AWS AWSCloudFormation documentation change
Summary
Updated documentation for creating StackSets with service-managed permissions, including CLI examples, account filtering options, and clarified IAM role creation responsibility
Security assessment
The changes clarify IAM role creation by CloudFormation (rather than StackSets) and add documentation about account filtering options (INTERSECTION/DIFFERENCE/UNION) for precise deployment control. While these improve security awareness, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.md b/AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.md index ea209f9d2..2359aad65 100644 --- a//AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.md +++ b//AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.md @@ -5 +5 @@ -ConsiderationsCreate a stack set with service-managed permissions (console)Create a stack set with service-managed permissions (AWS CLI) +ConsiderationsCreate a StackSet with service-managed permissions (console)Create a StackSet with service-managed permissions (AWS CLI) @@ -7 +7 @@ ConsiderationsCreate a stack set with service-managed permissions (console)Creat -# Create CloudFormation StackSets with service-managed permissions +# Create AWS CloudFormation StackSets with service-managed permissions @@ -9 +9 @@ ConsiderationsCreate a stack set with service-managed permissions (console)Creat -With _service-managed_ permissions, you can deploy stacks to accounts managed by AWS Organizations in specific Regions. With this model, you don't need to create the necessary IAM roles; StackSets creates the IAM roles on your behalf. You can also enable automatic deployments to accounts that are added to a target organization or organizational unit (OU) in the future. With automatic deployments enabled, StackSets automatically deletes stacks from an account if it's removed from a target organization or OU. For more information, see [Activate trusted access](./stacksets-orgs-activate-trusted-access.html). +With _service-managed_ permissions, you can deploy stacks to accounts managed by AWS Organizations in specific Regions. With this model, you don't need to create the necessary IAM roles; CloudFormation creates the IAM roles on your behalf. For more information, see [Activate trusted access](./stacksets-orgs-activate-trusted-access.html). @@ -15 +15 @@ With _service-managed_ permissions, you can deploy stacks to accounts managed by - * Create a stack set with service-managed permissions (console) + * Create a StackSet with service-managed permissions (console) @@ -17 +17 @@ With _service-managed_ permissions, you can deploy stacks to accounts managed by - * Create a stack set with service-managed permissions (AWS CLI) + * Create a StackSet with service-managed permissions (AWS CLI) @@ -24 +24 @@ With _service-managed_ permissions, you can deploy stacks to accounts managed by -Before you create a stack set with service-managed permissions, consider the following: +Before you create a StackSet with service-managed permissions, consider the following: @@ -28 +28 @@ Before you create a stack set with service-managed permissions, consider the fol - * Your stack set can target your entire organization (includes all accounts) or specified organizational units (OUs). If your stack set targets a parent OU, it also targets any child OUs. When your stack set targets specific OUs, all accounts within those OUs are included by default. However, you can target specific accounts using account filter options. + * Your StackSet can target your entire organization (includes all accounts) or specified organizational units (OUs). If your StackSet targets a parent OU, it also targets any child OUs. When your StackSet targets specific OUs, all accounts within those OUs are included by default. However, you can target specific accounts using account filter options. @@ -32 +32 @@ Before you create a stack set with service-managed permissions, consider the fol - * Your stack set can't target accounts outside your organization. + * Your StackSet can't target accounts outside your organization. @@ -34 +34 @@ Before you create a stack set with service-managed permissions, consider the fol - * Your stack set can't deploy nested stacks. + * Your StackSet can't deploy nested stacks. @@ -36 +36 @@ Before you create a stack set with service-managed permissions, consider the fol - * StackSets doesn't deploy stacks to the organization's management account, even if the management account is in your organization or in an OU in your organization. + * CloudFormation doesn't deploy stacks to the organization's management account, even if the management account is in your organization or in an OU in your organization. @@ -38 +38 @@ Before you create a stack set with service-managed permissions, consider the fol - * Automatic deployment is set at the stack set level. You can't adjust automatic deployments selectively for OUs, accounts, or Regions. + * Automatic deployment is set at the StackSet level. You can't adjust automatic deployments selectively for OUs, accounts, or Regions. @@ -42 +42 @@ Before you create a stack set with service-managed permissions, consider the fol - * Delegated administrators have full permissions to deploy to accounts in your organization. The management account can't limit delegated administrator permissions to deploy to specific OUs or to perform specific stack set operations. + * Delegated administrators have full permissions to deploy to accounts in your organization. The management account can't limit delegated administrator permissions