AWS cloudformation-cli documentation change
Summary
Updated documentation to replace 'invocation summaries' with 'invocation results' terminology, added new section for viewing Hook-specific invocation history, enhanced CLI examples with remediation guidance, and improved UI navigation instructions
Security assessment
The changes add detailed remediation guidance for failed Hook invocations and demonstrate security compliance checks (e.g., BlockPublicAccessCheck, BucketEncryptionCheck) in CLI examples. While this improves security documentation by showing how to interpret security-related findings, there's no evidence of addressing a specific security vulnerability.
Diff
diff --git a/cloudformation-cli/latest/hooks-userguide/hooks-view-invocations.md b/cloudformation-cli/latest/hooks-userguide/hooks-view-invocations.md index 7cd503d8f..4ea54e4c5 100644 --- a//cloudformation-cli/latest/hooks-userguide/hooks-view-invocations.md +++ b//cloudformation-cli/latest/hooks-userguide/hooks-view-invocations.md @@ -5 +5 @@ -View invocation summaries (console)View invocation summaries (AWS CLI) +View invocation results (console)View invocation results (AWS CLI) @@ -7 +7 @@ View invocation summaries (console)View invocation summaries (AWS CLI) -# View invocation summaries for AWS CloudFormation Hooks +# View invocation results for AWS CloudFormation Hooks @@ -9 +9 @@ View invocation summaries (console)View invocation summaries (AWS CLI) -This topic describes how to view invocation summaries for AWS CloudFormation Hooks. Viewing invocation summaries can help you understand how Hooks are evaluating your resources and troubleshoot any issues that may arise during stack operations. +This topic describes how to view invocation results for AWS CloudFormation Hooks. Viewing invocation results can help you understand how Hooks are evaluating your resources and resolve any issues that are detected when Hooks verify a resource. @@ -13 +13 @@ Invocations are specific instances when your validation logic (whether it's a AW -## View invocation summaries in the console +## View invocation results in the console @@ -15 +15 @@ Invocations are specific instances when your validation logic (whether it's a AW -You can view invocation information in the console in two ways: through the **Invocation summary** page for all invocations across your account, or through individual stack events for stack-specific invocations. +You can view invocation results in the console in three ways: through the **Invocation summary** page, through the invocation histories for individual Hooks, or through individual stack events for stack-specific invocations. @@ -17 +17 @@ You can view invocation information in the console in two ways: through the **In -### View all invocation summaries +### View results for all Hooks @@ -19 +19 @@ You can view invocation information in the console in two ways: through the **In -The **Invocation summary** page provides a comprehensive view of all Hook invocations across all stacks in your account and Region for the past 90 days. +The **Invocation summary** page provides a comprehensive view of all Hook invocations across your account and Region for the past 90 days. @@ -21 +21 @@ The **Invocation summary** page provides a comprehensive view of all Hook invoca -###### To view invocation summaries +###### To view results for all Hooks @@ -46,0 +47 @@ The **Invocation summary** page provides a comprehensive view of all Hook invoca + 6. Select a specific invocation to view more addition details about the invocation result, including remediation guidance for failed Hook invocations. @@ -50 +50,0 @@ The **Invocation summary** page provides a comprehensive view of all Hook invoca -### View stack-specific invocation information @@ -52 +52,22 @@ The **Invocation summary** page provides a comprehensive view of all Hook invoca -You can also view invocation information for a specific stack through the stack events page. +### View invocation history for individual Hooks + +You can also view invocation results through the invocation histories for individual Hooks. + +###### To view Hook invocations for a specific Hook + + 1. Sign in to the AWS Management Console and open the AWS CloudFormation console at [https://console.aws.amazon.com/cloudformation](https://console.aws.amazon.com/cloudformation/). + + 2. On the navigation bar at the top of the screen, choose the AWS Region where you want to view Hook invocations. + + 3. From the navigation pane, choose **Hooks**. + + 4. Choose the Hook you want to view Hook invocations for. + + 5. Select a specific invocation to view more addition details about the invocation result, including remediation guidance for failed Hook invocations. + + + + +### View results for stack-specific invocations + +You can also view invocation results for a specific stack through the stack **Events** page. @@ -66 +87,5 @@ You can also view invocation information for a specific stack through the stack - 6. In the events list, look for events with **Hook invocations complete** in the **Status reason** column. For additional Hook invocation details, review the **Hook invocations** column. + 6. In the events list, look for events with **Hook invocations complete** in the **Status reason** column. + + 7. To view specific Hook invocation details, review the **Hook invocations** column, and choose the underlined text to open a pop-up window with more detailed information. + +###### Note @@ -67,0 +93 @@ You can also view invocation information for a specific stack through the stack +To display hidden columns, choose the gear icon on the top right corner of the section to open the **Preferences** modal, update the settings as needed, and choose **Confirm**. @@ -71 +97,2 @@ You can also view invocation information for a specific stack through the stack -## View invocation summaries using the AWS CLI + +## View invocation results using the AWS CLI @@ -198,0 +226,46 @@ For a description of the fields in the response, see [HookResultSummary](https:/ +###### Get detailed results for a specific invocation + +Use the [get-hook-result](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/get-hook-result.html) command to retrieve detailed information about a specific Hook invocation, including annotations with compliance check results and remediation guidance. + + + aws cloudformation get-hook-result \ + --hook-result-id 59ef501c-0ac4-47c0-a193-e071cabf748d \ + --region us-west-2 + +Example output: + + + { + "HookResultId": "59ef501c-0ac4-47c0-a193-e071cabf748d", + "InvocationPoint": "PRE_PROVISION", + "FailureMode": "WARN", + "TypeName": "MyOrg::Security::ComplianceHook", + "TypeVersionId": "00000001", + "TypeArn": "arn:aws:cloudformation:us-west-2:123456789012:type/hook/MyOrg-Security-ComplianceHook", + "Status": "HOOK_COMPLETE_FAILED", + "HookStatusReason": "Hook completed with failed validations", + "InvokedAt": "2025-08-08T00:18:39.651Z", + "Target": { + "TargetType": "RESOURCE", + "TargetTypeName": "AWS::S3::Bucket", + "TargetId": "my-s3-bucket", + "Action": "CREATE" + }, + "Annotations": [ + { + "AnnotationName": "BlockPublicAccessCheck", + "Status": "FAILED", + "StatusMessage": "Bucket does not block public access", + "RemediationMessage": "Enable block public access settings on the S3 bucket", + "SeverityLevel": "HIGH" + }, + { + "AnnotationName": "BucketEncryptionCheck", + "Status": "PASSED", + "StatusMessage": "Bucket has encryption configured correctly" + } + ] + } + +For a description of the fields in the response, see [GetHookResult](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_GetHookResult.html) in the _AWS CloudFormation API Reference_. +