AWS AWSCloudFormation documentation change
Summary
Updated IAM permissions list, added GlobalTableWitnesses property, added MultiRegionConsistency property with STRONG/EVENTUAL modes, and updated replica management documentation
Security assessment
The changes introduce documentation for Multi-Region Strong Consistency (MRSC) and witness regions, which improves data consistency guarantees but doesn't address a specific vulnerability. While strong consistency can have security implications for data integrity, there's no evidence this change fixes a security issue.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-dynamodb-globaltable.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-dynamodb-globaltable.md index 29454d5c3..fc09d8b93 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-dynamodb-globaltable.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-dynamodb-globaltable.md @@ -21 +21 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:CreateTable` + * `application-autoscaling:DeleteScalingPolicy` @@ -23 +23 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:UpdateTable` + * `application-autoscaling:DeleteScheduledAction` @@ -25 +25 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:DeleteTable` + * `application-autoscaling:DeregisterScalableTarget` @@ -27 +27 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:DescribeContinuousBackups` + * `application-autoscaling:DescribeScalableTargets` @@ -29 +29 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:DescribeContributorInsights` + * `application-autoscaling:DescribeScalingPolicies` @@ -31 +31 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:DescribeTable` + * `application-autoscaling:PutScalingPolicy` @@ -33 +33 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:DescribeTableReplicaAutoScaling` + * `application-autoscaling:PutScheduledAction` @@ -35 +35 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:DescribeTimeToLive` + * `application-autoscaling:RegisterScalableTarget` @@ -37 +37 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:ListTables` + * `dynamodb:BatchWriteItem` @@ -39 +39 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:UpdateTimeToLive` + * `dynamodb:CreateGlobalTableWitness` @@ -41 +41 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:UpdateContributorInsights` + * `dynamodb:CreateTable` @@ -43 +43 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:UpdateContinuousBackups` + * `dynamodb:CreateTableReplica` @@ -45 +45 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:ListTagsOfResource` + * `dynamodb:DeleteGlobalTableWitness` @@ -47 +47 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:TagResource` + * `dynamodb:DeleteItem` @@ -49 +49 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:UntagResource` + * `dynamodb:DeleteTable` @@ -51 +51 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:BatchWriteItem` + * `dynamodb:DeleteTableReplica` @@ -53 +53 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:CreateTableReplica` + * `dynamodb:DescribeContinuousBackups` @@ -55 +55 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:DeleteItem` + * `dynamodb:DescribeContributorInsights` @@ -57 +57,5 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:DeleteTableReplica` + * `dynamodb:DescribeTable` + + * `dynamodb:DescribeTableReplicaAutoScaling` + + * `dynamodb:DescribeTimeToLive` @@ -64,0 +69,4 @@ You should be aware of the following behaviors when working with DynamoDB global + * `dynamodb:ListTables` + + * `dynamodb:ListTagsOfResource` + @@ -71,7 +79 @@ You should be aware of the following behaviors when working with DynamoDB global - * `dynamodb:UpdateItem` - - * `dynamodb:DescribeTableReplicaAutoScaling` - - * `dynamodb:UpdateTableReplicaAutoScaling` - - * `iam:CreateServiceLinkedRole` + * `dynamodb:TagResource` @@ -79 +81 @@ You should be aware of the following behaviors when working with DynamoDB global - * `kms:CreateGrant` + * `dynamodb:UntagResource` @@ -81 +83 @@ You should be aware of the following behaviors when working with DynamoDB global - * `kms:DescribeKey` + * `dynamodb:UpdateContinuousBackups` @@ -83 +85 @@ You should be aware of the following behaviors when working with DynamoDB global - * `application-autoscaling:DeleteScalingPolicy` + * `dynamodb:UpdateContributorInsights` @@ -85 +87 @@ You should be aware of the