AWS cli medium security documentation change
Summary
Updated CLI version reference from 2.27.45 to 2.27.46; Added clarification that S3 static website URLs are not supported for template URLs; Updated documentation links for IAM and CloudWatch resources; Enhanced documentation for ImportExistingResources parameter
Security assessment
The addition of 'S3 static website URLs are not supported' clarifies secure template sourcing requirements. This prevents potential misuse of insecure S3 website endpoints (which might not enforce HTTPS), reducing risk of template tampering or interception. The change explicitly enforces HTTPS for S3 template sources, addressing a potential misconfiguration vector.
Diff
diff --git a/cli/latest/reference/cloudformation/create-change-set.md b/cli/latest/reference/cloudformation/create-change-set.md index 142332518..4bd9c5416 100644 --- a//cli/latest/reference/cloudformation/create-change-set.md +++ b//cli/latest/reference/cloudformation/create-change-set.md @@ -15 +15 @@ - * [AWS CLI 2.27.45 Command Reference](../../index.html) » + * [AWS CLI 2.27.46 Command Reference](../../index.html) » @@ -129 +129 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cloudf -> The URL of the file that contains the revised template. The URL must point to a template (max size: 1 MB) that’s located in an Amazon S3 bucket or a Systems Manager document. CloudFormation generates the change set by comparing this template with the stack that you specified. The location for an Amazon S3 bucket must start with `https://` . +> The URL of the file that contains the revised template. The URL must point to a template (max size: 1 MB) that’s located in an Amazon S3 bucket or a Systems Manager document. CloudFormation generates the change set by comparing this template with the stack that you specified. The location for an Amazon S3 bucket must start with `https://` . URLs from S3 static websites are not supported. @@ -194,8 +194,8 @@ JSON Syntax: ->> * [AWS::IAM::AccessKey](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-accesskey.html) ->> * [AWS::IAM::Group](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-group.html) ->> * [AWS::IAM::InstanceProfile](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-instanceprofile.html) ->> * [AWS::IAM::ManagedPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html) ->> * [AWS::IAM::Policy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html) ->> * [AWS::IAM::Role](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html) ->> * [AWS::IAM::User](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html) ->> * [AWS::IAM::UserToGroupAddition](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-usertogroupaddition.html) +>> * [AWS::IAM::AccessKey](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-accesskey.html) +>> * [AWS::IAM::Group](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-group.html) +>> * [AWS::IAM::InstanceProfile](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-instanceprofile.html) +>> * [AWS::IAM::ManagedPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-managedpolicy.html) +>> * [AWS::IAM::Policy](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-policy.html) +>> * [AWS::IAM::Role](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-role.html) +>> * [AWS::IAM::User](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html) +>> * [AWS::IAM::UserToGroupAddition](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-usertogroupaddition.html) @@ -288 +288 @@ Syntax: ->>>> The resource type of the rollback trigger. Specify either [AWS::CloudWatch::Alarm](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudwatch-alarm.html) or [AWS::CloudWatch::CompositeAlarm](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudwatch-compositealarm.html) resource types. +>>>> The resource type of the rollback trigger. Specify either [AWS::CloudWatch::Alarm](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-alarm.html) or [AWS::CloudWatch::CompositeAlarm](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-compositealarm.html) resource types. @@ -347 +347 @@ Syntax: ->>> _Required_ . A string containing the value for this tag. You can specify a maximum of 256 characters for a tag value. +>>> _Required_ . A string that contains the value for this tag. You can specify a maximum of 256 characters for a tag value. @@ -467 +467 @@ JSON Syntax: -> Indicates if the change set imports resources that already exist. +> Indicates if the change set auto-imports resources that already exist. For more information, see [Import Amazon Web Services resources into a CloudFormation stack automatically](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/import-resources-automatically.html) in the _CloudFormation User Guide_ . @@ -471 +471 @@ JSON Syntax: -> This parameter can only import resources that have custom names in templates. For more information, see [name type](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-name.html) in the _CloudFormation User Guide_ . To import resources that do not accept custom names, such as EC2 instances, use the resource import feature instead. For more information, see [Import Amazon Web Services resources into a CloudFormation stack with a resource import](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import.html) in the _CloudFormation User Guide_ . +> This parameter can only import resources that have custom names in templates. For more information, see [name type](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-name.html) in the _CloudFormation User Guide_ . To import resources that do not accept custom names, such as EC2 instances, use the `ResourcesToImport` parameter instead. @@ -619 +619 @@ StackId -> (string) - * [AWS CLI 2.27.45 Command Reference](../../index.html) » + * [AWS CLI 2.27.46 Command Reference](../../index.html) »