AWS AWSCloudFormation documentation change
Summary
Updated documentation for DeploymentTargets property to clarify requirements when using SERVICE_MANAGED vs SELF_MANAGED permissions, added details about AccountFilterType usage, and modified property requirements (changed OrganizationalUnitIds/Accounts from Conditional to No).
Security assessment
The changes improve documentation clarity around permission models and account selection logic, which helps prevent misconfigurations. However, there is no direct evidence of addressing a specific security vulnerability. The added guidance about AccountFilterType requirements and permission model constraints helps users implement more secure configurations by following best practices.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudformation-stackset-deploymenttargets.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-cloudformation-stackset-deploymenttargets.md index bf06f2638..ccde3fcff 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-cloudformation-stackset-deploymenttargets.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-cloudformation-stackset-deploymenttargets.md @@ -9 +9,17 @@ This is the new _AWS CloudFormation Template Reference Guide_. Please update you -The AWS`OrganizationalUnitIds` or `Accounts` for which to create stack instances in the specified Regions. +The AWS Organizations accounts or AWS accounts to deploy stacks to in the specified Regions. + +When deploying to AWS Organizations accounts with `SERVICE_MANAGED` permissions: + + * You must specify the `OrganizationalUnitIds` property. + + * If you specify organizational units (OUs) for `OrganizationalUnitIds` and use either the `Accounts` or `AccountsUrl` property, you must also specify the `AccountFilterType` property. + + + + +When deploying to AWS accounts with `SELF_MANAGED` permissions: + + * You must specify either the `Accounts` or `AccountsUrl` property, but not both. + + + @@ -42 +58 @@ To declare this entity in your AWS CloudFormation template, use the following sy -Limit deployment targets to individual accounts or include additional accounts with provided OUs. +Refines which accounts to deploy stacks to by specifying how to use the `Accounts` and `OrganizationalUnitIds` properties together. @@ -44 +60 @@ Limit deployment targets to individual accounts or include additional accounts w -The following is a list of possible values for the `AccountFilterType` operation. +The following values determine how CloudFormation selects target accounts: @@ -46 +62 @@ The following is a list of possible values for the `AccountFilterType` operation - * `INTERSECTION`: StackSet deploys to the accounts specified in the `Accounts` parameter. + * `INTERSECTION`: StackSet deploys to the accounts specified in the `Accounts` property. @@ -48 +64 @@ The following is a list of possible values for the `AccountFilterType` operation - * `DIFFERENCE`: StackSet deploys to the OU, excluding the accounts specified in the `Accounts` parameter. + * `DIFFERENCE`: StackSet deploys to the OU, excluding the accounts specified in the `Accounts` property. @@ -50 +66 @@ The following is a list of possible values for the `AccountFilterType` operation - * `UNION` StackSet deploys to the OU, and the accounts specified in the `Accounts` parameter. `UNION` is not supported for create operations when using StackSet as a resource. + * `UNION`: StackSet deploys to the OU, and the accounts specified in the `Accounts` property. `UNION` is not supported for create operations when using StackSet as a resource or the `CreateStackInstances` API. @@ -70 +86 @@ _Pattern_ : `^[0-9]{12}$` -_Required_ : Conditional +_Required_ : No @@ -82,0 +99,2 @@ The Amazon S3 URL path to a file that contains a list of AWS account IDs. The fi +This property serves the same purpose as `Accounts` but allows you to specify a large number of accounts. + @@ -102 +120 @@ _Pattern_ : `^(ou-[a-z0-9]{4,32}-[a-z0-9]{8,32}|r-[a-z0-9]{4,32})$` -_Required_ : Conditional +_Required_ : No