AWS cli documentation change
Summary
Added documentation for drift detection features including StackDriftStatus, ResourceDriftStatus, ResourceDriftIgnoredAttributes, DeploymentMode, and related parameters. Updated action types to include SyncWithActual and NoModification.
Security assessment
The changes document drift detection capabilities and remediation options (like REVERT_DRIFT deployment mode) which help identify configuration mismatches. While drift detection improves security posture by detecting unauthorized changes, there is no evidence this addresses a specific security vulnerability. The documentation adds information about security-related features for maintaining stack integrity.
Diff
diff --git a/cli/latest/reference/cloudformation/describe-change-set.md b/cli/latest/reference/cloudformation/describe-change-set.md index cecfaa98f..4bd1eda8b 100644 --- a//cli/latest/reference/cloudformation/describe-change-set.md +++ b//cli/latest/reference/cloudformation/describe-change-set.md @@ -15 +15 @@ - * [AWS CLI 2.31.37 Command Reference](../../index.html) » + * [AWS CLI 2.31.39 Command Reference](../../index.html) » @@ -416,0 +417,22 @@ StatusReason -> (string) +StackDriftStatus -> (string) + +> The drift status of the stack when the change set was created. Valid values: +> +> * `DRIFTED` – The stack has drifted from its last deployment. +> * `IN_SYNC` – The stack is in sync with its last deployment. +> * `NOT_CHECKED` – CloudFormation doesn’t currently return this value. +> * `UNKNOWN` – The drift status could not be determined. +> + +> +> Only present for drift-aware change sets. +> +> Possible values: +> +> * `DRIFTED` +> * `IN_SYNC` +> * `UNKNOWN` +> * `NOT_CHECKED` +> + + @@ -597 +619 @@ Changes -> (list) ->>>> The action that CloudFormation takes on the resource, such as `Add` (adds a new resource), `Modify` (changes a resource), `Remove` (deletes a resource), `Import` (imports a resource), or `Dynamic` (exact action for the resource can’t be determined). +>>>> The action that CloudFormation takes on the resource, such as `Add` (adds a new resource), `Modify` (changes a resource), `Remove` (deletes a resource), `Import` (imports a resource), `Dynamic` (exact action for the resource can’t be determined), or `SyncWithActual` (resource will not be changed, only CloudFormation metadata will change). @@ -605,0 +628 @@ Changes -> (list) +>>>> * `SyncWithActual` @@ -658,0 +682,54 @@ Changes -> (list) +>>> +>>> ResourceDriftStatus -> (string) +>>> +>>>> The drift status of the resource. Valid values: +>>>> +>>>> * `IN_SYNC` – The resource matches its template definition. +>>>> * `MODIFIED` – Resource properties were modified outside CloudFormation. +>>>> * `DELETED` – The resource was deleted outside CloudFormation. +>>>> * `NOT_CHECKED` – CloudFormation doesn’t currently return this value. +>>>> * `UNKNOWN` – Drift status could not be determined. +>>>> * `UNSUPPORTED` – Resource type does not support actual state comparison. +>>>> + +>>>> +>>>> Only present for drift-aware change sets. +>>>> +>>>> Possible values: +>>>> +>>>> * `IN_SYNC` +>>>> * `MODIFIED` +>>>> * `DELETED` +>>>> * `NOT_CHECKED` +>>>> * `UNKNOWN` +>>>> * `UNSUPPORTED` +>>>> + +>>> +>>> ResourceDriftIgnoredAttributes -> (list) +>>> +>>>> List of resource attributes for which drift was ignored. +>>>> +>>>> (structure) +>>>> +>>>>> The `ResourceDriftIgnoredAttribute` data type. +>>>>> +>>>>> Path -> (string) +>>>>> +>>>>>> Path of the resource attribute for which drift was ignored. +>>>>> +>>>>> Reason -> (string) +>>>>> +>>>>>> Reason why drift was ignored for the attribute, can have 2 possible values: +>>>>>> +>>>>>> * `WRITE_ONLY_PROPERTY` \- Property is not included in read response for the resource’s live state. +>>>>>> * `MANAGED_BY_AWS` \- Property is managed by an Amazon Web Services service and is expected to be dynamically modified. +>>>>>> + +>>>>>> +>>>>>> Possible values: +>>>>>> +>>>>>> * `MANAGED_BY_AWS` +>>>>>> * `WRITE_ONLY_PROPERTY` +>>>>>> + @@ -715,0 +793,50 @@ Changes -> (list) +>>>>>> BeforeValueFrom -> (string) +>>>>>> +>>>>>>> Indicates the source of the before value. Valid values: +>>>>>>> +>>>>>>> * `ACTUAL_STATE` – The before value represents current actual state. +>>>>>>> * `PREVIOUS_DEPLOYMENT_STATE` – The before value represents the previous CloudFormation deployment state. +>>>>>>> + +>>>>>>> +>>>>>>> Only present for drift-aware change sets. +>>>>>>> +>>>>>>> Possible values: +>>>>>>> +>>>>>>> * `PREVIOUS_DEPLOYMENT_STATE` +>>>>>>> * `ACTUAL_STATE` +>>>>>>> + +>>>>>> +>>>>>> AfterValueFrom -> (string) +>>>>>> +>>>>>>> Indicates the source of the after value. Valid value: +>>>>>>> +>>>>>>> * `TEMPLATE` – The after value comes from the new template. +>>>>>>> + +>>>>>>> +>>>>>>> Only present for drift-aware change sets. +>>>>>>> +>>>>>>> Possible values: +>>>>>>> +>>>>>>> * `TEMPLATE` +>>>>>>> + +>>>>>> +>>>>>> Drift -> (structure) +>>>>>> +>>>>>>> Detailed drift information for the resource property, including actual values, previous deployment values, and drift detection timestamps. +>>>>>>> +>>>>>>> PreviousValue -> (string) +>>>>>>> +>>>>>>>> The configuration value from the previous CloudFormation deployment. +>>>>>>> +>>>>>>> ActualValue -> (string) +>>>>>>> +>>>>>>>> The current live configuration value of the resource property. +>>>>>>> +>>>>>>> DriftDetectionTimestamp -> (timestamp) +>>>>>>> +>>>>>>>> The timestamp when drift was detected for this resource property. +>>>>>> @@ -722,0 +850 @@ Changes -> (list) +>>>>>>> * `SyncWithActual` The drift status of this item will be reset but the item will not be modified. @@ -730,0 +859 @@ Changes -> (list) +>>>>>>> * `SyncWithActual` @@ -757,0 +887 @@ Changes -> (list) +>>>>>> * `NoModification` entities are changes made to the template that matches the actual state of the resource. @@ -767,0 +898 @@ Changes -> (list) +>>>>>> * `NoModification` @@ -816,0 +948,4 @@ Changes -> (list) +>>> +>>> PreviousDeploymentContext -> (string) +>>> +>>>> Information about the resource’s state from the previous CloudFormation deployment. @@ -880,0 +1016,10 @@ ImportExistingResources -> (boolean) +DeploymentMode -> (string) + +> The deployment mode specified when the change set was created. Valid value is `REVERT_DRIFT` . Only present for drift-aware change sets. +> +> Possible values: +> +> * `REVERT_DRIFT` +> + + @@ -891 +1036 @@ ImportExistingResources -> (boolean) - * [AWS CLI 2.31.37 Command Reference](../../index.html) » + * [AWS CLI 2.31.39 Command Reference](../../index.html) »