AWS cli medium security documentation change

Service: cli · 2025-11-19 · Security-related medium

File: cli/latest/reference/resourcegroupstaggingapi/tag-resources.md

Summary

Added warning about CloudFormation stack updates, corrected permissions, and added service-specific tagging requirements

Security assessment

Added security note about unintended resource updates when tagging CloudFormation stacks and documented service-specific permission requirements. Corrected permission from tag:TagResource to tag:TagResources to prevent permission misconfiguration.

Diff

diff --git a/cli/latest/reference/resourcegroupstaggingapi/tag-resources.md b/cli/latest/reference/resourcegroupstaggingapi/tag-resources.md
index d6761d935..6808f49b6 100644
--- a//cli/latest/reference/resourcegroupstaggingapi/tag-resources.md
+++ b//cli/latest/reference/resourcegroupstaggingapi/tag-resources.md
@@ -15 +15 @@
-  * [AWS CLI 2.31.37 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.39 Command Reference](../../index.html) »
@@ -65,0 +66 @@ Applies one or more tags to the specified resources. Note the following:
+  * When you use the [Amazon Web Services Resource Groups Tagging API](https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/overview.html) to update tags for Amazon Web Services CloudFormation stack sets, Amazon Web Services calls the Amazon Web Services CloudFormation ``UpdateStack` <https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_UpdateStack>.html`__ operation. This operation may initiate additional resource property updates in addition to the desired tag updates. To avoid unexpected resource updates, Amazon Web Services recommends that you only apply or update tags to your CloudFormation stack sets using Amazon Web Services CloudFormation.
@@ -77 +78 @@ In addition to the `tag:TagResources` permission required by this operation, you
-  * `tag:TagResource`
+  * `tag:TagResources`
@@ -81,0 +83,4 @@ In addition to the `tag:TagResources` permission required by this operation, you
+### Note
+
+In addition, some services might have specific requirements for tagging some types of resources. For example, to tag an Amazon S3 bucket, you must also have the `s3:GetBucketTagging` permission. If the expected minimum permissions don’t work, check the documentation for that service’s tagging APIs for more information.
+
@@ -370 +375 @@ FailedResourcesMap -> (map)
-  * [AWS CLI 2.31.37 Command Reference](../../index.html) »
+  * [AWS CLI 2.31.39 Command Reference](../../index.html) »