AWS AWSCloudFormation documentation change
Summary
Complete rewrite of StackSets getting started guide to add a detailed tutorial for creating/configuring StackSets with AWS Config, including prerequisites, step-by-step deployment, monitoring, updates, stack additions, cleanup, and next steps.
Security assessment
The changes emphasize proper IAM role configuration (AWSCloudFormationStackSetAdministrationRole/ExecutionRole) which are security best practices, but there is no evidence of addressing a specific vulnerability. The tutorial adds documentation about security-related permissions setup but doesn't reference a security incident or weakness.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stacksets-getting-started.md b/AWSCloudFormation/latest/UserGuide/stacksets-getting-started.md index 387c3bbb7..c8264cf7d 100644 --- a//AWSCloudFormation/latest/UserGuide/stacksets-getting-started.md +++ b//AWSCloudFormation/latest/UserGuide/stacksets-getting-started.md @@ -5 +5 @@ -# CloudFormation StackSets operations +PrerequisitesCreate a StackSet with self-managed permissionsMonitor StackSet creationView StackSet resultsUpdate your StackSetAdd stacks to your StackSetClean upNext steps @@ -7 +7,11 @@ -Before you create your first stack set, be sure that you have completed required account setup steps in [Prerequisites](./stacksets-prereqs.html). +# Get started with StackSets using a sample template + +This tutorial will help you get started with StackSets using the AWS Management Console. It guides you through creating a StackSet using a sample template. You'll learn how to deploy stacks across multiple Regions, monitor StackSet operations, and view the results. + +In this tutorial, you'll create a StackSet that enables AWS Config in your AWS account within the US West (Oregon) Region (`us-west-2`) and US East (N. Virginia) Region (`us-east-1`). With StackSets, you can create, update, or delete stacks across multiple accounts and Regions with a single operation, making it an ideal solution for managing infrastructure at scale. While this tutorial uses a single account for simplicity, it effectively demonstrates the multi-region capabilities of StackSets. + +The sample template is available in the following S3 bucket: [https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/EnableAWSConfig.yml](https://s3.amazonaws.com/cloudformation-stackset-sample-templates-us-east-1/EnableAWSConfig.yml). + +###### Note + +StackSets is free, but you'll be charged for the AWS resources you create with it, such as AWS Config in this tutorial. For more information, see [AWS Config pricing](https://aws.amazon.com/config/pricing/). @@ -11 +21,318 @@ Before you create your first stack set, be sure that you have completed required - * [Create StackSets (self-managed permissions)](./stacksets-getting-started-create-self-managed.html) + * Prerequisites + + * Create a StackSet with self-managed permissions + + * Monitor StackSet creation + + * View StackSet results + + * Update your StackSet + + * Add stacks to your StackSet + + * Clean up + + * Next steps + + + + +## Prerequisites + +Before you begin this tutorial, make sure you have completed the following prerequisites: + + * You must have set up the required IAM roles for self-managed permissions. To create a StackSet and deploy stacks within a single account, you need the following roles in your account: + + * `AWSCloudFormationStackSetAdministrationRole` + + * `AWSCloudFormationStackSetExecutionRole` + +For detailed instructions on setting up these roles, see [Grant self-managed permissions](./stacksets-prereqs-self-managed.html). + + + + +## Create a StackSet with self-managed permissions + +###### To create a StackSet that enables AWS Config + + 1. Open the [CloudFormation console](https://console.aws.amazon.com/cloudformation/). + + 2. On the navigation bar at the top of the screen, choose the AWS Region that you want to manage the StackSet from. + +You can choose any Region that supports StackSets. The Region you select doesn't affect which Regions you can deploy to with your StackSet. + + 3. From the navigation pane, choose **StackSets**. + + 4. From the top of the **StackSets** page, choose **Create StackSet**. + + 5. Under **Permissions** , choose **Self-service permissions** and choose the IAM roles you created in the prerequisites. + + * For IAM admin role, choose **AWSCloudFormationStackSetAdministrationRole**. + + * For IAM execution role name, choose **AWSCloudFormationStackSetExecutionRole**. + + 6. Under **Prerequisite - Prepare template** , choose **Use a sample template**. + + 7. Under **Select a sample template** , choose the **Enable AWS Config** template. Then, choose **Next**. + +This template creates the necessary resources to enable AWS Config in your account, including a configuration recorder and delivery channel. + + 8. On the **Specify StackSet details** page, for **StackSet name** , enter `my-awsconfig-stackset`. + + 9. For **StackSet description** , enter `A StackSet that enables Config across multiple Regions`. + + 10. Under **Parameters** , configure the AWS Config settings as follows: + + 1. For **Support all resource