AWS AWSCloudFormation medium security documentation change
Summary
Updated Mappings examples to use more descriptive map names (RegionToInstanceType/RegionToAMI), replaced hardcoded AMI IDs with SSM parameter resolution, added environment-based instance type/security group mappings, and restructured examples to demonstrate dynamic resource selection.
Security assessment
The change promotes security best practices by: 1) Removing hardcoded AMI IDs in favor of SSM parameter resolution ({{resolve:ssm...}}) which ensures use of latest patched AMIs 2) Demonstrating environment-specific security group mapping (Prod vs Dev) 3) Showing secure pattern of separating instance types and security groups by environment. These changes help prevent deployment of outdated AMIs with vulnerabilities and enforce least-privilege security groups.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/mappings-section-structure.md b/AWSCloudFormation/latest/UserGuide/mappings-section-structure.md index 7788949e9..a7e45db70 100644 --- a//AWSCloudFormation/latest/UserGuide/mappings-section-structure.md +++ b//AWSCloudFormation/latest/UserGuide/mappings-section-structure.md @@ -86 +86 @@ If the values in a mapping aren't currently used by your stack, you cannot updat -The following example shows a `Mappings` section with a map `RegionMap`, which contains five keys that map to name-value pairs containing single string values. The keys are region names. Each name-value pair is an instance type from the T family that's available in the region represented by the key. The name-value pairs have a name (`InstanceType` in the example) and a value. +The following example shows a `Mappings` section with a map `RegionToInstanceType`, which contains five keys that map to name-value pairs containing single string values. The keys are region names. Each name-value pair is an instance type from the T family that's available in the region represented by the key. The name-value pairs have a name (`InstanceType` in the example) and a value. @@ -92 +92 @@ The following example shows a `Mappings` section with a map `RegionMap`, which c - "RegionMap" : { + "RegionToInstanceType" : { @@ -105 +105 @@ The following example shows a `Mappings` section with a map `RegionMap`, which c - RegionMap: + RegionToInstanceType: @@ -128 +128,2 @@ The AMI IDs shown in these examples are placeholders for demonstration purposes. - "AMIIDMap" : { + "Mappings" : { + "RegionToAMI" : { @@ -134,0 +136 @@ The AMI IDs shown in these examples are placeholders for demonstration purposes. + } @@ -139 +141,2 @@ The AMI IDs shown in these examples are placeholders for demonstration purposes. - AMIIDMap: + Mappings: + RegionToAMI: @@ -158 +161 @@ The AMI IDs shown in these examples are placeholders for demonstration purposes. -You can use the `Fn::FindInMap` function to return a named value based on a specified key. The following example template contains an Amazon EC2 resource whose `ImageId` property is assigned by the `FindInMap` function. The `FindInMap` function specifies key as the region where the stack is created (using the `AWS::Region` pseudo parameter) and `MyAMI1` as the name of the value to map to. For more information about pseudo parameters, see [Get AWS values using pseudo parameters](./pseudo-parameter-reference.html). +You can use the `Fn::FindInMap` function to return a named value based on a specified key. The following example template contains an Amazon EC2 resource whose `InstanceType` property is assigned by the `FindInMap` function. The `FindInMap` function specifies key as the AWS Region where the stack is created (using the `AWS::Region` pseudo parameter) and `InstanceType` as the name of the value to map to. The `ImageId` uses a Systems Manager parameter to dynamically retrieve the latest Amazon Linux 2 AMI. For more information about pseudo parameters, see [Get AWS values using pseudo parameters](./pseudo-parameter-reference.html). @@ -166,6 +169,6 @@ You can use the `Fn::FindInMap` function to return a named value based on a spec - "AMIIDMap" : { - "us-east-1" : {"MyAMI1" : "ami-12345678901234567", "MyAMI2" : "ami-23456789012345678"}, - "us-west-1" : {"MyAMI1" : "ami-34567890123456789", "MyAMI2" : "ami-45678901234567890"}, - "eu-west-1" : {"MyAMI1" : "ami-56789012345678901", "MyAMI2" : "ami-67890123456789012"}, - "ap-northeast-1" : {"MyAMI1" : "ami-90123456789012345", "MyAMI2" : "ami-01234567890123456"}, - "ap-southeast-1" : {"MyAMI1" : "ami-78901234567890123", "MyAMI2" : "ami-89012345678901234"} + "RegionToInstanceType" : { + "us-east-1" : { "InstanceType" : "t2.micro" }, + "us-west-1" : { "InstanceType" : "t2.micro" }, + "eu-west-1" : { "InstanceType" : "t2.micro" }, + "eu-north-1" : { "InstanceType" : "t3.micro" }, + "me-south-1" : { "InstanceType" : "t3.micro" } @@ -178,2 +181,2 @@ You can use the `Fn::FindInMap` function to return a named value based on a spec - "ImageId" : { "Fn::FindInMap" : [ "AMIIDMap", { "Ref" : "AWS::Region" }, "MyAMI1" ]}, - "InstanceType" : "t2.micro" + "ImageId" : "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}", + "InstanceType" : { "Fn::FindInMap" : [ "RegionToInstanceType", { "Ref" : "AWS::Region" }, "InstanceType" ]} @@ -190 +193 @@ You can use the `Fn::FindInMap` function to return a named value based on a spec - AMIIDMap: + RegionToInstanceType: @@ -192,2 +195 @@ You can use the `Fn::FindInMap` function to return a named value based on a spec - MyAMI1: ami-12345678901234567 - MyAMI2: