AWS AWSCloudFormation medium security documentation change

Service: AWSCloudFormation · 2025-11-07 · Security-related medium

File: AWSCloudFormation/latest/TemplateReference/doc-history.md

Summary

Added documentation for AWS::CloudFront::VpcOrigin resource with AccountId field to determine VPC origin account ownership

Security assessment

The addition of AccountId helps enforce access control to VPC origins, directly addressing security through origin ownership verification as referenced in linked CloudFront security documentation.

Diff

diff --git a/AWSCloudFormation/latest/TemplateReference/doc-history.md b/AWSCloudFormation/latest/TemplateReference/doc-history.md
index 69be92cf8..08f69ad6b 100644
--- a//AWSCloudFormation/latest/TemplateReference/doc-history.md
+++ b//AWSCloudFormation/latest/TemplateReference/doc-history.md
@@ -10,0 +11,15 @@ Change| Description| Date
+[Updated resource](./aws-template-resource-type-ref.html#AWS_CloudFront)| The following resource was added: AWS::CloudFront::VpcOrigin
+
+[AWS::CloudFront::VpcOrigin](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-cloudfront-vpcorigin.html)
+     Added the `AccountId` so that you can determine the account ID of the AWS account that owns the VPC origin. For more information, see [Restrict access with VPC origins](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-vpc-origins.html) in the _Amazon CloudFront Developer Guide_.
+| November 5, 2025  
+[Updated resource](./aws-template-resource-type-ref.html#AWS_CloudFront)| The following resource was updated: AWS::CloudFront::AnycastIpList
+
+[AWS::CloudFront::AnycastIpList](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudfront-anycastiplist.html)
+     Added `IpAddressType` for this resource to support either `ipv4` or `dualstack`. For more information, see [Request Anycast static IPs](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/request-static-ips.html) in the _Amazon CloudFront Developer Guide_.
+| November 5, 2025  
+[New resource](./aws-template-resource-type-ref.html#AWS_BedrockAgentCore)| The following resource was added: `AWS::BedrockAgentCore::WorkloadIdentity`.
+
+[AWS::BedrockAgentCore::WorkloadIdentity](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-bedrockagentcore-workloadidentity.html)
+     Use the `AWS::BedrockAgentCore::WorkloadIdentity` resource to create a workload identity for Amazon Bedrock AgentCore.
+| November 3, 2025