AWS AWSCloudFormation documentation change
Summary
Restructured documentation by removing detailed concept explanations and replacing with links to dedicated pages. Changed terminology capitalization (StackSet -> StackSet) and simplified the table of contents.
Security assessment
The changes are organizational/structural improvements to documentation navigation and terminology consistency. No security vulnerabilities, mitigations, or security feature enhancements are introduced. The 'Prevent failed StackSets deployments using target account gates' link existed in both versions.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.md b/AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.md index fa7b4ade7..1b08dd6b8 100644 --- a//AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.md +++ b//AWSCloudFormation/latest/UserGuide/what-is-cfnstacksets.md @@ -5,2 +4,0 @@ -StackSets concepts - @@ -11 +9 @@ AWS CloudFormation StackSets extends the capability of stacks by allowing you to - + @@ -13 +11 @@ AWS CloudFormation StackSets extends the capability of stacks by allowing you to -This section helps you get started using StackSets, and answers common questions about how to work with and troubleshoot stack set creation, updates, and deletion. +This section helps you get started using StackSets, and answers common questions about how to work with and troubleshoot StackSet creation, updates, and deletion. @@ -17,137 +15 @@ This section helps you get started using StackSets, and answers common questions - * StackSets concepts - - * [Prerequisites for using CloudFormation StackSets](./stacksets-prereqs.html) - - * [CloudFormation StackSets operations](./stacksets-getting-started.html) - - * [Configuring a target account gate in StackSets](./stacksets-account-gating.html) - - * [Choose the Concurrency Mode for CloudFormation StackSets](./concurrency-mode.html) - - * [Performing drift detection on CloudFormation StackSets](./stacksets-drift.html) - - * [Import stacks into CloudFormation StackSets](./stacksets-import.html) - - * [Account level targets for service-managed Stack Sets](./account-level-targets.html) - - * [Best practices for using AWS CloudFormation StackSets](./stacksets-bestpractices.html) - - * [AWS CloudFormation StackSets sample templates](./stacksets-sampletemplates.html) - - * [Troubleshooting AWS CloudFormation StackSets](./stacksets-troubleshooting.html) - - - - -## StackSets concepts - -When you use StackSets, you work with _stack sets_ , _stack instances_ , and _stacks_. - -###### Contents - - * [Administrator and target accounts](./what-is-cfnstacksets.html#stacksets-concepts-accts) - - * [AWS CloudFormation StackSets](./what-is-cfnstacksets.html#stacksets-concepts-stackset) - - * [Permission models for stack sets](./what-is-cfnstacksets.html#stacksets-concepts-stackset-permission-models) - - * [Stack instances](./what-is-cfnstacksets.html#stacksets-concepts-stackinstances) - - * [Stack set operations](./what-is-cfnstacksets.html#stacksets-concepts-ops) - - * [Stack set operation options](./what-is-cfnstacksets.html#stackset-ops-options) - - * [Tags](./what-is-cfnstacksets.html#stackset-concepts-tags) - - * [StackSets status codes](./what-is-cfnstacksets.html#stackset-status-codes) - - * [Stack instance status codes](./what-is-cfnstacksets.html#stack-instance-status-codes) - - - - -### Administrator and target accounts - -An _administrator account_ is the AWS account in which you create stack sets. For stack sets with service-managed permissions, the administrator account is either the organization's management account or a delegated administrator account. You can manage a stack set by signing in to the AWS administrator account that created the stack set. - -A _target account_ is the account into which you create, update, or delete one or more stacks in your stack set. Before you can use a stack set to create stacks in a target account, set up a trust relationship between the administrator and target accounts. - -### AWS CloudFormation StackSets - -A _stack set_ lets you create stacks in AWS accounts across regions by using a single CloudFormation template. A stack set's CloudFormation template defines all the resources in each stack. As you create the stack set, specify the template to use, in addition to any parameters and capabilities that template requires. - -After you've defined a stack set, you can create, update, or delete stacks in the target accounts and AWS Regions you specify. When you create, update, or delete stacks, you can also specify operation preferences. For example, include the order of Regions you want to perform the operation, the failure tolerance threshold before stack operations stop, and the number of accounts performing stack operations concurrently. - -A stack set is a regional resource. If you create a stack set in one AWS Region, you can only see or change it when viewing that Region. - -### Permission models for stack sets - -You can create stack sets using either _self-managed_ permissions or _service-managed_ permissions. - -With _self-managed_ permissions, you