AWS AWSCloudFormation documentation change
Summary
Updated documentation structure and wording for condition functions, consolidated sample template sections, removed detailed security parameter example
Security assessment
The changes primarily restructure documentation and fix grammatical inconsistencies. While a detailed example showing NoEcho usage for sensitive parameters was removed, this appears to be content reorganization rather than addressing a security vulnerability. The remaining text still contains security recommendations about not embedding credentials.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.md b/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.md index 0d2b857f5..6fd708ffd 100644 --- a//AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.md +++ b//AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-conditions.md @@ -3 +3 @@ -Fn::AndFn::EqualsFn::IfFn::NotFn::OrSupported functionsSample templates +Fn::AndFn::EqualsFn::IfFn::NotFn::OrSupported functionsSample template @@ -17 +17 @@ If you're new to using conditions in your templates, we recommend you first revi -You must define all conditions in the `Conditions` section of a template, except for `Fn::If` conditions. You can use the `Fn::If` condition in the `Metadata` attribute, `UpdatePolicy` attribute, and property values within the `Resources` and `Outputs` sections. +You must define all conditions in the `Conditions` section of a template, except for `Fn::If` conditions. You can use the `Fn::If` condition in the `Metadata` attribute, `UpdatePolicy` attribute, and property values in the `Resources` and `Outputs` sections. @@ -33 +33 @@ You must define all conditions in the `Conditions` section of a template, except - * Sample templates + * Sample template @@ -141 +141 @@ The following `IsProduction` condition evaluates to true if the value for the `E -Returns one value if the specified condition evaluates to `true` and another value if the specified condition evaluates to `false`. Currently, CloudFormation supports the `Fn::If` intrinsic function in the metadata attribute, update policy attribute, and property values in the `Resources` section and `Outputs` sections of a template. You can use the `AWS::NoValue` pseudo parameter as a return value to remove the corresponding property. +Returns one value if the specified condition evaluates to `true` and another value if the specified condition evaluates to `false`. Currently, CloudFormation supports the `Fn::If` intrinsic function in the `Metadata` attribute, `UpdatePolicy` attribute, and property values in the `Resources` section and `Outputs` sections of a template. You can use the `AWS::NoValue` pseudo parameter as a return value to remove the corresponding property. @@ -518,7 +518 @@ You can use the following functions in all other condition functions, such as `F -## Sample templates - -###### Topics - - * Conditionally create resources for a production, development, or test stack - - * Conditionally assign a resource property +## Sample template @@ -525,0 +520 @@ You can use the following functions in all other condition functions, such as `F +### Conditionally create resources for a production, development, or test stack @@ -526,0 +522 @@ You can use the following functions in all other condition functions, such as `F +In some cases, you might want to create stacks that are similar but with minor tweaks. For example, you might have a template that you use for production applications. You want to create the same production stack so that you can use it for development or testing. However, for development and testing, you might not require all the extra capacity that's included in a production-level stack. Instead, you can use an environment type input parameter to conditionally create stack resources that are specific to production, development, or testing, as shown in the following sample: @@ -527,0 +524 @@ You can use the following functions in all other condition functions, such as `F +You can specify `prod`, `dev`, or `test` for the `EnvType` parameter. For each environment type, the template specifies a different instance type. The instance types can range from a large, compute-optimized instance type to a small general purpose instance type. In order to conditionally specify the instance type, the template defines two conditions in the `Conditions` section of the template: `CreateProdResources`, which evaluates