following behaviors when working with DynamoDB global - * `application-autoscaling:DeleteScheduledAction` + * `dynamodb:UpdateItem` @@ -87 +89 @@ You should be aware of the following behaviors when working with DynamoDB global - * `application-autoscaling:DeregisterScalableTarget` + * `dynamodb:UpdateTable` @@ -89 +91 @@ You should be aware of the following behaviors when working with DynamoDB global - * `application-autoscaling:DescribeScalingPolicies` + * `dynamodb:UpdateTableReplicaAutoScaling` @@ -91 +93 @@ You should be aware of the following behaviors when working with DynamoDB global - * `application-autoscaling:DescribeScalableTargets` + * `dynamodb:UpdateTimeToLive` @@ -93 +95 @@ You should be aware of the following behaviors when working with DynamoDB global - * `application-autoscaling:PutScalingPolicy` + * `iam:CreateServiceLinkedRole` @@ -95 +97 @@ You should be aware of the following behaviors when working with DynamoDB global - * `application-autoscaling:PutScheduledAction` + * `kms:CreateGrant` @@ -97 +99 @@ You should be aware of the following behaviors when working with DynamoDB global - * `application-autoscaling:RegisterScalableTarget` + * `kms:DescribeKey` @@ -120,0 +123 @@ To declare this entity in your AWS CloudFormation template, use the following sy + "GlobalTableWitnesses" : [ [GlobalTableWitness](./aws-properties-dynamodb-globaltable-globaltablewitness.html), ... ], @@ -122,0 +126 @@ To declare this entity in your AWS CloudFormation template, use the following sy + "MultiRegionConsistency" : String, @@ -144,0 +149,2 @@ To declare this entity in your AWS CloudFormation template, use the following sy + GlobalTableWitnesses: + - [GlobalTableWitness](./aws-properties-dynamodb-globaltable-globaltablewitness.html) @@ -148,0 +155 @@ To declare this entity in your AWS CloudFormation template, use the following sy + MultiRegionConsistency: String @@ -215,0 +223,15 @@ _Required_ : No +`GlobalTableWitnesses` + + +The list of witnesses of the MRSC global table. Only one witness Region can be configured per MRSC global table. + +_Required_ : No + + _Type_ : Array of [GlobalTableWitness](./aws-properties-dynamodb-globaltable-globaltablewitness.html) + + _Minimum_ : `1` + + _Maximum_ : `1` + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + @@ -241,0 +264,24 @@ _Required_ : No +`MultiRegionConsistency` + + +Specifies the consistency mode for a new global table. + +You can specify one of the following consistency modes: + + * `EVENTUAL`: Configures a new global table for multi-Region eventual consistency (MREC). + + * `STRONG`: Configures a new global table for multi-Region strong consistency (MRSC). + + + + +If you don't specify this field, the global table consistency mode defaults to `EVENTUAL`. For more information about global tables consistency modes, see [ Consistency modes](https://docs.aws.amazon.com/V2globaltables_HowItWorks.html#V2globaltables_HowItWorks.consistency-modes) in DynamoDB developer guide. + +_Required_ : No + + _Type_ : String + + _Allowed values_ : `EVENTUAL | STRONG` + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + @@ -253 +299 @@ If you add or delete a replica during an update, we recommend that you don't upd -You can create a new global table with as many replicas as needed. You can add or remove replicas after table creation, but you can only add or remove a single replica in each update. +You can create a new global table with as many replicas as needed. You can add or remove replicas after table creation, but you can only add or remove a single replica in each update. For Multi-Region Strong Consistency (MRSC), you can add or remove up to 3 replicas, or 2 replicas plus a witness Region. @@ -277 +323 @@ _Required_ : No -Specifies the streams settings on your global table. You must provide a value for this property if your global table contains more than one replica. You can only change the streams settings if your global table has only one replica. +Specifies the streams settings on your global table. You must provide a value for this property if your global table contains more than one replica. You can only change the streams settings if your global table has only one replica. For Multi-Region Strong Consistency (MRSC), you do not need to provide a value for this property and can change the settings at any time.