AWS cloudformation-cli medium security documentation change
Summary
Added Annotations section explaining encrypted compliance results and KMS key requirements
Security assessment
Documents encryption capabilities for sensitive compliance data in Hooks, including requirements for customer-managed KMS keys. This enhances security documentation for data protection.
Diff
diff --git a/cloudformation-cli/latest/hooks-userguide/hooks-concepts.md b/cloudformation-cli/latest/hooks-userguide/hooks-concepts.md index 885c247d8..aea9384a6 100644 --- a//cloudformation-cli/latest/hooks-userguide/hooks-concepts.md +++ b//cloudformation-cli/latest/hooks-userguide/hooks-concepts.md @@ -5 +5 @@ -HookFailure modeHook targetsTarget actionsHook handlerTimeout and retry limits +HookFailure modeHook targetsTarget actionsAnnotationsHook handlerTimeout and retry limits @@ -59,0 +60,10 @@ Target actions define the specific actions (`CREATE`, `UPDATE`, or `DELETE`) tha +## Annotations + +[GetHookResult](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetHookResult.html) responses can return _annotations_ that provide detailed compliance check results and remediation guidance for each evaluated resource. For details on the API's annotation structure, see [Annotation](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_Annotation.html) in the _AWS CloudFormation API Reference_. For instructions on viewing these validation results, see [View invocation results for AWS CloudFormation Hooks](./hooks-view-invocations.html). + +You can encrypt annotations as needed for sensitive compliance information by specifying your own KMS key when configuring the Hook. For more information, see [Hook configuration schema syntax reference](./hook-configuration-schema.html). For information about setting up the key policy that you need when you specify your KMS key for Hooks, see [AWS KMS key policy and permissions for encrypting AWS CloudFormation Hooks results at rest](./hooks-kms-key-policy.html). + +###### Important + +Note that the `KmsKeyId` option to specify a customer managed key is currently only available when you use the AWS CLI to configure your Hook. +