to true if the `EnvType` parameter value is equal to `prod` and `CreateDevResources`, which evaluates to true if the parameter value is equal to `dev`. @@ -529 +526 @@ You can use the following functions in all other condition functions, such as `F -### Conditionally create resources for a production, development, or test stack +In the `InstanceType` property, the template nests two `Fn::If` intrinsic functions to determine which instance type to use. If the `CreateProdResources` condition is true, the instance type is `c5.xlarge`. If the condition is false, the `CreateDevResources` condition is evaluated. If the `CreateDevResources` condition is true, the instance type is `t3.medium` or else the instance type is `t3.small`. @@ -531 +528 @@ You can use the following functions in all other condition functions, such as `F -In some cases, you might want to create stacks that are similar but with minor tweaks. For example, you might have a template that you use for production applications. You want to create the same production stack so that you can use it for development or testing. However, for development and testing, you might not require all the extra capacity that's included in a production-level stack. Instead, you can use an environment type input parameter to conditionally create stack resources that are specific to production, development, or testing, as shown in the following sample: +In addition to the instance type, the production environment creates and attaches an Amazon EC2 volume to the instance. The `MountPoint` and `NewVolume` resources are associated with the `CreateProdResources` condition so that the resources are created only if the condition evaluates to true. @@ -621,149 +618 @@ In some cases, you might want to create stacks that are similar but with minor t -You can specify `prod`, `dev`, or `test` for the `EnvType` parameter. For each environment type, the template specifies a different instance type. The instance types can range from a large, compute-optimized instance type to a small general purpose instance type. In order to conditionally specify the instance type, the template defines two conditions in the `Conditions` section of the template: `CreateProdResources`, which evaluates to true if the `EnvType` parameter value is equal to `prod` and `CreateDevResources`, which evaluates to true if the parameter value is equal to `dev`. - -In the `InstanceType` property, the template nests two `Fn::If` intrinsic functions to determine which instance type to use. If the `CreateProdResources` condition is true, the instance type is `c5.xlarge`. If the condition is false, the `CreateDevResources` condition is evaluated. If the `CreateDevResources` condition is true, the instance type is `t3.medium` or else the instance type is `t3.small`. - -In addition to the instance type, the production environment creates and attaches an Amazon EC2 volume to the instance. The `MountPoint` and `NewVolume` resources are associated with the `CreateProdResources` condition so that the resources are created only if the condition evaluates to true. - -### Conditionally assign a resource property - -In this example, you can create an Amazon RDS DB instance from a snapshot. If you specify the `DBSnapshotName` parameter, CloudFormation uses the parameter value as the snapshot name when creating the DB instance. If you keep the default value (empty string), CloudFormation removes the `DBSnapshotIdentifier` property and creates a DB instance from scratch. - -The example defines the `DBUser` and `DBPassword` parameters with their `NoEcho` property set to `true`. If you set the `NoEcho` attribute to `true`, CloudFormation returns the parameter value masked as asterisks (*****) for any calls that describe the stack or stack events, except for information stored in the locations specified below. - -###### Important - -Using the `NoEcho` attribute does not mask any information stored in the following: - - * The `Metadata` template section. CloudFormation does not transform, modify, or redact any information you include in the `Metadata` section. For more information, see [Metadata](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html). - - * The `Outputs` template section. For more information, see [Outputs](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/outputs-section-structure.html). - - * The `Metadata` attribute of a resource definition. For more