AWS AWSCloudFormation documentation change
Summary
Updated documentation to use 'CloudFormation' instead of 'AWS CloudFormation' in multiple sections for consistency, including StackSets references, linter tools, workshop links, and service role documentation.
Security assessment
Changes are branding/terminology updates rather than substantive security content modifications. No new security guidance added or vulnerabilities addressed. References to IAM, least privilege, and sensitive parameters remain unchanged.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/best-practices.md b/AWSCloudFormation/latest/UserGuide/best-practices.md index 9ce68e7b6..71d57813e 100644 --- a//AWSCloudFormation/latest/UserGuide/best-practices.md +++ b//AWSCloudFormation/latest/UserGuide/best-practices.md @@ -5 +5 @@ -Shorten the feedback loop to improve development velocityOrganize your stacks by lifecycle and ownershipUse cross-stack references to return the value of an output exported by another stackUse AWS CloudFormation StackSets for multi-account and multi-region deploymentsVerify quotas for all resource typesReuse templates to replicate stacks in multiple environmentsUse modules to reuse resource configurationsAdopt infrastructure as code practicesDon't embed credentials in your templatesUse AWS-specific parameter typesUse parameter constraintsUse pseudo parameters to promote portabilityUse AWS::CloudFormation::Init to deploy software applications on Amazon EC2 instancesUse the latest helper scriptsValidate templates before using themUsing YAML or JSON for template authoringImplement a comprehensive tagging strategyLeverage template macros for advanced transformationsManage all stack resources through CloudFormationCreate change sets before updating your stacksUse stack policies to protect resourcesUse AWS CloudTrail to log CloudFormation callsUse code reviews and revision controls to manage your templatesUpdate your Amazon EC2 instances regularlyUse drift detection regularlyConfigure rollback triggers for automatic recoveryImplement effective stack refactoring strategiesUse CloudFormation Hooks for lifecycle managementUse IaC Generator to create templates from existing resourcesUse AWS Infrastructure Composer for visual template designConsider using AWS Cloud Development Kit (AWS CDK) for complex infrastructureUse IAM to control accessApply the principle of least privilegeSecure sensitive parametersImplement policy as code with AWS CloudFormation Guard +Shorten the feedback loop to improve development velocityOrganize your stacks by lifecycle and ownershipUse cross-stack references to return the value of an output exported by another stackUse CloudFormation StackSets for multi-account and multi-region deploymentsVerify quotas for all resource typesReuse templates to replicate stacks in multiple environmentsUse modules to reuse resource configurationsAdopt infrastructure as code practicesDon't embed credentials in your templatesUse AWS-specific parameter typesUse parameter constraintsUse pseudo parameters to promote portabilityUse AWS::CloudFormation::Init to deploy software applications on Amazon EC2 instancesUse the latest helper scriptsValidate templates before using themUsing YAML or JSON for template authoringImplement a comprehensive tagging strategyLeverage template macros for advanced transformationsManage all stack resources through CloudFormationCreate change sets before updating your stacksUse stack policies to protect resourcesUse AWS CloudTrail to log CloudFormation callsUse code reviews and revision controls to manage your templatesUpdate your Amazon EC2 instances regularlyUse drift detection regularlyConfigure rollback triggers for automatic recoveryImplement effective stack refactoring strategiesUse CloudFormation Hooks for lifecycle managementUse IaC Generator to create templates from existing resourcesUse AWS Infrastructure Composer for visual template designConsider using AWS Cloud Development Kit (AWS CDK) for complex infrastructureUse IAM to control accessApply the principle of least privilegeSecure sensitive parametersImplement policy as code with AWS CloudFormation Guard @@ -20 +20 @@ Best practices are recommendations that can help you use CloudFormation more eff - * Use AWS CloudFormation StackSets for multi-account and multi-region deployments + * Use CloudFormation StackSets for multi-account and multi-region deployments @@ -115 +115 @@ Adopt practices and tools that help you shorten the feedback loop for your infra -Tooling choices that help you achieve fail-fast practices include the [AWS CloudFormation Linter](https://github.com/aws-cloudformation/cfn-lint) (`cfn-lint`) and [TaskCat](https://github.com/aws-ia/taskcat) command line tools. The `cfn-lint` tool gives you the ability to validate your CloudFormation templates against the [AWS CloudFormation Resource Specification](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/cfn-resource-specification.html). This includes checking valid values for resource properties, as well as best practices. Plugins for `cfn-lint` are [available for a number of code editors](https://github.com/aws-cloudformation/cfn-lint#editor-plugins); this gives you the ability to visualize issues within your editor and to get direct linter feedback. You can also choose to integrate `cfn-lint` in your source code repository’s configuration, so that you can perform template validation