AWS cli medium security documentation change
Summary
Updated documentation version number, minor wording changes ('containing' to 'that contains'), added clarification that S3 static website URLs are not supported for stack policies, updated IAM resource links to TemplateReference URLs
Security assessment
The addition of 'URLs from S3 static websites are not supported' for stack policy URLs indicates a security control to prevent using potentially insecure HTTP endpoints (S3 static websites use HTTP URLs). This helps enforce HTTPS requirements for policy retrieval, mitigating risks of policy tampering during transmission.
Diff
diff --git a/cli/latest/reference/cloudformation/update-stack.md b/cli/latest/reference/cloudformation/update-stack.md index f2bfa80fb..8cfd7ab71 100644 --- a//cli/latest/reference/cloudformation/update-stack.md +++ b//cli/latest/reference/cloudformation/update-stack.md @@ -15 +15 @@ - * [AWS CLI 2.27.45 Command Reference](../../index.html) » + * [AWS CLI 2.27.46 Command Reference](../../index.html) » @@ -120 +120 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cloudf -> Structure containing the template body with a minimum length of 1 byte and a maximum length of 51,200 bytes. +> Structure that contains the template body with a minimum length of 1 byte and a maximum length of 51,200 bytes. @@ -126 +126 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cloudf -> The URL of a file containing the template body. The URL must point to a template that’s located in an Amazon S3 bucket or a Systems Manager document. The location for an Amazon S3 bucket must start with `https://` . +> The URL of a file that contains the template body. The URL must point to a template that’s located in an Amazon S3 bucket or a Systems Manager document. The location for an Amazon S3 bucket must start with `https://` . @@ -138 +138 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cloudf -> Structure containing the temporary overriding stack policy body. You can specify either the `StackPolicyDuringUpdateBody` or the `StackPolicyDuringUpdateURL` parameter, but not both. +> Structure that contains the temporary overriding stack policy body. You can specify either the `StackPolicyDuringUpdateBody` or the `StackPolicyDuringUpdateURL` parameter, but not both. @@ -144 +144,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/cloudf -> Location of a file containing the temporary overriding stack policy. The URL must point to a policy (max size: 16KB) located in an S3 bucket in the same Region as the stack. The location for an Amazon S3 bucket must start with `https://` . You can specify either the `StackPolicyDuringUpdateBody` or the `StackPolicyDuringUpdateURL` parameter, but not both. +> Location of a file that contains the temporary overriding stack policy. The URL must point to a policy (max size: 16KB) located in an S3 bucket in the same Region as the stack. The location for an Amazon S3 bucket must start with `https://` . URLs from S3 static websites are not supported. +> +> You can specify either the `StackPolicyDuringUpdateBody` or the `StackPolicyDuringUpdateURL` parameter, but not both. @@ -205,8 +207,8 @@ JSON Syntax: ->> * [AWS::IAM::AccessKey](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-accesskey.html) ->> * [AWS::IAM::Group](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-group.html) ->> * [AWS::IAM::InstanceProfile](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-instanceprofile.html) ->> * [AWS::IAM::ManagedPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-managedpolicy.html) ->> * [AWS::IAM::Policy](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-policy.html) ->> * [AWS::IAM::Role](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html) ->> * [AWS::IAM::User](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-user.html) ->> * [AWS::IAM::UserToGroupAddition](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-usertogroupaddition.html) +>> * [AWS::IAM::AccessKey](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-accesskey.html) +>> * [AWS::IAM::Group](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-group.html) +>> * [AWS::IAM::InstanceProfile](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-instanceprofile.html) +>> * [AWS::IAM::ManagedPolicy](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-managedpolicy.html) +>> * [AWS::IAM::Policy](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-policy.html) +>> * [AWS::IAM::Role](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-role.html) +>> * [AWS::IAM::User](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-user.html) +>> * [AWS::IAM::UserToGroupAddition](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-iam-usertogroupaddition.html) @@ -299 +301 @@ Syntax: ->>>> The resource type of the rollback trigger. Specify either [AWS::CloudWatch::Alarm](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudwatch-alarm.html) or [AWS::CloudWatch::CompositeAlarm](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudwatch-compositealarm.html) resource types. +>>>> The resource type of the rollback trigger. Specify either [AWS::CloudWatch::Alarm](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-alarm.html) or [AWS::CloudWatch::CompositeAlarm](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-compositealarm.html) resource types. @@ -334 +336 @@ JSON Syntax: -> Structure containing a new stack policy body. You can specify either the `StackPolicyBody` or the `StackPolicyURL` parameter, but not both. +> Structure that contains a new stack policy body. You can specify either the `StackPolicyBody` or the `StackPolicyURL` parameter, but not both. @@ -340 +342,3 @@ JSON Syntax: -> Location of a file containing the updated stack policy. The URL must point to a policy (max size: 16KB) located in an S3 bucket in the same Region as the stack. The location for an Amazon S3 bucket must start with `https://` . You can specify either the `StackPolicyBody` or the `StackPolicyURL` parameter, but not both. +> Location of a file that contains the updated stack policy. The URL must point to a policy (max size: 16KB) located in an S3 bucket in the same Region as the stack. The location for an Amazon S3 bucket must start with `https://` . URLs from S3 static websites are not supported. +> +> You can specify either the `StackPolicyBody` or the `StackPolicyURL` parameter, but not both. @@ -372 +376 @@ Syntax: ->>> _Required_ . A string containing the value for this tag. You can specify a maximum of 256 characters for a tag value. +>>> _Required_ . A string that contains the value for this tag. You can specify a maximum of 256 characters for a tag value. @@ -555 +559 @@ StackId -> (string) - * [AWS CLI 2.27.45 Command Reference](../../index.html) » + * [AWS CLI 2.27.46 Command Reference](../../index.html) »