information, see [`Metadata` attribute](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-attribute-metadata.html). - - - - -We strongly recommend you do not use these mechanisms to include sensitive information, such as passwords or secrets. - -###### Important - -Rather than embedding sensitive information directly in your CloudFormation templates, we recommend you use dynamic parameters in the stack template to reference sensitive information that is stored and managed outside of CloudFormation, such as in the AWS Systems Manager Parameter Store or AWS Secrets Manager. - -For more information, see the [Do not embed credentials in your templates](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/security-best-practices.html#creds) best practice. - -###### Example JSON - - - { - "AWSTemplateFormatVersion" : "2010-09-09", - "Parameters": { - "DBUser": { - "NoEcho": "true", - "Description" : "The database admin account username", - "Type": "String", - "MinLength": "1", - "MaxLength": "16", - "AllowedPattern" : "[a-zA-Z][a-zA-Z0-9]*", - "ConstraintDescription" : "must begin with a letter and contain only alphanumeric characters." - }, - "DBPassword": { - "NoEcho": "true", - "Description" : "The database admin account password", - "Type": "String", - "MinLength": "1", - "MaxLength": "41", - "AllowedPattern" : "[a-zA-Z0-9]*", - "ConstraintDescription" : "must contain only alphanumeric characters." - }, - "DBSnapshotName": { - "Description": "The name of a DB snapshot (optional)", - "Default": "", - "Type": "String" - } - }, - "Conditions": { - "UseDBSnapshot": {"Fn::Not": [{"Fn::Equals" : [{"Ref" : "DBSnapshotName"}, ""]}]} - }, - "Resources" : { - "MyDB" : { - "Type" : "AWS::RDS::DBInstance", - "Properties" : { - "AllocatedStorage" : "5", - "DBInstanceClass" : "db.t2.small", - "Engine" : "MySQL", - "EngineVersion" : "5.5", - "MasterUsername" : { "Ref" : "DBUser" }, - "MasterUserPassword" : { "Ref" : "DBPassword" }, - "DBParameterGroupName" : { "Ref" : "MyRDSParamGroup" }, - "DBSnapshotIdentifier" : { - "Fn::If" : [ - "UseDBSnapshot", - {"Ref" : "DBSnapshotName"}, - {"Ref" : "AWS::NoValue"} - ] - } - } - }, - "MyRDSParamGroup" : { - "Type": "AWS::RDS::DBParameterGroup", - "Properties" : { - "Family" : "MySQL5.5", - "Description" : "CloudFormation Sample Database Parameter Group", - "Parameters" : { - "autocommit" : "1" , - "general_log" : "1", - "old_passwords" : "0" - } - } - } - } - } - -###### Example YAML - - - AWSTemplateFormatVersion: "2010-09-09" - Parameters: - DBUser: - NoEcho: true - Description: The database admin account username - Type: String - MinLength: 1 - MaxLength: 16 - AllowedPattern: "[a-zA-Z][a-zA-Z0-9]*" - ConstraintDescription: must begin with a letter and contain only alphanumeric characters. - DBPassword: - NoEcho: true - Description: The database admin account password - Type: String - MinLength: 1 - MaxLength: 41 - AllowedPattern: "[a-zA-Z0-9]*" - ConstraintDescription: must contain only alphanumeric characters. - DBSnapshotName: - Description: The name of a DB snapshot (optional) - Default: "" - Type: String - Conditions: - UseDBSnapshot: !Not [!Equals [!Ref DBSnapshotName, ""]] - Resources: - MyDB: - Type: AWS::RDS::DBInstance - Properties: - AllocatedStorage: 5 - DBInstanceClass: db.t2.small - Engine: MySQL - EngineVersion: 5.5 - MasterUsername: !Ref DBUser - MasterUserPassword: !Ref DBPassword - DBParameterGroupName: !Ref MyRDSParamGroup - DBSnapshotIdentifier: !If [UseDBSnapshot, !Ref DBSnapshotName, !Ref "AWS::NoValue"] - MyRDSParamGroup: - Type: AWS::RDS::DBParameterGroup - Properties: - Family: MySQL5.5 - Description: CloudFormation Sample Database Parameter Group - Parameters: - autocommit: 1 - general_log: 1 - old_passwords: 0 +###### Note @@ -771 +620 @@ For more information, see the [Do not embed credentials in your templates](https -The `UseDBSnapshot` condition evaluates to true only if the `DBSnapshotName` isn't an empty string. If the `UseDBSnapshot` condition evaluates to true, CloudFormation uses the `DBSnapshotName` parameter value for the `DBSnapshotIdentifier` property. If the condition evaluates to false, CloudFormation removes the `DBSnapshotIdentifier` property. The `AWS::NoValue` pseudo parameter removes the corresponding resource property when it's used as a return value. +For more complext examples of using conditions to create resources, see the [Condition attribute](./aws-attribute-condition.html) topic.