AWS controltower documentation change
Summary
Updated references from 'AWS CloudFormation' to 'CloudFormation' throughout the document, removing redundant AWS branding from CloudFormation mentions in implementation details, guard rule specifications, and code examples.
Security assessment
The changes are purely cosmetic/terminology updates to align with naming conventions (removing 'AWS' prefix from CloudFormation references). No security controls, configurations, or vulnerability mitigations were modified or added. The security-related content (IMDSv2 enforcement, security group rules, encryption) remains substantively unchanged.
Diff
diff --git a/controltower/latest/controlreference/ec2-rules.md b/controltower/latest/controlreference/ec2-rules.md index a23070ea3..01ef00ff4 100644 --- a//controltower/latest/controlreference/ec2-rules.md +++ b//controltower/latest/controlreference/ec2-rules.md @@ -60 +60 @@ This control checks whether your Amazon EC2 launch templates are configured with - * **Implementation:** AWS CloudFormation guard rule + * **Implementation:** CloudFormation guard rule @@ -66 +66 @@ This control checks whether your Amazon EC2 launch templates are configured with - * **AWS CloudFormation guard rule:** CT.EC2.PR.1 rule specification + * **CloudFormation guard rule:** CT.EC2.PR.1 rule specification @@ -157 +157 @@ Amazon EC2 launch template configured with IMDSv2 activated. The example is show - # AWS CloudFormation, AWS CloudFormation hook + # CloudFormation, CloudFormation hook @@ -164 +164 @@ Amazon EC2 launch template configured with IMDSv2 activated. The example is show - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -168 +168 @@ Amazon EC2 launch template configured with IMDSv2 activated. The example is show - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -174 +174 @@ Amazon EC2 launch template configured with IMDSv2 activated. The example is show - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -182 +182 @@ Amazon EC2 launch template configured with IMDSv2 activated. The example is show - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -190 +190 @@ Amazon EC2 launch template configured with IMDSv2 activated. The example is show - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -341 +341 @@ This control checks whether an Amazon EC2 launch template has a metadata token h - * **Implementation:** AWS CloudFormation guard rule + * **Implementation:** CloudFormation guard rule @@ -347 +347 @@ This control checks whether an Amazon EC2 launch template has a metadata token h - * **AWS CloudFormation guard rule:** CT.EC2.PR.2 rule specification + * **CloudFormation guard rule:** CT.EC2.PR.2 rule specification @@ -378 +378 @@ The Time To Live (TTL) field in the IP packet is reduced by one on every hop. Th -Within the `LaunchTemplateData` property, provide a `MetadataOptions` configuration with the value of `HttpPutResponseLimit` set to `1`, or omit the `HttpPutResponseLimit` property to adopt the AWS CloudFormation default value of `1`. +Within the `LaunchTemplateData` property, provide a `MetadataOptions` configuration with the value of `HttpPutResponseLimit` set to `1`, or omit the `HttpPutResponseLimit` property to adopt the CloudFormation default value of `1`. @@ -384 +384 @@ The examples that follow show how to implement this remediation. -Amazon EC2 launch template configured with access to instance metadata enabled and a token hop limit of `1`, set by means of AWS CloudFormation defaults. The example is shown in JSON and in YAML. +Amazon EC2 launch template configured with access to instance metadata enabled and a token hop limit of `1`, set by means of CloudFormation defaults. The example is shown in JSON and in YAML. @@ -469 +469 @@ Amazon EC2 launch template configured with access to instance metadata enabled a - # AWS CloudFormation, AWS CloudFormation hook + # CloudFormation, CloudFormation hook @@ -476 +476 @@ Amazon EC2 launch template configured with access to instance metadata enabled a - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -480 +480 @@ Amazon EC2 launch template configured with access to instance metadata enabled a - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -486 +486 @@ Amazon EC2 launch template configured with access to instance metadata enabled a - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -495 +495 @@ Amazon EC2 launch template configured with access to instance metadata enabled a - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -500 +500 @@ Amazon EC2 launch template configured with access to instance metadata enabled a - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -508 +508 @@ Amazon EC2 launch template configured with access to instance metadata enabled a - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -536 +536 @@ Amazon EC2 launch template configured with access to instance metadata enabled a - [FIX]: Within the 'LaunchTemplateData' property, provide a 'MetadataOptions' configuration with the value of 'HttpPutResponseLimit' set to '1', or omit the 'HttpPutResponseLimit' property to adopt the AWS CloudFormation default value of '1'. + [FIX]: Within the 'LaunchTemplateData' property, provide a 'MetadataOptions' configuration with the value of 'HttpPutResponseLimit' set to '1', or omit the 'HttpPutResponseLimit' property to adopt the CloudFormation default value of '1'. @@ -544 +544 @@ Amazon EC2 launch template configured with access to instance metadata enabled a - [FIX]: Within the 'LaunchTemplateData' property, provide a 'MetadataOptions' configuration with the value of 'HttpPutResponseLimit' set to '1', or omit the 'HttpPutResponseLimit' property to adopt the AWS CloudFormation default value of '1'. + [FIX]: Within the 'LaunchTemplateData' property, provide a 'MetadataOptions' configuration with the value of 'HttpPutResponseLimit' set to '1', or omit the 'HttpPutResponseLimit' property to adopt the CloudFormation default value of '1'. @@ -646 +646 @@ This control checks whether an Amazon EC2 security group rule contains the strin - * **Implementation:** AWS CloudFormation Guard Rule + * **Implementation:** CloudFormation Guard Rule @@ -652 +652 @@ This control checks whether an Amazon EC2 security group rule contains the strin - * **AWS CloudFormation guard rule:** CT.EC2.PR.3 rule specification + * **CloudFormation guard rule:** CT.EC2.PR.3 rule specification @@ -661 +661 @@ This control checks whether an Amazon EC2 security group rule contains the strin - * For examples of PASS and FAIL AWS CloudFormation Templates related to this control, see: CT.EC2.PR.3 example templates + * For examples of PASS and FAIL CloudFormation Templates related to this control, see: CT.EC2.PR.3 example templates @@ -793 +793 @@ Amazon EC2 Security Group allowing inbound TCP traffic from `0.0.0.0/0` on port - # AWS CloudFormation, AWS CloudFormation hook + # CloudFormation, CloudFormation hook @@ -800 +800 @@ Amazon EC2 Security Group allowing inbound TCP traffic from `0.0.0.0/0` on port - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -804 +804 @@ Amazon EC2 Security Group allowing inbound TCP traffic from `0.0.0.0/0` on port - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -810 +810 @@ Amazon EC2 Security Group allowing inbound TCP traffic from `0.0.0.0/0` on port - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -818 +818 @@ Amazon EC2 Security Group allowing inbound TCP traffic from `0.0.0.0/0` on port - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -827 +827 @@ Amazon EC2 Security Group allowing inbound TCP traffic from `0.0.0.0/0` on port - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1030 +1030 @@ This control checks whether an Amazon EC2 security group rule that contains the - * **Implementation:** AWS CloudFormation Guard Rule + * **Implementation:** CloudFormation Guard Rule @@ -1036 +1036 @@ This control checks whether an Amazon EC2 security group rule that contains the - * **AWS CloudFormation guard rule:** CT.EC2.PR.4 rule specification + * **CloudFormation guard rule:** CT.EC2.PR.4 rule specification @@ -1178 +1178 @@ Amazon EC2 security group ingress rule configured to allow traffic from the sour - # AWS CloudFormation, AWS CloudFormation Hook + # CloudFormation, CloudFormation Hook @@ -1185 +1185 @@ Amazon EC2 security group ingress rule configured to allow traffic from the sour - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1189 +1189 @@ Amazon EC2 security group ingress rule configured to allow traffic from the sour - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1195 +1195 @@ Amazon EC2 security group ingress rule configured to allow traffic from the sour - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1203 +1203 @@ Amazon EC2 security group ingress rule configured to allow traffic from the sour - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1212 +1212 @@ Amazon EC2 security group ingress rule configured to allow traffic from the sour - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1412 +1412 @@ This control checks whether the Amazon EC2 network ACL inbound entry allows unre - * **Implementation:** AWS CloudFormation Guard Rule + * **Implementation:** CloudFormation Guard Rule @@ -1418 +1418 @@ This control checks whether the Amazon EC2 network ACL inbound entry allows unre - * **AWS CloudFormation guard rule:** CT.EC2.PR.5 rule specification + * **CloudFormation guard rule:** CT.EC2.PR.5 rule specification @@ -1560 +1560 @@ Amazon EC2 network ACL entry configured to allow unrestricted inbound IPv6 UDP t - # AWS CloudFormation, AWS CloudFormation hook + # CloudFormation, CloudFormation hook @@ -1567 +1567 @@ Amazon EC2 network ACL entry configured to allow unrestricted inbound IPv6 UDP t - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1571 +1571 @@ Amazon EC2 network ACL entry configured to allow unrestricted inbound IPv6 UDP t - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1577 +1577 @@ Amazon EC2 network ACL entry configured to allow unrestricted inbound IPv6 UDP t - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1585 +1585 @@ Amazon EC2 network ACL entry configured to allow unrestricted inbound IPv6 UDP t - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1593 +1593 @@ Amazon EC2 network ACL entry configured to allow unrestricted inbound IPv6 UDP t - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1601 +1601 @@ Amazon EC2 network ACL entry configured to allow unrestricted inbound IPv6 UDP t - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1609 +1609 @@ Amazon EC2 network ACL entry configured to allow unrestricted inbound IPv6 UDP t - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1802 +1802 @@ This control checks whether Amazon EC2 transit gateways are configured to accept - * **Implementation:** AWS CloudFormation Guard Rule + * **Implementation:** CloudFormation Guard Rule @@ -1808 +1808 @@ This control checks whether Amazon EC2 transit gateways are configured to accept - * **AWS CloudFormation guard rule:** CT.EC2.PR.6 rule specification + * **CloudFormation guard rule:** CT.EC2.PR.6 rule specification @@ -1876 +1876 @@ AWS Transit Gateway configured to deactivate auto-acceptance of cross-account Am - # AWS CloudFormation, AWS CloudFormation hook + # CloudFormation, CloudFormation hook @@ -1883 +1883 @@ AWS Transit Gateway configured to deactivate auto-acceptance of cross-account Am - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1887 +1887 @@ AWS Transit Gateway configured to deactivate auto-acceptance of cross-account Am - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1892 +1892 @@ AWS Transit Gateway configured to deactivate auto-acceptance of cross-account Am - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1897 +1897 @@ AWS Transit Gateway configured to deactivate auto-acceptance of cross-account Am - # Given: The input document is an AWS CloudFormation or AWS CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -1993 +1993 @@ This control checks whether your standalone Amazon EC2 EBS volume and Amazon Ela - * **Implementation:** AWS CloudFormation Guard Rule + * **Implementation:** CloudFormation Guard Rule @@ -1999 +1999 @@ This control checks whether your standalone Amazon EC2 EBS volume and Amazon Ela - * **AWS CloudFormation guard rule:** CT.EC2.PR.7 rule specification + * **CloudFormation guard rule:** CT.EC2.PR.7 rule specification @@ -2163 +2163 @@ Amazon EBS Volume with encryption configured. The example is shown in JSON and i - # AWS CloudFormation, CloudFormation hook + # CloudFormation, CloudFormation hook @@ -2170 +2170 @@ Amazon EBS Volume with encryption configured. The example is shown in JSON and i - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -2174 +2174 @@ Amazon EBS Volume with encryption configured. The example is shown in JSON and i - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -2179 +2179 @@ Amazon EBS Volume with encryption configured. The example is shown in JSON and i - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -2186 +2186 @@ Amazon EBS Volume with encryption configured. The example is shown in JSON and i - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -2193 +2193 @@ Amazon EBS Volume with encryption configured. The example is shown in JSON and i - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -2198 +2198 @@ Amazon EBS Volume with encryption configured. The example is shown in JSON and i - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -2203 +2203 @@ Amazon EBS Volume with encryption configured. The example is shown in JSON and i - # Given: The input document is an AWS CloudFormation or CloudFormation hook document + # Given: The input document is an CloudFormation or CloudFormation hook document @@ -2210 +2210 @@ Amazon EBS Volume with encryption configured. The example is shown in JSON and i