to deploy to specific OUs or to perform specific StackSet operations. @@ -47 +47,3 @@ Before you create a stack set with service-managed permissions, consider the fol -## Create a stack set with service-managed permissions (console) +## Create a StackSet with service-managed permissions (console) + +###### To create a StackSet @@ -51 +53 @@ Before you create a stack set with service-managed permissions, consider the fol - 2. On the navigation bar at the top of the screen, choose the AWS Region that you want to manage the stack set from. + 2. On the navigation bar at the top of the screen, choose the AWS Region that you want to manage the StackSet from. @@ -61 +63 @@ Before you create a stack set with service-managed permissions, consider the fol -If trusted access with AWS Organizations is disabled, a banner displays. Trusted access is required to create or update a stack set with service-managed permissions. Only the administrator in the organization's management account has permissions to [Activate trusted access for stack sets with AWS Organizations](./stacksets-orgs-activate-trusted-access.html). +If trusted access with AWS Organizations is disabled, a banner displays. Trusted access is required to create or update a StackSet with service-managed permissions. Only the administrator in the organization's management account has permissions to [Activate trusted access for StackSets with AWS Organizations](./stacksets-orgs-activate-trusted-access.html). @@ -67 +69 @@ If trusted access with AWS Organizations is disabled, a banner displays. Trusted - 8. On the **Specify StackSet details** page, provide a name for the stack set, specify any parameters, and then choose **Next**. + 8. On the **Specify StackSet details** page, provide a name for the StackSet, specify any parameters, and then choose **Next**. @@ -69 +71 @@ If trusted access with AWS Organizations is disabled, a banner displays. Trusted - 9. On the **Configure StackSet options** page, under **Tags** , specify any tags to apply to resources in your stack. + 9. On the **Configure StackSet options** page, under **Tags** , specify any tags to apply to resources in your stack. For more information about how tags are used in AWS, see [Organizing and tracking costs using AWS cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the _AWS Billing and Cost Management User Guide_. @@ -71 +73 @@ If trusted access with AWS Organizations is disabled, a banner displays. Trusted - 10. For **Execution configuration** , choose **Active** so that StackSets performs non-conflicting operations concurrently and queues conflicting operations. After conflicting operations finish, StackSets starts queued operations in request order. + 10. For **Execution configuration** , choose **Active** to enable CloudFormation's optimized operation handling: @@ -73 +75,3 @@ If trusted access with AWS Organizations is disabled, a banner displays. Trusted -###### Note + * Non-conflicting operations run concurrently for faster deployment times. + + * Conflicting operations are automatically queued and processed in the order they were requested. @@ -75 +79 @@ If trusted access with AWS Organizations is disabled, a banner displays. Trusted -When operations are running or queued, StackSets queues all incoming operations even if they're non-conflicting. You can't change execution settings during this time. +While operations are running or queued, CloudFormation queues all incoming operations even if they're non-conflicting. You can't change execution settings during this time. @@ -77 +81 @@ When operations are running or queued, StackSets queues all incoming operations - 11. Choose **Next** to proceed and to activate trusted access if not already activated. + 11. If your template contains IAM resources, for **Capabilities** , choose **I acknowledge that this template may create IAM resources** to specify that you want to use IAM resources in the template. For more information, see [Acknowledging IAM resources in CloudFormation templates](./control-access-with-iam.html#using-iam-capabilities). @@ -79 +83,3 @@ When operations are running or queued, StackSets queues all incoming operations - 12. On the **Set deployment options** page, under **Deployment targets** , do one of the following: + 12. Choose **Next** to proceed and to activate trusted access if not already activated. + + 13. On the **Set deployment options** page, under **Deployment targets** , do one of the following: @@ -85 +91 @@ When operations are running or queued, StackSets queues all incoming operations -If you chose **Deploy to organizational units (OUs)** , for **Account filter type** , you can set your deployment targets to be specific individual accounts by choosing one of the following options and providing account numbers. For more information, see [Account level targets for service-managed Stack Sets](./account-level-targets.html). +If you chose **Deploy to organizational units (OUs)** , for **Account filter type** , you can set your deployment targets to be specific individual accounts by choosing one of the following options and providing account numbers. @@ -95 +101 @@ If you chose **Deploy to organizational units (OUs)** , for **Account filter typ - 13. Under **Automatic deployment** , choose whether StackSets will automatically deploy to accounts that are added to the target organization or OUs in the future. For more information, see [Enable or disable automatic deployments for StackSets in AWS Organizations](./stacksets-orgs-manage-auto-deployment.html). + 14. Under **Automatic