when you commit your contributions. For more information, see [Git pre-commit validation of AWS CloudFormation templates with `cfn-lint`](https://aws.amazon.com/blogs/mt/git-pre-commit-validation-of-aws-cloudformation-templates-with-cfn-lint/). Once you have performed your initial linting—and fixed any issues `cfn-lint` might have raised—you can use TaskCat to test your templates by programmatically creating stacks in the AWS Regions you choose. TaskCat also generates a report with a pass/fail grades for each Region you chose. +Tooling choices that help you achieve fail-fast practices include the [CloudFormation Linter](https://github.com/aws-cloudformation/cfn-lint) (`cfn-lint`) and [TaskCat](https://github.com/aws-ia/taskcat) command line tools. The `cfn-lint` tool gives you the ability to validate your CloudFormation templates against the [CloudFormation Resource Specification](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/cfn-resource-specification.html). This includes checking valid values for resource properties, as well as best practices. Plugins for `cfn-lint` are [available for a number of code editors](https://github.com/aws-cloudformation/cfn-lint#editor-plugins); this gives you the ability to visualize issues within your editor and to get direct linter feedback. You can also choose to integrate `cfn-lint` in your source code repository’s configuration, so that you can perform template validation when you commit your contributions. For more information, see [Git pre-commit validation of CloudFormation templates with `cfn-lint`](https://aws.amazon.com/blogs/mt/git-pre-commit-validation-of-aws-cloudformation-templates-with-cfn-lint/). Once you have performed your initial linting—and fixed any issues `cfn-lint` might have raised—you can use TaskCat to test your templates by programmatically creating stacks in the AWS Regions you choose. TaskCat also generates a report with a pass/fail grades for each Region you chose. @@ -117 +117 @@ Tooling choices that help you achieve fail-fast practices include the [AWS Cloud -For a step-by-step, hands-on walkthrough on how to use both tools to shorten the feedback loop, follow the [Linting and Testing lab](https://catalog.workshops.aws/cfn101/en-US/basics/templates/linting-and-testing) of the [AWS CloudFormation Workshop](https://catalog.workshops.aws/cfn101/en-US). +For a step-by-step, hands-on walkthrough on how to use both tools to shorten the feedback loop, follow the [Linting and Testing lab](https://catalog.workshops.aws/cfn101/en-US/basics/templates/linting-and-testing) of the [CloudFormation Workshop](https://catalog.workshops.aws/cfn101/en-US). @@ -137 +137 @@ For example, you might have a network stack that includes a VPC, a security grou -## Use AWS CloudFormation StackSets for multi-account and multi-region deployments +## Use CloudFormation StackSets for multi-account and multi-region deployments @@ -139 +139 @@ For example, you might have a network stack that includes a VPC, a security grou -AWS CloudFormation StackSets extend the capability of stacks by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation. Use StackSets for deploying common infrastructure components, compliance controls, or shared services across your organization. +CloudFormation StackSets extend the capability of stacks by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation. Use StackSets for deploying common infrastructure components, compliance controls, or shared services across your organization. @@ -210 +210 @@ The CloudFormation helper scripts are updated periodically. Be sure you include -For more information about getting the latest helper scripts, see the [CloudFormation helper scripts reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/cfn-helper-scripts-reference.html) in the _AWS CloudFormation Template Reference Guide_. +For more information about getting the latest helper scripts, see the [CloudFormation helper scripts reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/cfn-helper-scripts-reference.html) in the _CloudFormation Template Reference Guide_. @@ -298 +298 @@ AWS CloudTrail tracks anyone making CloudFormation API calls in your AWS account -For more information, see [Logging AWS CloudFormation API calls with AWS CloudTrail](./cfn-api-logging-cloudtrail.html). +For more information, see [Logging CloudFormation API calls with AWS CloudTrail](./cfn-api-logging-cloudtrail.html). @@ -399 +399 @@ IAM is an AWS service that you can use to manage users and their permissions in -In most cases, users require full access to manage all of the resources in a template. CloudFormation makes calls to create, modify, and delete those resources on their behalf. To separate permissions between a user and the CloudFormation service, use a service role. CloudFormation uses the service role's policy to make calls instead of the user's policy. For more information, see [AWS CloudFormation service role](./using-iam-servicerole.html). +In most cases, users require full access to manage all of the resources in a template. CloudFormation makes calls to create, modify, and delete those resources on their behalf. To separate permissions between a user and the CloudFormation service, use a service role. CloudFormation uses the service role's policy to make calls instead of the user's policy. For more information, see [CloudFormation service role](./using-iam-servicerole.html).