AWS CLI) @@ -113 +106 @@ CloudFormation starts creating your stack set. View the progress and status of t -When you create StackSets by using AWS CLI commands, you run two separate commands: **create-stack-set** to upload your template and create the stack set container, and **create-stack-instances** to create the stacks within your stack set. +###### To create a StackSet @@ -115 +108 @@ When you create StackSets by using AWS CLI commands, you run two separate comman - 1. Start by running the following [create-stack-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-set.html) command to upload the sample template that enables AWS Config. For the `--template-url` option, provide the URL of the Amazon S3 bucket where your template is located. In this example, we use `my-awsconfig-stackset` as the value of the `--stack-set-name` option. The `--parameters` option is included to work with the `EnableAWSConfig.yml` template we include. If you use your own template, adjust the command to your needs. + 1. Use the [create-stack-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-set.html) command to create a new StackSet named ``my-stackset``. The following example uses a template stored in an S3 bucket and includes a parameter that sets a ``KeyPairName`` with the value ``TestKey``. @@ -118,3 +111,3 @@ When you create StackSets by using AWS CLI commands, you run two separate comman - --stack-set-name my-awsconfig-stackset \ - --template-url https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/EnableAWSConfig.yml \ - --parameters ParameterKey=ServiceLinkedRoleRegion,ParameterValue="us-west-2" ParameterKey=RecordingFrequency,ParameterValue="DAILY" + --stack-set-name my-stackset \ + --template-url https://s3.region-code.amazonaws.com/amzn-s3-demo-bucket/MyApp.template \ + --parameters ParameterKey=KeyPairName,ParameterValue=TestKey @@ -122 +115 @@ When you create StackSets by using AWS CLI commands, you run two separate comman - 2. After your **create-stack-set** command is finished, run the [list-stack-sets](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-stack-sets.html) command to see that your stack set has been created. You should see your new stack set in the results. + 2. After your **create-stack-set** command is finished, run the [list-stack-sets](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-stack-sets.html) command to see that your StackSet has been created. You should see your new StackSet in the results. @@ -126 +119 @@ When you create StackSets by using AWS CLI commands, you run two separate comman - 3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stacks to your stack set. In this walkthrough, we use `us-west-2` and `us-east-1` as the values of the `--regions` option. + 3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to deploy stacks within your StackSet. The following example deploys stacks in two AWS accounts (``account_ID_1`` and ``account_ID_2``) across two Regions (``us-west-2`` and ``us-east-1``). @@ -131 +124 @@ Set concurrent account processing and other deployment preferences using the `-- - --stack-set-name my-awsconfig-stackset \ + --stack-set-name my-stackset \ @@ -138 +131 @@ For more information, see [CreateStackInstances](https://docs.aws.amazon.com/AWS - 4. Using the `operation-id` that was returned as part of the **create-stack-instances** output, use the following [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) command to verify that your stacks were created successfully. + 4. Use the [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) command to verify that your stacks were created successfully. For the `--operation-id` option, specify the operation ID that was returned as part of the **create-stack-instances** output. @@ -141 +134 @@ For more information, see [CreateStackInstances](https://docs.aws.amazon.com/AWS - --stack-set-name my-awsconfig-stackset \ + --stack-set-name my-stackset \ @@ -153 +146 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -StackSets operations +Get started using a sample template