deployment** , choose whether to automatically deploy to accounts that are added to the target organization or OUs in the future. For more information, see [Enable or disable automatic deployments for StackSets in AWS Organizations](./stacksets-orgs-manage-auto-deployment.html). @@ -97 +103 @@ If you chose **Deploy to organizational units (OUs)** , for **Account filter typ - 14. If you enabled automatic deployment, under **Account removal behavior** , choose whether stack resources are retained or deleted when an account is removed from a target organization or OU. + 15. If you enabled automatic deployment, under **Account removal behavior** , choose whether stack resources are retained or deleted when an account is removed from a target organization or OU. @@ -101 +107 @@ If you chose **Deploy to organizational units (OUs)** , for **Account filter typ -With **Retain stacks** selected, stacks are removed from your stack set, but the stacks and their associated resources are retained. The resources stay in their current state, but will no longer be part of the stack set. +With **Retain stacks** selected, stacks are removed from your StackSet, but the stacks and their associated resources are retained. The resources stay in their current state, but will no longer be part of the StackSet. @@ -103 +109 @@ With **Retain stacks** selected, stacks are removed from your stack set, but the - 15. Under **Specify regions** , choose the Regions you want to deploy stacks in. + 16. Under **Specify regions** , choose the Regions you want to deploy stacks in. @@ -105 +111 @@ With **Retain stacks** selected, stacks are removed from your stack set, but the - 16. For **Deployment options** , do the following: + 17. For **Deployment options** , do the following: @@ -109 +115 @@ With **Retain stacks** selected, stacks are removed from your stack set, but the - * For **Failure tolerance** , specify how many failures are acceptable before the operation stops. + * For **Failure tolerance** , specify the maximum number of account failures allowed per Region. The operation will stop and won't proceed to other Regions once this limit is reached. @@ -115 +121 @@ With **Retain stacks** selected, stacks are removed from your stack set, but the - * **Strict failure tolerance** – Reduces concurrency level when failures occur, staying within **Failure tolerance** +1. + * **Strict failure tolerance** – Reduces account concurrency level when failures occur, staying within **Failure tolerance** +1. @@ -119 +125,3 @@ With **Retain stacks** selected, stacks are removed from your stack set, but the - 17. Choose **Next** to continue. + 18. Choose **Next** to continue. + + 19. On the **Review** page, verify that your StackSet will deploy to the correct accounts in the correct Regions, and then choose **Create StackSet**. @@ -121 +129 @@ With **Retain stacks** selected, stacks are removed from your stack set, but the - 18. On the **Review** page, verify that StackSets will deploy to the correct accounts in the correct Regions, and then choose **Create StackSet**. +The **StackSet details** page opens. You can view the progress and status of the creation of the stacks in your StackSet. @@ -123 +130,0 @@ With **Retain stacks** selected, stacks are removed from your stack set, but the -The **StackSet details** page opens. You can view the progress and status of the creation of the stacks in your stack set. @@ -126,0 +134 @@ The **StackSet details** page opens. You can view the progress and status of the +## Create a StackSet with service-managed permissions (AWS CLI) @@ -128 +136 @@ The **StackSet details** page opens. You can view the progress and status of the -## Create a stack set with service-managed permissions (AWS CLI) +Follow the steps in this section to use the AWS CLI to: @@ -130 +138 @@ The **StackSet details** page opens. You can view the progress and status of the -When you create StackSets using the AWS CLI, you run two separate commands. During **create-stack-set** , you upload your template, create the stack set container, and manage automatic deployments. During **create-stack-instances** , you create stacks in specific target accounts. + * Create the StackSet container. @@ -132 +140 @@ When you create StackSets using the AWS CLI, you run two separate commands. Duri -When acting as a delegated administrator, you must set the `--call-as` option to `DELEGATED_ADMIN` each time you run a stack set command. + * Deploy stack instances. @@ -135 +142,0 @@ When acting as a delegated administrator, you must set the `--call-as` option to - --call-as DELEGATED_ADMIN @@ -137 +143,0 @@ When acting as a delegated administrator, you must set the `--call-as` option to -StackSets created by a delegated administrator are created in the organization's management account. @@ -139 +145,6 @@ StackSets created by a delegated administrator are created in the organization's - 1. Use the [create-stack-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-set.html) CLI command. +###### Note + +When acting as a delegated administrator, you must include `--call-as DELEGATED_ADMIN` in the command. + +Deploy to your organization + @@ -141 +152,3 @@ StackSets created by a delegated administrator are created in the organization's -In the following example, we enable automatic deployments to allow StackSets to automatically deploy to accounts that are added to the target organization or OUs in the future. We retain stack resources when an account is removed from a target organization or OU. +###### To create a StackSet + + 1. Use the [create-stack-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-set.html) command to create a new StackSet named ``my-stackset``. The following example uses a template stored in an S3 bucket, enables automatic deployments, and preserves stacks when accounts are removed. For more information, see [Enable or disable automatic deployments for StackSets in AWS Organizations](./stacksets-orgs-manage-auto-deployment.html). @@ -145 +158 @@ In the following example, we enable automatic deployments to allow StackSets to - --template-url https://s3.us-west-2.amazonaws.com/cloudformation-templates-us-west-2/MyApp.template \ + --template-url https://s3.region-code.amazonaws.com/amzn-s3-demo-bucket/MyApp.template \ @@ -149 +162,44 @@ In the following example, we enable automatic deployments to allow StackSets to - 2. After your **create-stack-set** command is finished, run the [list-stack-sets](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-stack-sets.html) command to confirm that your stack set was created. Your new stack set is listed in the results. + 2. Use the [list-stack-sets](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-stack-sets.html) command to confirm that your StackSet was created. Your new StackSet is listed in the results. + + aws cloudformation list-stack-sets + + * If you set the `--call-as` option to `DELEGATED_ADMIN` while signed in to your member account, **list-stack-sets** returns all StackSets with service-managed permissions in the organization's management account. + + * If you set the `--call-as` option to `SELF` while signed in to your AWS account, **list-stack-sets** returns all self-managed StackSets in your AWS account. + + * If you set the `--call-as` option to `SELF` while signed in to the organization's management account, **list-stack-sets** returns all StackSets in the organization's management account. + + 3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stacks to your StackSet. For the `--deployment-targets` option, specify the organization root ID to deploy to all accounts in your organization. + +Set concurrent account processing and other deployment preferences using the `--operation-preferences` option. This example uses count-based settings. Note that `MaxConcurrentCount` must not exceed `FailureToleranceCount` \+ 1. For percentage-based settings, use `FailureTolerancePercentage` or `MaxConcurrentPercentage` instead. + + aws cloudformation create-stack-instances --stack-set-name my-stackset \ + --deployment-targets OrganizationalUnitIds=r-a1b2c3d4e5 \ + --regions us-west-2 us-east-1 \ + --operation-preferences MaxConcurrentCount=1,FailureToleranceCount=0 + +For more information, see [CreateStackInstances](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStackInstances.html) in the _AWS CloudFormation API Reference_. + + 4. Using the `operation-id` that was returned as part of the **create-stack-instances** output, use the following [describe-stack-set-operation](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-stack-set-operation.html) command to verify that your stacks were created successfully. + + aws cloudformation describe-stack-set-operation \ + --stack-set-name my-stackset \ + --operation-id operation_ID + + + + +Deploy to organizational units (OUs) + + +###### To create a StackSet + + 1. Use the [create-stack-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-set.html) command to create a new StackSet named ``my-stackset``. The following example uses a template stored in an S3 bucket and includes a parameter that sets a ``KeyPairName`` with the value ``TestKey`` + + aws cloudformation create-stack-set \ + --stack-set-name my-stackset \ + --template-url https://s3.region-code.amazonaws.com/amzn-s3-demo-bucket/MyApp.template \ + --permission-model SERVICE_MANAGED \ + --parameters ParameterKey=KeyPairName,ParameterValue=TestKey + + 2. Use the [list-stack-sets](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/list-stack-sets.html) command to confirm that your StackSet was created. Your new StackSet is listed in the results. @@ -159 +215 @@ In the following example, we enable automatic deployments to allow StackSets to - 3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stacks to your stack set. For the `--deployment-targets` option, specify the organization root ID to deploy to all accounts in your organization, or provide specific OU IDs to deploy to. In this example, we specify OUs with `ou-rcuk-1x5j1lwo` and `ou-rcuk-slr5lh0a` IDs. By default, stacks will be deployed to all accounts in the specified OU IDs. However, when you specify OU IDs, you can optionally target individual accounts for deployment instead. For more information, see [Account level targets for service-managed Stack Sets](./account-level-targets.html). + 3. Use the [create-stack-instances](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-stack-instances.html) command to add stacks to your StackSet. For the `--deployment-targets` option, specify the OU IDs to deploy to. @@ -164 +220 @@ Set concurrent account processing and other deployment preferences using the `-- - --deployment-targets OrganizationalUnitIds='["ou-rcuk-1x5j1lwo", "ou-rcuk-slr5lh0a"]' \ + --deployment-targets OrganizationalUnitIds=ou-rcuk-1x5j1lwo,ou-rcuk-slr5lh0a \ @@ -173 +229 @@ For more information, see [CreateStackInstances](https://docs.aws.amazon.com/AWS - --stack-set-name my-awsconfig-stackset \ + --stack-set-name my-stackset \ @@ -178,0 +235,36 @@ For more information, see [CreateStackInstances](https://docs.aws.amazon.com/AWS +Deploy to specific accounts in OUs + +