AWS appconfig documentation change
Summary
Restructured workflow steps, added diagram, clarified configuration profile creation process, removed redundant environment setup details, and updated deployment/retrieval mechanics
Security assessment
Changes focus on improving documentation clarity and workflow structure rather than addressing security vulnerabilities. While the update mentions risk mitigation through staged rollouts and validation, these are general best practices rather than new security features. The removal of CloudWatch alarm/IAM role configuration details reduces explicit security documentation but doesn't indicate a security issue.
Diff
diff --git a/appconfig/latest/userguide/what-is-appconfig.md b/appconfig/latest/userguide/what-is-appconfig.md index 45a9a25ba..b2a8b861d 100644 --- a//appconfig/latest/userguide/what-is-appconfig.md +++ b//appconfig/latest/userguide/what-is-appconfig.md @@ -68 +68 @@ AWS AppConfig integrates with AWS Identity and Access Management (IAM) to provid -This section provides a high-level description of how AWS AppConfig works and how you get started. +This section provides a high-level description of how AWS AppConfig works. @@ -70 +70 @@ This section provides a high-level description of how AWS AppConfig works and ho -**1\. Identify configuration values in code you want to manage in the cloud** + @@ -71,0 +72 @@ This section provides a high-level description of how AWS AppConfig works and ho +**1\. Identify configuration values in code you want to manage in AWS AppConfig** @@ -73 +73,0 @@ This section provides a high-level description of how AWS AppConfig works and ho -Before you start creating AWS AppConfig artifacts, we recommend you identify configuration data in your code that you want to dynamically manage using AWS AppConfig. Good examples include feature flags or toggles, allow and block lists, logging verbosity, service limits, and throttling rules, to name a few. @@ -75 +75 @@ Before you start creating AWS AppConfig artifacts, we recommend you identify con -If your configuration data already exists in the cloud, you can take advantage of AWS AppConfig validation, deployment, and extension features to further streamline configuration data management. +Before you create a configuration profile in AWS AppConfig, we recommend you identify configuration data in your code that you want to dynamically manage using AWS AppConfig. Good examples include feature flags or toggles, allow and block lists, logging verbosity, service limits, and throttling rules, to name a few. These types of configuration change frequently and can cause problems if not correct. @@ -77 +77 @@ If your configuration data already exists in the cloud, you can take advantage o -**2\. Create an application namespace** +If your configuration data already exists in the cloud, for example in Parameter Store or Amazon S3, you can take advantage of AWS AppConfig validation, deployment, and extension features to further streamline configuration data management. @@ -78,0 +79 @@ If your configuration data already exists in the cloud, you can take advantage o +**2\. Create a configuration profile in AWS AppConfig** @@ -80 +80,0 @@ If your configuration data already exists in the cloud, you can take advantage o -To create a namespace, you create an AWS AppConfig artifact called an application. An application is simply an organizational construct like a folder. For more information, see [Creating a namespace for your application in AWS AppConfig](./appconfig-creating-namespace.html). @@ -82,11 +82 @@ To create a namespace, you create an AWS AppConfig artifact called an applicatio -**3\. Create environments** - - -For each AWS AppConfig application, you define one or more environments. An environment is a logical grouping of targets, such as applications in a `Beta` or `Production` environment, AWS Lambda functions, or containers. You can also define environments for application subcomponents, such as the `Web`, `Mobile`, and `Back-end`. For more information, see [Creating environments for your application in AWS AppConfig](./appconfig-creating-environment.html). - -You can configure Amazon CloudWatch alarms for each environment. The system monitors alarms during a configuration deployment. If an alarm is triggered, the system rolls back the configuration. To use this feature, you must create an AWS Identity and Access Management role so that AWS AppConfig can monitor alarms. For more information, see [Configure permissions for automatic rollback](./setting-up-appconfig.html#getting-started-with-appconfig-cloudwatch-alarms-permissions). - -**4\. Create a configuration profile** - - -A configuration profile includes, among other things, a URI that enables AWS AppConfig to locate your configuration data in its stored location and a profile type. AWS AppConfig supports two configuration profile types: feature flags and freeform configurations. Feature flag configuration profiles store their data in the AWS AppConfig hosted configuration store and the URI is simply `hosted`. For freeform configuration profiles, you can store your data in the AWS AppConfig hosted configuration store or any AWS service that integrates with AWS AppConfig, as described in [Creating a free form configuration profile in AWS AppConfig](./appconfig-free-form-configurations-creating.html). For more information about creating a configuration profile, see [Creating a configuration profile in AWS AppConfig](./appconfig-creating-configuration-profile.html). +A configuration profile includes, among other things, a URI that enables AWS AppConfig to locate your configuration data in its stored location and a profile type. AWS AppConfig supports two configuration profile types: feature flags and freeform configurations. Both types can reduce the risk and complexity of software development and deployment by decoupling feature releases from code deployments. They also enable continuous delivery and risk mitigation through staged rollouts. Additionally, feature flags enable testing in production with real users, while freeform configurations enable you to retrieve configuration data from other AWS services. Both profile types allow for faster iteration, experimentation, personalization, and efficient management of the software lifecycle. For more information about creating a configuration profile, see [Creating a configuration profile in AWS AppConfig](./appconfig-creating-configuration-profile.html). @@ -96,15 +86 @@ A configuration profile can also include optional validators to ensure your conf -**5\. Deploy configuration data** - - -When you create a new deployment, you specify the following: - - * An application ID - - * A configuration profile ID - - * A configuration version - - * An environment ID where you want to deploy the configuration data - - * A deployment strategy ID that defines how fast you want the changes to take effect - +When you create a configuration profile, you also create an application in AWS AppConfig. An application is simply a namespace or an organizational construct like a folder. @@ -111,0 +88 @@ When you create a new deployment, you specify the following: +**3\. Deploy configuration data** @@ -116 +93 @@ When you start a deployment, AWS AppConfig performs the following tasks: - 1. Retrieves the configuration data from the underlying data store by using the location URI in the configuration profile. + 1. Retrieves the configuration data from the underlying data store by using the location path name in the configuration profile. @@ -120 +97 @@ When you start a deployment, AWS AppConfig performs the following tasks: - 3. Caches a copy of the data so it is ready to be retrieved by your application. This cached copy is called the _deployed data_. + 3. Sends a copy of the data to AWS AppConfig Agent to be read by your application. This copy is called the _deployed data_. @@ -127 +104 @@ For more information about deploying a configuration, see [Deploying feature fla -**6\. Retrieve the configuration** +**4\. Retrieve the configuration** @@ -130 +107 @@ For more information about deploying a configuration, see [Deploying feature fla -You can configure AWS AppConfig Agent as a local host and have the agent poll AWS AppConfig for configuration updates. The agent calls the [StartConfigurationSession](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_appconfigdata_StartConfigurationSession.html) and [GetLatestConfiguration](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_appconfigdata_GetLatestConfiguration.html) API actions and caches your configuration data locally. To retrieve the data, your application makes an HTTP call to the localhost server. AWS AppConfig Agent supports several use cases, as described in [How to use AWS AppConfig Agent to retrieve configuration data](./appconfig-agent-how-to-use.html). +To retrieve the data, your application makes an HTTP call to the localhost server where AWS AppConfig Agent has cached a local copy of your deployed configuration data. Retrieving data is a metered event. AWS AppConfig Agent supports several use cases, as described in [How to use AWS AppConfig Agent to retrieve configuration data](./appconfig-agent-how-to-use.html).