ami-23456789012345678 + InstanceType: t2.micro @@ -195,2 +197 @@ You can use the `Fn::FindInMap` function to return a named value based on a spec - MyAMI1: ami-34567890123456789 - MyAMI2: ami-45678901234567890 + InstanceType: t2.micro @@ -198,8 +199,5 @@ You can use the `Fn::FindInMap` function to return a named value based on a spec - MyAMI1: ami-56789012345678901 - MyAMI2: ami-67890123456789012 - ap-northeast-1: - MyAMI1: ami-90123456789012345 - MyAMI2: ami-01234567890123456 - ap-southeast-1: - MyAMI1: ami-78901234567890123 - MyAMI2: ami-89012345678901234 + InstanceType: t2.micro + eu-north-1: + InstanceType: t3.micro + me-south-1: + InstanceType: t3.micro @@ -210,2 +208,2 @@ You can use the `Fn::FindInMap` function to return a named value based on a spec - ImageId: !FindInMap [AMIIDMap, !Ref "AWS::Region", MyAMI1] - InstanceType: t2.micro + ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}' + InstanceType: !FindInMap [RegionToInstanceType, !Ref 'AWS::Region', InstanceType] @@ -215,3 +213 @@ You can use the `Fn::FindInMap` function to return a named value based on a spec -You can use an input parameter with the `Fn::FindInMap` function to refer to a specific value in a map. For example, suppose you have a list of regions and environment types that map to a specific security group ID. You can select the security group ID that your stack uses by using an input parameter (`EnvironmentType`). To determine the region, use the `AWS::Region` pseudo parameter, which gets the AWS Region in which you create the stack. - -This example also declares a Systems Manager parameter type that provides a Systems Manager parameter alias (`/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2`) as the default value for the `ImageId` property of the EC2 instance. This is a value that CloudFormation resolves as the AMI ID value for the latest Amazon Linux 2 AMI in the region where the stack is created. +The following example template shows how to create an EC2 instance using multiple mappings. The template uses nested mappings to automatically select the appropriate instance type and security group based on the target AWS Region and environment type (`Dev` or `Prod`). It also uses a Systems Manager parameter to dynamically retrieve the latest Amazon Linux 2 AMI. @@ -225,5 +220,0 @@ This example also declares a Systems Manager parameter type that provides a Syst - "LatestAmiId" : { - "Description" : "The latest Amazon Linux 2 AMI from the Parameter Store", - "Type" : "AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>", - "Default" : "/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2" - }, @@ -234,4 +225 @@ This example also declares a Systems Manager parameter type that provides a Syst - "AllowedValues" : [ - "Dev", - "Prod" - ] + "AllowedValues" : [ "Dev", "Prod" ] @@ -241,4 +229,3 @@ This example also declares a Systems Manager parameter type that provides a Syst - "SecurityGroupMap" : { - "us-east-1" : { - "Dev" : "sg-12345678", - "Prod" : "sg-abcdef01" + "RegionAndEnvironmentToInstanceType" : { + "us-east-1" : { "Dev" : "t3.micro", "Prod" : "c5.large" }, + "us-west-1" : { "Dev" : "t2.micro", "Prod" : "m5.large" } @@ -246,4 +233,3 @@ This example also declares a Systems Manager parameter type that provides a Syst - "us-west-2" : { - "Dev" : "sg-ghijkl23", - "Prod" : "sg-45678abc" - } + "RegionAndEnvironmentToSecurityGroup" : { + "us-east-1" : { "Dev" : "sg-12345678", "Prod" : "sg-abcdef01" }, + "us-west-1" : { "Dev" : "sg-ghijkl23", "Prod" : "sg-45678abc" } @@ -256,5 +242,3 @@ This example also declares a Systems Manager parameter type that provides a Syst - "ImageId" : { - "Ref" : "LatestAmiId" - }, - "InstanceType" : "t2.micro", - "SecurityGroupIds" : [{ "Fn::FindInMap" : [ "SecurityGroupMap", { "Ref" : "AWS::Region" }, { "Ref" : "EnvironmentType" } ]}] + "ImageId" : "{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}", + "InstanceType" : { "Fn::FindInMap": [ "RegionAndEnvironmentToInstanceType", { "Ref": "AWS::Region" }, { "Ref": "EnvironmentType" } ]}, + "SecurityGroupIds" : [{ "Fn::FindInMap" : [ "RegionAndEnvironmentToSecurityGroup", { "Ref" : "AWS::Region" }, { "Ref" : "EnvironmentType" } ]}] @@ -271,4 +254,0 @@ This example also declares a Systems Manager parameter type that provides a Syst - LatestAmiId: - Description: The latest Amazon Linux 2 AMI from the Parameter Store - Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id> - Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2 @@ -283 +263,8 @@ This example also declares a Systems Manager parameter type that provides a Syst - SecurityGroupMap: + RegionAndEnvironmentToInstanceType: + us-east-1: + Dev: t3.micro + Prod: c5.large + us-west-1: + Dev: t2.micro + Prod: m5.large + RegionAndEnvironmentToSecurityGroup: @@ -287 +274 @@ This example also declares a Systems Manager parameter type that provides a Syst - us-west-2: + us-west-1: @@ -294,2 +281,2 @@ This example also declares a Systems Manager parameter type that provides a Syst - ImageId: !Ref LatestAmiId - InstanceType: t2.micro + ImageId: '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}' + InstanceType: !FindInMap [RegionAndEnvironmentToInstanceType, !Ref 'AWS::Region', !Ref EnvironmentType] @@ -297 +284 @@ This example also declares a Systems Manager parameter type that provides a Syst - - !FindInMap [SecurityGroupMap, !Ref "AWS::Region", !Ref EnvironmentType] + - !FindInMap [RegionAndEnvironmentToSecurityGroup, !Ref 'AWS::Region', !Ref EnvironmentType]