AWS AWSCloudFormation high security documentation change

Service: AWSCloudFormation · 2025-10-13 · Security-related high

File: AWSCloudFormation/latest/TemplateReference/aws-attribute-dependson.md

Summary

Updated examples to use SSM Parameter Store for AMI IDs and Secrets Manager for database credentials, removed hardcoded values and region mapping tables

Security assessment

Replaced hardcoded database credentials with Secrets Manager references to prevent plaintext secret exposure in templates. Changed AMI references to use SSM Parameter Store to ensure latest secure AMIs are used. These changes directly mitigate security risks related to credential leakage and outdated system images.

Diff

diff --git a/AWSCloudFormation/latest/TemplateReference/aws-attribute-dependson.md b/AWSCloudFormation/latest/TemplateReference/aws-attribute-dependson.md
index 70a3204e6..11c17d62c 100644
--- a//AWSCloudFormation/latest/TemplateReference/aws-attribute-dependson.md
+++ b//AWSCloudFormation/latest/TemplateReference/aws-attribute-dependson.md
@@ -48 +48 @@ The `DependsOn` attribute can take a single string or list of strings.
-The following template contains an [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) resource with a `DependsOn` attribute that specifies myDB, an [AWS::RDS::DBInstance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.html). When CloudFormation creates this stack, it first creates myDB, then creates Ec2Instance.
+The following template contains an [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-instance.html) resource with a `DependsOn` attribute that specifies `myDB`, an [AWS::RDS::DBInstance](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-rds-dbinstance.html). When CloudFormation creates this stack, it first creates `myDB`, then creates `Ec2Instance`.
@@ -54,20 +53,0 @@ The following template contains an [AWS::EC2::Instance](https://docs.aws.amazon.
-        "AWSTemplateFormatVersion" : "2010-09-09",
-        "Mappings" : {
-            "RegionMap" : {
-                "us-east-1" : { 
-                    "AMI" : "ami-0ff8a91507f77f867" 
-                },
-                "us-west-1" : { 
-                    "AMI" : "ami-0bdb828fd58c52235" 
-                },
-                "eu-west-1" : { 
-                    "AMI" : "ami-047bb4163c506cd98" 
-                },
-                "ap-northeast-1" : { 
-                    "AMI" : "ami-06cd52961ce9f0d85" 
-                },
-                "ap-southeast-1" : { 
-                    "AMI" : "ami-08569b978cc4dfa10" 
-                }
-            }
-        },
@@ -78,9 +58,2 @@ The following template contains an [AWS::EC2::Instance](https://docs.aws.amazon.
-                    "ImageId": {
-                        "Fn::FindInMap": [
-                            "RegionMap",
-                            {
-                                "Ref": "AWS::Region"
-                            },
-                            "AMI"
-                        ]
-                    }
+                    "ImageId": "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64}}",
+                    "InstanceType": "t2.micro"
@@ -97,2 +70,2 @@ The following template contains an [AWS::EC2::Instance](https://docs.aws.amazon.
-                   "MasterUsername" : "MyName",
-                   "MasterUserPassword" : "MyPassword"
+                   "MasterUsername" : "{{resolve:secretsmanager:MySecret:SecretString:username}}",
+                   "MasterUserPassword" : "{{resolve:secretsmanager:MySecret:SecretString:password}}"
@@ -107,13 +79,0 @@ The following template contains an [AWS::EC2::Instance](https://docs.aws.amazon.
-    AWSTemplateFormatVersion: '2010-09-09'
-    Mappings:
-      RegionMap:
-        us-east-1:
-          AMI: ami-0ff8a91507f77f867
-        us-west-1:
-          AMI: ami-0bdb828fd58c52235
-        eu-west-1:
-          AMI: ami-047bb4163c506cd98
-        ap-northeast-1:
-          AMI: ami-06cd52961ce9f0d85
-        ap-southeast-1:
-          AMI: ami-08569b978cc4dfa10
@@ -124,5 +84,2 @@ The following template contains an [AWS::EC2::Instance](https://docs.aws.amazon.
-          ImageId:
-            Fn::FindInMap:
-            - RegionMap
-            - Ref: AWS::Region
-            - AMI
+          ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64}}'
+          InstanceType: t2.micro
@@ -137,3 +94,2 @@ The following template contains an [AWS::EC2::Instance](https://docs.aws.amazon.
-          MasterUsername: MyName
-          MasterUserPassword: MyPassword
-    
+          MasterUsername: '{{resolve:secretsmanager:MySecret:SecretString:username}}'
+          MasterUserPassword: '{{resolve:secretsmanager:MySecret:SecretString:password}}'
@@ -187,3 +143,2 @@ The following snippet shows a sample gateway attachment and an Amazon EC2 instan
-        "InstanceType" : { 
-          "Ref" : "EC2InstanceType" 
-        },
+        "InstanceType" : "t2.micro",
+        "ImageId": "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64}}",
@@ -193,17 +147,0 @@ The following snippet shows a sample gateway attachment and an Amazon EC2 instan
-        "ImageId": {
-          "Fn::FindInMap": [
-            "AWSRegionArch2AMI",
-            {
-              "Ref": "AWS::Region"
-            },
-            {
-              "Fn::FindInMap": [
-                "AWSInstanceType2Arch",
-                {
-                  "Ref": "EC2InstanceType"
-                },
-                "Arch"
-              ]
-            }
-          ]
-        },
@@ -242,2 +180,2 @@ The following snippet shows a sample gateway attachment and an Amazon EC2 instan
-        InstanceType:
-          Ref: EC2InstanceType
+        InstanceType: t2.micro
+        ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64}}'
@@ -246,8 +183,0 @@ The following snippet shows a sample gateway attachment and an Amazon EC2 instan
-        ImageId:
-          Fn::FindInMap:
-          - AWSRegionArch2AMI
-          - Ref: AWS::Region
-          - Fn::FindInMap:
-            - AWSInstanceType2Arch
-            - Ref: EC2InstanceType
-            - Arch