AWS controltower documentation change
Summary
Updated terminology from 'AWS CloudFormation' to 'CloudFormation' throughout the document for consistency
Security assessment
The changes are purely terminological updates replacing 'AWS CloudFormation' with 'CloudFormation'. No security vulnerabilities, weaknesses, or incidents are addressed. The modifications don't alter security controls (like CT.CLOUDFORMATION.PR.1) or introduce new security features.
Diff
diff --git a/controltower/latest/userguide/2024-all.md b/controltower/latest/userguide/2024-all.md index d118777bc..aa8972a24 100644 --- a//controltower/latest/userguide/2024-all.md +++ b//controltower/latest/userguide/2024-all.md @@ -5 +5 @@ -AWS Control Tower CfCT supports GitHub and RCPsAWS Control Tower adds preventive controls with declarative policiesAWS Control Tower adds prescriptive backup plan optionsAWS Control Tower integrates AWS Config controlsAWS Control Tower improves hook management and adds proactive control RegionsAWS Control Tower launches managed resource control policiesAWS Control Tower reports control policy driftNew ResetEnabledControl API Control catalog updates GetControl APIAWS Control Tower AFT supports GitLabAWS Control Tower available in AWS Asia Pacific (Malaysia) Region AWS Control Tower supports up to 1000 accounts per OUAWS Control Tower adds landing zone version selectionDescriptive control API available, expanded access to Regions and controlsAWS Control Tower supports AFT and CfCT in opt-in RegionsAWS Control Tower adds the ListLandingZoneOperations APIAWS Control Tower supports up to 100 concurrent control operationsAWS Control Tower available in AWS Canada West (Calgary)AWS Control Tower supports self-service quota adjustmentsAWS Control Tower releases the Controls Reference GuideAWS Control Tower updates and renames two proactive controlsDeprecated controls no longer availableAWS Control Tower supports tagging EnabledControl resources in AWS CloudFormationAWS Control Tower supports APIs for OU registration and configuration with baselines +AWS Control Tower CfCT supports GitHub and RCPsAWS Control Tower adds preventive controls with declarative policiesAWS Control Tower adds prescriptive backup plan optionsAWS Control Tower integrates AWS Config controlsAWS Control Tower improves hook management and adds proactive control RegionsAWS Control Tower launches managed resource control policiesAWS Control Tower reports control policy driftNew ResetEnabledControl API Control catalog updates GetControl APIAWS Control Tower AFT supports GitLabAWS Control Tower available in AWS Asia Pacific (Malaysia) Region AWS Control Tower supports up to 1000 accounts per OUAWS Control Tower adds landing zone version selectionDescriptive control API available, expanded access to Regions and controlsAWS Control Tower supports AFT and CfCT in opt-in RegionsAWS Control Tower adds the ListLandingZoneOperations APIAWS Control Tower supports up to 100 concurrent control operationsAWS Control Tower available in AWS Canada West (Calgary)AWS Control Tower supports self-service quota adjustmentsAWS Control Tower releases the Controls Reference GuideAWS Control Tower updates and renames two proactive controlsDeprecated controls no longer availableAWS Control Tower supports tagging EnabledControl resources in CloudFormationAWS Control Tower supports APIs for OU registration and configuration with baselines @@ -55 +55 @@ In 2024, AWS Control Tower released the following updates: - * AWS Control Tower supports tagging EnabledControl resources in AWS CloudFormation + * AWS Control Tower supports tagging EnabledControl resources in CloudFormation @@ -106 +106 @@ For more information, see [Integrated AWS Config controls available in AWS Contr -With this release, you can utilize the full capacity of AWS CloudFormation hooks, without restriction by AWS Control Tower. Also, proactive controls are available in the Canada West (Calgary) Region and Asia Pacific (Malaysia) Region. +With this release, you can utilize the full capacity of CloudFormation hooks, without restriction by AWS Control Tower. Also, proactive controls are available in the Canada West (Calgary) Region and Asia Pacific (Malaysia) Region. @@ -108 +108 @@ With this release, you can utilize the full capacity of AWS CloudFormation hooks -Previously, all AWS CloudFormation hooks in your environment needed to be protected by the **CT.CLOUDFORMATION.PR.1** control, so that only AWS Control Tower could modify them. With this release, you can deploy AWS CloudFormation hooks, and modify these hooks, without the restrictions that previously were required by the AWS Control Tower service. +Previously, all CloudFormation hooks in your environment needed to be protected by the **CT.CLOUDFORMATION.PR.1** control, so that only AWS Control Tower could modify them. With this release, you can deploy CloudFormation hooks, and modify these hooks, without the restrictions that previously were required by the AWS Control Tower service. @@ -112 +112 @@ If you currently deploy proactive controls, you can move to this improved hook f -After you reset any proactive control, remove the **CT.CLOUDFORMATION.PR.1** control on your AWS Control Tower OUs, unless you enabled that control for another purpose. If you don't turn off the **CT.CLOUDFORMATION.PR.1** control, you won't be able to create and modify your other AWS CloudFormation hooks. +After you reset any proactive control, remove the **CT.CLOUDFORMATION.PR.1** control on your AWS Control Tower OUs, unless you enabled that control for another purpose. If you don't turn off the **CT.CLOUDFORMATION.PR.1** control, you