create the IAM roles required by StackSets to deploy across accounts and Regions. These roles are necessary to establish a trusted relationship between the account you're administering the stack set from and the account you're deploying stack instances to. Using this permissions model, StackSets can deploy to any AWS account in which you have permissions to create an IAM role. - -With _service-managed_ permissions, you can deploy stack instances to accounts managed by AWS Organizations. Using this permissions model, you don't have to create the necessary IAM roles; StackSets creates the IAM roles on your behalf. With this model, you can also turn on automatic deployments to accounts that you add to your organization in the future. - -AWS Organizations integrates with CloudFormation and helps you centrally manage and govern your environment as you scale and grow your AWS resources. - - * Management account – the account that you use to create the organization. For more information, see [Terminology and concepts for AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html). - - * Delegated administrator – a compatible AWS service can register an AWS member account in the organization as an administrator for the organization's accounts in that service. For more information, see [AWS services that you can use with AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_integrate_services_list.html). - - - - -For more information about creating and managing stack sets with service-managed permissions, see the following topics: - - * [Activate trusted access for stack sets with AWS Organizations](./stacksets-orgs-activate-trusted-access.html) - - * [Register a delegated administrator member account](./stacksets-orgs-delegated-admin.html) - - * [Create CloudFormation StackSets with service-managed permissions](./stacksets-orgs-associate-stackset-with-org.html) - - - - -### Stack instances - -A _stack instance_ is a reference to a stack in a target account within a Region. A stack instance can exist without a stack. For example, if the stack couldn't be created for some reason, the stack instance shows the reason for stack creation failure. A stack instance associates with only one stack set. - -The following figure shows the logical relationships between stack sets, stack operations, and stacks. When you update a stack set, _all_ associated stack instances update throughout all accounts and Regions. - - - -### Stack set operations - -You can perform the following operations on stack sets. - -Create stack set - - -Creating a new stack set includes specifying a CloudFormation template that you want to use to create stacks, specifying the target accounts in which you want to create stacks, and identifying the AWS Regions in which you want to deploy stacks in your target accounts. A stack set ensures consistent deployment of the same stack resources, with the same settings, to all specified target accounts within the Regions you choose. - -Update stack set - - -When you update a stack set, you push changes out to stacks in your stack set. You can update a stack set in one of the following ways. Your template updates always affect all stacks; you can't selectively update the template for some stacks in the stack set, but not others. - - * Change existing settings in the template or add new resources, such as updating parameter settings for a specific service, or adding new Amazon EC2 instances. - - * Replace the template with a different template. - - * Add stacks in existing or additional target accounts, across existing or additional Regions. - - - - -Delete stacks - - -When you delete stacks, you are removing a stack and all its associated resources from the target accounts you specify, within the Regions you specify. You can delete stacks in the following ways. - - * Delete stacks from some target accounts, while leaving other stacks in other target accounts running. - - * Delete stacks from some Regions, while leaving stacks in other Regions running. - - * Delete stacks from your stack set, but save them so they continue to run independently of your stack set by choosing the **Retain Stacks** option. You can then manage retained stacks outside of your stack set in AWS CloudFormation. - - * Delete all stacks in your stack set, in preparation for deleting your entire stack set. + * [StackSets concepts](./stacksets-concepts.html) @@ -154,0 +17 @@ When you delete stacks, you are removing a stack and all its associated resource + * [Prerequisites for using AWS CloudFormation StackSets](./stacksets-prereqs.html) @@ -155,0 +19 @@ When you delete stacks, you are removing a stack and all its associated resource + * [Get started with StackSets using a sample template](./stacksets-getting-started.html) @@ -156,0 +21 @@ When you delete stacks, you are removing a stack and all its associated resource + * [Create AWS CloudFormation StackSets with self-managed permissions](./stacksets-getting-started-create-self-managed.html) @@ -158 +23 @@ When you delete stacks, you are removing a stack and all its associated resource -Delete stack set + * [Create AWS CloudFormation StackSets with service-managed permissions](./stacksets-orgs-associate-stackset-with-org.html) @@ -159,0 +25 @@ Delete stack set + * [Enable or disable automatic deployments for StackSets in AWS Organizations](./stacksets-orgs-manage-auto-deployment.html) @@ -161 +27 @@ Delete stack set -You can delete your stack set only when there are no stack instances in it. + * [Update AWS CloudFormation StackSets](./stacksets-update.html) @@ -163 +29 @@ You can delete your stack set only when there are no stack instances in it. -### Stack set operation options + * [Add stacks to CloudFormation StackSets](./stackinstances-create.html) @@ -165 +31 @@ You can delete your stack set only when there are no stack instances in it. -The options described in this section help to control the time and number of failures allowed to perform successful stack set operations, and prevent you from losing stack resources. + * [Override parameter values on stacks within your CloudFormation StackSet](./stackinstances-override.html) @@ -167 +33 @@ The options described in this section help to control the time and number of fai -Maximum concurrent accounts + * [Delete stacks from AWS CloudFormation StackSets ](./stackinstances-delete.html) @@ -168,0 +35 @@ Maximum concurrent accounts + * [Delete AWS CloudFormation StackSets](./stacksets-delete.html) @@ -170 +37 @@ Maximum concurrent accounts -This setting, available in create, update, and delete workflows, lets you specify the maximum number or percentage of target accounts in which an operation performs at one time. A lower number or percentage means that an operation performs in fewer target accounts at one time. Operations perform in one Region at a time, in the order specified in the **Deployment order** box. For example, if you are deploying stacks to 10 target accounts within two Regions, setting **Maximum concurrent accounts** to **50** and **By percentage** deploys stacks to five accounts in the first Region, then the second five accounts within the first Region, before moving on to the next Region and beginning deployment to the first five target accounts. + * [Prevent failed StackSets deployments using target account gates](./stacksets-account-gating.html) @@ -172,132 +39 @@ This setting, available in create, update, and delete workflows, lets you specif -When you choose **By percentage** , if the specified percentage doesn't represent a whole number of your specified accounts, CloudFormation rounds down. For example, if you are deploying stacks to 10 target accounts, and you set **Maximum concurrent accounts** to **25** and **By percentage** , CloudFormation rounds down from deploying 2.5 stacks concurrently (which would not be possible) to deploying two stacks concurrently. - -Note that this setting lets you specify the _maximum_ for operations. For large deployments, under certain circumstances the actual number of accounts acted upon concurrently may be lower due to service throttling. - -**Maximum concurrent accounts** can depend on the value of **Failure tolerance** depending on your **Concurrency Mode**. If your **Concurrency Mode** is set to **Strict Failure Tolerance** then **Maximum concurrent accounts** can be at most one more than the **Failure tolerance** setting. - -Concurrency mode - - -This setting, available in create, update, and delete workflows, lets you choose how the concurrency level behaves during stack set operations. For more information, see [Choose the Concurrency Mode for CloudFormation StackSets](./concurrency-mode.html). - -Failure tolerance - - -This setting, available in create, update, and delete workflows, lets you specify the maximum number or percentage of stack operation failures that can occur, per Region, beyond which CloudFormation stops an operation automatically. A lower number or percentage means that the operation performs on fewer stacks, but you are able to start troubleshooting failed operations faster. For example, if you are updating 10 stacks in 10 target accounts within three Regions, setting **Failure tolerance** to **20** and **By percentage** means that a maximum of two stack updates in a Region can fail for the operation to continue. If a third stack in the same Region fails, CloudFormation stops the operation. If a stack can't update in the first Region, the update operation continues in that Region, and then moves on to the next Region. If two stacks can't update in the second Region, the failure tolerance reaches 20%; if a third stack in the Region fails, CloudFormation stops the update operation, and doesn't go on to subsequent Regions. - -When you choose **By percentage** , if the specified percentage doesn't represent a whole number of your stacks within each Region, CloudFormation rounds down. For example, if you are deploying stacks to 10 target accounts in three Regions, and you set **Failure tolerance** to **25** and **By percentage** , CloudFormation rounds down from a failure tolerance of 2.5 stacks (which would not be possible) to a failure tolerance of two stacks per Region. - -Retain stacks