AWS Security ChangesHomeSearch

AWS controltower documentation change

Service: controltower · 2025-11-19 · Documentation low

File: controltower/latest/controlreference/codebuild-rules.md

Summary

Updated documentation to remove 'AWS' prefix from CloudFormation references in multiple sections, standardizing terminology to 'CloudFormation'

Security assessment

Changes are purely branding/terminology updates (AWS CloudFormation → CloudFormation) without altering security controls or requirements. The security-related rules (CT.CODEBUILD.PR.1 through PR.6) remain unchanged in their intent to enforce secure configurations like encrypted artifacts and proper credential handling.

Diff

diff --git a/controltower/latest/controlreference/codebuild-rules.md b/controltower/latest/controlreference/codebuild-rules.md
index 49468f1b8..01d558494 100644
--- a//controltower/latest/controlreference/codebuild-rules.md
+++ b//controltower/latest/controlreference/codebuild-rules.md
@@ -30 +30 @@ This control checks whether the GitHub or Bitbucket source repository URL contai
-  * **Implementation:** AWS CloudFormation Guard Rule
+  * **Implementation:** CloudFormation Guard Rule
@@ -36 +36 @@ This control checks whether the GitHub or Bitbucket source repository URL contai
-  * **AWS CloudFormation guard rule:** CT.CODEBUILD.PR.1 rule specification
+  * **CloudFormation guard rule:** CT.CODEBUILD.PR.1 rule specification
@@ -229 +229 @@ AWS CodeBuild project configured with primary and secondary source locations tha
-    #   AWS CloudFormation, AWS CloudFormation hook
+    #   CloudFormation, CloudFormation hook
@@ -236 +236 @@ AWS CodeBuild project configured with primary and secondary source locations tha
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -240 +240 @@ AWS CodeBuild project configured with primary and secondary source locations tha
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -247 +247 @@ AWS CodeBuild project configured with primary and secondary source locations tha
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -254 +254 @@ AWS CodeBuild project configured with primary and secondary source locations tha
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -262 +262 @@ AWS CodeBuild project configured with primary and secondary source locations tha
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -271 +271 @@ AWS CodeBuild project configured with primary and secondary source locations tha
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -499 +499 @@ This control checks whether AWS CodeBuild projects contain environment variables
-  * **Implementation:** AWS CloudFormation Guard Rule
+  * **Implementation:** CloudFormation Guard Rule
@@ -505 +505 @@ This control checks whether AWS CodeBuild projects contain environment variables
-  * **AWS CloudFormation guard rule:** CT.CODEBUILD.PR.2 rule specification
+  * **CloudFormation guard rule:** CT.CODEBUILD.PR.2 rule specification
@@ -636 +636 @@ AWS CodeBuild project configured to use credentials stored in AWS Secrets Manage
-    #   AWS CloudFormation, AWS CloudFormation Hook
+    #   CloudFormation, CloudFormation Hook
@@ -643 +643 @@ AWS CodeBuild project configured to use credentials stored in AWS Secrets Manage
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -647 +647 @@ AWS CodeBuild project configured to use credentials stored in AWS Secrets Manage
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -652 +652 @@ AWS CodeBuild project configured to use credentials stored in AWS Secrets Manage
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -660 +660 @@ AWS CodeBuild project configured to use credentials stored in AWS Secrets Manage
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -667 +667 @@ AWS CodeBuild project configured to use credentials stored in AWS Secrets Manage
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -673 +673 @@ AWS CodeBuild project configured to use credentials stored in AWS Secrets Manage
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -894 +894 @@ This control checks whether AWS CodeBuild projects environment has at least one
-  * **Implementation:** AWS CloudFormation Guard Rule
+  * **Implementation:** CloudFormation Guard Rule
@@ -900 +900 @@ This control checks whether AWS CodeBuild projects environment has at least one
-  * **AWS CloudFormation guard rule:** CT.CODEBUILD.PR.3 rule specification
+  * **CloudFormation guard rule:** CT.CODEBUILD.PR.3 rule specification
@@ -1082 +1082 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #   AWS CloudFormation, AWS CloudFormation hook
+    #   CloudFormation, CloudFormation hook