won't be able to create and modify your other CloudFormation hooks. @@ -177 +177 @@ For more information, see the [`GetControl` API](https://docs.aws.amazon.com/con - * All existing Hook controls have their `Implementation` parameter value changed from AWS CloudFormation guard rule to AWS CloudFormation hook. The corresponding console help panel is modified to reflect this change. + * All existing Hook controls have their `Implementation` parameter value changed from CloudFormation guard rule to CloudFormation hook. The corresponding console help panel is modified to reflect this change. @@ -208 +208 @@ AWS Control Tower has increased the maximum number of accounts allowed per organ -Some account limitations still apply due to the limitations on the number of AWS CloudFormation stack sets available. Specifically, the maximum number of accounts you can enroll in an OU may differ, depending on the number of Regions you have under governance. To learn more, visit [Limitations based on underlying AWS services](https://docs.aws.amazon.com/controltower/latest/userguide/region-stackset-limitations.html) in the [_AWS Control Tower User Guide_](https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html). For a full list of AWS Regions where AWS Control Tower is available, see the [AWS Region Table](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/). +Some account limitations still apply due to the limitations on the number of CloudFormation stack sets available. Specifically, the maximum number of accounts you can enroll in an OU may differ, depending on the number of Regions you have under governance. To learn more, visit [Limitations based on underlying AWS services](https://docs.aws.amazon.com/controltower/latest/userguide/region-stackset-limitations.html) in the [_AWS Control Tower User Guide_](https://docs.aws.amazon.com/controltower/latest/userguide/what-is-control-tower.html). For a full list of AWS Regions where AWS Control Tower is available, see the [AWS Region Table](https://aws.amazon.com/about-aws/global-infrastructure/regional-product-services/). @@ -251 +251 @@ Today, AWS Control Tower customization frameworks Account Factory for Terraform -Account Factory for Terraform (AFT) sets up a Terraform pipeline to help you provision and customize accounts in AWS Control Tower. Customizations for AWS Control Tower (CfCT) helps you customize your AWS Control Tower landing zone and accounts with AWS CloudFormation templates and service control policies (SCPs). +Account Factory for Terraform (AFT) sets up a Terraform pipeline to help you provision and customize accounts in AWS Control Tower. Customizations for AWS Control Tower (CfCT) helps you customize your AWS Control Tower landing zone and accounts with CloudFormation templates and service control policies (SCPs). @@ -373 +373 @@ AWS Control Tower has deprecated some controls. These controls are no longer ava -## AWS Control Tower supports tagging `EnabledControl` resources in AWS CloudFormation +## AWS Control Tower supports tagging `EnabledControl` resources in CloudFormation @@ -379 +379 @@ AWS Control Tower has deprecated some controls. These controls are no longer ava -This AWS Control Tower release updates the behavior of the `EnabledControl` resource, to align better with configurable controls, and to improve the ability to manage your AWS Control Tower environment with automation. With this release, you can add tags to configurable `EnabledControl` resources by means of AWS CloudFormation templates. Previously, you could add tags through the AWS Control Tower console and APIs only. +This AWS Control Tower release updates the behavior of the `EnabledControl` resource, to align better with configurable controls, and to improve the ability to manage your AWS Control Tower environment with automation. With this release, you can add tags to configurable `EnabledControl` resources by means of CloudFormation templates. Previously, you could add tags through the AWS Control Tower console and APIs only. @@ -383 +383 @@ The AWS Control Tower `GetEnabledControl`, `EnableControl`, and `ListTagsforReso -For more information, see [Tagging `EnabledControl` resources in AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/controlreference/tagging.html) and [`EnabledControl`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-controltower-enabledcontrol.html) in the _AWS CloudFormation User Guide_. +For more information, see [Tagging `EnabledControl` resources in AWS Control Tower](https://docs.aws.amazon.com/controltower/latest/controlreference/tagging.html) and [`EnabledControl`](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-controltower-enabledcontrol.html) in the _CloudFormation User Guide_. @@ -410 +410 @@ Specific baselines are compatible with specific AWS Control Tower landing zone v -With the new APIs and defined baselines, you can register OUs and automate your OU provisioning workflow. The APIs also can manage OUs that are already under AWS Control Tower governance, so you can re-register OUs after landing zone updates. The APIs include support for an AWS CloudFormation `EnabledBaseline` resource, which allows you to manage your OUs with infrastructure as code (IaC). +With the new APIs and defined baselines, you can register OUs and automate your OU provisioning workflow. The APIs also can manage OUs that are already under AWS Control Tower governance, so you can re-register OUs after landing zone updates. The APIs include support for an CloudFormation `EnabledBaseline` resource, which allows you to manage your OUs with infrastructure as code (IaC).