types** , keep the default value, **true** , to record all supported resource types. + + 2. For **Include global resource types** , keep the default value, **false** , to exclude global resources like IAM roles. + + 3. Leave **List of resource types if not all supported** set to **< All>**. + + 4. For **The region containing the Config service-linked role resource** , replace **< DeployToAnyRegion>** with `us-west-2`. + +This means that the service-linked role named `AWSServiceRoleForConfig` will only be created if a stack is deployed to the US West (Oregon) Region. You'll choose the deployment Regions later in this procedure. + + 5. For **Configuration recorder recording frequency** , choose **DAILY** recording. + + 11. Choose **Next** to continue. + + 12. On the **Configure StackSet options** page, choose **Add new tag** and add a tag by specifying a key and value pair: + + 1. For **Key** , enter `Stage`. + + 2. For **Value** , enter `Test`. + +Tags that you apply to StackSets are applied to resources that are created by your stacks. + + 13. For **Execution configuration** , choose **Active** to enable CloudFormation's optimized operation handling: + + * Non-conflicting operations run concurrently for faster deployment times. + + * Conflicting operations are automatically queued and processed in the order they were requested. + +While operations are running or queued, CloudFormation queues all incoming operations even if they're non-conflicting. You can't change execution settings during this time. + + 14. Choose **Next**. + + 15. On the **Set deployment options** page, for **Add stacks to StackSet** , choose **Deploy new stacks**. + + 16. For **Accounts** , choose **Deploy stacks in accounts**. + + 17. In the text box, enter your AWS account ID. + + 18. For **Specify regions** , select the following Regions in this order: + + 1. US West (Oregon) Region (`us-west-2`) + + 2. US East (N. Virginia) Region (`us-east-1`) + +Use the up arrow next to US West (Oregon) Region to move it to be the first entry in the list if needed. The order of the Regions determines their deployment order. + + 19. For **Deployment options** , configure the following settings: + + 1. For **Maximum concurrent accounts** , keep the defaults of **Number** and **1**. + +For multi-account deployments, this setting means that CloudFormation deploys your stack in only one account at a time. + + 2. For **Failure tolerance** , keep the defaults of **Number** and **0**. + +This means that a maximum of zero stack deployments can fail in one of your specified Regions before CloudFormation stops deployment in the current Region and cancels deployments in remaining Regions. + + 3. For **Region concurrency** , choose **Sequential** (default). + +This setting ensures that CloudFormation completes deployments in one Region before moving to the next. + + 4. For **Concurrency mode** , keep the default of **Strict failure tolerance**. + +For multi-account deployments, this reduces the account concurrency level when failures occur, staying within **Failure tolerance** +1. + + 20. Choose **Next**. + + 21. On the **Review** page, review your choices. To make changes, choose **Edit** on the related section. + + 22. When you are ready to create your StackSet, choose **Submit**. + + + + +## Monitor StackSet creation + +After you choose **Submit** , CloudFormation begins creating your StackSet and deploying stacks to the specified Regions in your account. The StackSet details page opens automatically, where you can monitor the progress of the operation. + +###### To monitor the StackSet creation + + 1. On the StackSet details page, the **Operations** tab is displayed by default, showing the current operation in progress. + + 2. The operation status should be `RUNNING` initially. CloudFormation creates stacks in the Regions you specified according to the deployment options you configured. + + 3. To see more details about the operation, select the operation ID in the list. + + 4. On the operation details page, you can view the status of stack instances being created in each Region. + + 5. Wait for the operation status to change to `SUCCEEDED`, which indicates that the StackSet and all its stack instances were created successfully. + + + + +## View StackSet results + +After the StackSet creation is complete, you can view the deployed stack instances and verify that AWS Config has been enabled in your account across the specified Regions. + +###### To view the StackSet results + + 1. On the StackSet details page, choose the **Stack instances** tab. + + 2. You should see a list of stack instances that were created in your account across the specified Regions. Each stack instance should have a status of `SUCCEEDED`, indicating that it was successfully deployed. + + 3. To verify that AWS Config is enabled in your account, you can check the AWS Config console in each of the deployed Regions. + + + + +## Update your StackSet + +After creating your StackSet, you might want to update it to modify parameter values or add more Regions. This section shows you how to update the AWS Config recording frequency parameter. + +###### To update your StackSet