@@ -1089 +1089 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1093 +1093 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1098 +1098 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1104 +1104 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1111 +1111 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1118 +1118 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1124 +1124 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1133 +1133 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1140 +1140 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1148 +1148 @@ AWS CodeBuild project configured to enable logging, by means of Amazon S3. The e
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1405 +1405 @@ This control checks whether AWS CodeBuild projects are configured to encrypt art
-  * **Implementation:** AWS CloudFormation Guard Rule
+  * **Implementation:** CloudFormation Guard Rule
@@ -1411 +1411 @@ This control checks whether AWS CodeBuild projects are configured to encrypt art
-  * **AWS CloudFormation guard rule:** CT.CODEBUILD.PR.5 rule specification
+  * **CloudFormation guard rule:** CT.CODEBUILD.PR.5 rule specification
@@ -1444 +1444 @@ The examples that follow show how to implement this remediation.
-AWS CodeBuild project configured to return primary artifacts as output with artifact encryption enabled, by means of AWS CloudFormation defaults. The example is shown in JSON and in YAML.
+AWS CodeBuild project configured to return primary artifacts as output with artifact encryption enabled, by means of CloudFormation defaults. The example is shown in JSON and in YAML.
@@ -1618 +1618 @@ AWS CodeBuild project configured to return primary and secondary artifacts as ou
-    #   AWS CloudFormation, AWS CloudFormation hook
+    #   CloudFormation, CloudFormation hook
@@ -1625 +1625 @@ AWS CodeBuild project configured to return primary and secondary artifacts as ou
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1629 +1629 @@ AWS CodeBuild project configured to return primary and secondary artifacts as ou
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1635 +1635 @@ AWS CodeBuild project configured to return primary and secondary artifacts as ou
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1642 +1642 @@ AWS CodeBuild project configured to return primary and secondary artifacts as ou
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1648 +1648 @@ AWS CodeBuild project configured to return primary and secondary artifacts as ou
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1654 +1654 @@ AWS CodeBuild project configured to return primary and secondary artifacts as ou
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -1937 +1937 @@ This control checks whether AWS CodeBuild projects configured with Amazon S3 log
-  * **Implementation:** AWS CloudFormation Guard Rule
+  * **Implementation:** CloudFormation Guard Rule
@@ -1943 +1943 @@ This control checks whether AWS CodeBuild projects configured with Amazon S3 log
-  * **AWS CloudFormation guard rule:** CT.CODEBUILD.PR.6 rule specification
+  * **CloudFormation guard rule:** CT.CODEBUILD.PR.6 rule specification
@@ -1976 +1976 @@ The examples that follow show how to implement this remediation.
-AWS CodeBuild project configured to encrypt logs delivered to an Amazon S3 logging destination, by means of AWS CloudFormation defaults. The example is shown in JSON and in YAML.
+AWS CodeBuild project configured to encrypt logs delivered to an Amazon S3 logging destination, by means of CloudFormation defaults. The example is shown in JSON and in YAML.
@@ -2147 +2147 @@ AWS CodeBuild project configured to encrypt logs delivered to an Amazon S3 loggi
-    #   AWS CloudFormation, AWS CloudFormation hook
+    #   CloudFormation, CloudFormation hook
@@ -2154 +2154 @@ AWS CodeBuild project configured to encrypt logs delivered to an Amazon S3 loggi
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -2158 +2158 @@ AWS CodeBuild project configured to encrypt logs delivered to an Amazon S3 loggi
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -2163 +2163 @@ AWS CodeBuild project configured to encrypt logs delivered to an Amazon S3 loggi
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -2168 +2168 @@ AWS CodeBuild project configured to encrypt logs delivered to an Amazon S3 loggi
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -2174 +2174 @@ AWS CodeBuild project configured to encrypt logs delivered to an Amazon S3 loggi
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document
@@ -2180 +2180 @@ AWS CodeBuild project configured to encrypt logs delivered to an Amazon S3 loggi
-    #     Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document
+    #     Given: The input document is an CloudFormation or CloudFormation hook document