AWS Security ChangesHomeSearch

AWS cloudformation-cli documentation change

Service: cloudformation-cli · 2025-11-16 · Documentation low

File: cloudformation-cli/latest/hooks-userguide/hooks-concepts.md

Summary

Updated section headers and CLI availability note for KMS keys

Security assessment

Structural updates and feature availability notes without specific security context or vulnerability references.

Diff

diff --git a/cloudformation-cli/latest/hooks-userguide/hooks-concepts.md b/cloudformation-cli/latest/hooks-userguide/hooks-concepts.md
index 885c247d8..aea9384a6 100644
--- a//cloudformation-cli/latest/hooks-userguide/hooks-concepts.md
+++ b//cloudformation-cli/latest/hooks-userguide/hooks-concepts.md
@@ -5 +5 @@
-HookFailure modeHook targetsTarget actionsHook handlerTimeout and retry limits
+HookFailure modeHook targetsTarget actionsAnnotationsHook handlerTimeout and retry limits
@@ -59,0 +60,10 @@ Target actions define the specific actions (`CREATE`, `UPDATE`, or `DELETE`) tha
+## Annotations
+
+[GetHookResult](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetHookResult.html) responses can return _annotations_ that provide detailed compliance check results and remediation guidance for each evaluated resource. For details on the API's annotation structure, see [Annotation](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_Annotation.html) in the _AWS CloudFormation API Reference_. For instructions on viewing these validation results, see [View invocation results for AWS CloudFormation Hooks](./hooks-view-invocations.html).
+
+You can encrypt annotations as needed for sensitive compliance information by specifying your own KMS key when configuring the Hook. For more information, see [Hook configuration schema syntax reference](./hook-configuration-schema.html). For information about setting up the key policy that you need when you specify your KMS key for Hooks, see [AWS KMS key policy and permissions for encrypting AWS CloudFormation Hooks results at rest](./hooks-kms-key-policy.html).
+
+###### Important
+
+Note that the `KmsKeyId` option to specify a customer managed key is currently only available when you use the AWS CLI to configure your Hook.
+