AWS AWSCloudFormation low security documentation change
Summary
Updated IAM role ARN pattern regex and corrected documentation links for Ref/GetAtt functions
Security assessment
The regex pattern change for IAM role ARNs tightens validation rules (added stricter character restrictions and path structure). This could prevent misconfigurations of privileged roles, which has security implications for access control.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-datazone-environmentblueprintconfiguration.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-datazone-environmentblueprintconfiguration.md index 05085d92d..a035dcba7 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-datazone-environmentblueprintconfiguration.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-datazone-environmentblueprintconfiguration.md @@ -142 +142 @@ _Required_ : No - _Pattern_ : `^arn:aws[^:]*:iam::\d{12}:(role|role/service-role)/[\w+=,.@-]*$` + _Pattern_ : `^arn:aws[^:]*:iam::\d{12}:role(/[a-zA-Z0-9+=,.@_-]+)*/[a-zA-Z0-9+=,.@_-]+$` @@ -163 +163 @@ When you pass the logical ID of this resource to the intrinsic `Ref` function, ` -For more information about using the `Ref` function, see [`Ref`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html). +For more information about using the `Ref` function, see [`Ref`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html). @@ -169 +169 @@ The `Fn::GetAtt` intrinsic function returns a value for a specified attribute of -For more information about using the `Fn::GetAtt` intrinsic function, see [`Fn::GetAtt`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-getatt.html). +For more information about using the `Fn::GetAtt` intrinsic function, see [`Fn::GetAtt`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html).