AWS documentdb documentation change
Summary
Updated references from 'AWS CloudFormation' to 'CloudFormation' throughout the document, removed redundant AWS branding from CloudFormation references, and maintained existing security recommendations about IAM policies and deletion protection.
Security assessment
Changes are primarily branding/naming convention updates (removing 'AWS' from CloudFormation references). No new security content was added, though existing security recommendations about IAM least privilege and deletion protection were preserved. No evidence of addressing a specific vulnerability or security incident.
Diff
diff --git a/documentdb/latest/developerguide/quick_start_cfn.md b/documentdb/latest/developerguide/quick_start_cfn.md index 51b5498b8..7d9e9b9f5 100644 --- a//documentdb/latest/developerguide/quick_start_cfn.md +++ b//documentdb/latest/developerguide/quick_start_cfn.md @@ -5 +5 @@ -PrerequisitesLaunching an Amazon DocumentDB AWS CloudFormation stackAccessing the Amazon DocumentDB clusterTermination protection and deletion protection +PrerequisitesLaunching an Amazon DocumentDB CloudFormation stackAccessing the Amazon DocumentDB clusterTermination protection and deletion protection @@ -7 +7 @@ PrerequisitesLaunching an Amazon DocumentDB AWS CloudFormation stackAccessing th -# Amazon DocumentDB quick start using AWS CloudFormation +# Amazon DocumentDB quick start using CloudFormation @@ -9 +9 @@ PrerequisitesLaunching an Amazon DocumentDB AWS CloudFormation stackAccessing th -This section contains steps and other information to help you get started quickly with Amazon DocumentDB (with MongoDB compatibility) using [AWS CloudFormation](https://docs.aws.amazon.com/en_us/AWSCloudFormation/latest/UserGuide/Welcome.html). For general information about Amazon DocumentDB, see [What is Amazon DocumentDB (with MongoDB compatibility)](./what-is.html). +This section contains steps and other information to help you get started quickly with Amazon DocumentDB (with MongoDB compatibility) using [CloudFormation](https://docs.aws.amazon.com/en_us/AWSCloudFormation/latest/UserGuide/Welcome.html). For general information about Amazon DocumentDB, see [What is Amazon DocumentDB (with MongoDB compatibility)](./what-is.html). @@ -15 +15 @@ These instructions use an AWS CloudFormation template to create a cluster and in -The AWS CloudFormation stack that is created by this template creates multiple resources, including resources in Amazon DocumentDB (for example, a cluster and instances) and Amazon Elastic Compute Cloud (for example, a subnet group). +The CloudFormation stack that is created by this template creates multiple resources, including resources in Amazon DocumentDB (for example, a cluster and instances) and Amazon Elastic Compute Cloud (for example, a subnet group). @@ -19 +19 @@ Some of these resources are not free-tier resources. For pricing information, se -This AWS CloudFormation stack is intended for tutorial purposes only. If you use this template for a production environment, we recommend that you use stricter IAM policies and security. For information about securing resources, see [Amazon VPC Security](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html) and [Amazon EC2 Network and Security](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EC2_Network_and_Security.html). +This CloudFormation stack is intended for tutorial purposes only. If you use this template for a production environment, we recommend that you use stricter IAM policies and security. For information about securing resources, see [Amazon VPC Security](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Security.html) and [Amazon EC2 Network and Security](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/EC2_Network_and_Security.html). @@ -25 +25 @@ This AWS CloudFormation stack is intended for tutorial purposes only. If you use - * Launching an Amazon DocumentDB AWS CloudFormation stack + * Launching an Amazon DocumentDB CloudFormation stack @@ -47 +47 @@ Before you create an Amazon DocumentDB cluster, you must have the following: -The following permissions allow you to create resources for the AWS CloudFormation stack: +The following permissions allow you to create resources for the CloudFormation stack: @@ -60 +60 @@ The following permissions allow you to create resources for the AWS CloudFormati -The following policy outlines the additional permissions that are required to create and delete this AWS CloudFormation stack. +The following policy outlines the additional permissions that are required to create and delete this CloudFormation stack. @@ -66 +66 @@ In the following examples, replace each `user input placeholder` with your resou -You must have a key pair (and the PEM file) available in the Region where you will create the AWS CloudFormation stack. If you need to create a key pair, see [ Creating a Key Pair Using Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#having-ec2-create-your-key-pair) in the _Amazon EC2 User Guide_. +You must have a key pair (and the PEM file) available in the Region where you will create the CloudFormation stack. If you need to create a key pair, see [ Creating a Key Pair Using Amazon EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#having-ec2-create-your-key-pair) in the _Amazon EC2 User Guide_. @@ -68 +68 @@ You must have a key pair (and the PEM file) available in the Region where you wi -## Launching an Amazon DocumentDB AWS CloudFormation stack +## Launching an Amazon DocumentDB CloudFormation stack @@ -70 +70 @@ You must have a key pair (and the PEM file) available in the Region where you wi -This section describes how to launch and configure an Amazon DocumentDB AWS CloudFormation stack. +This section describes how to launch and configure an Amazon DocumentDB CloudFormation stack. @@ -94 +94 @@ Europe (Paris) | [View Template](https://s3.amazonaws.com/amazon-documentdb-sam -When you launch an AWS CloudFormation stack, deletion protection for your Amazon DocumentDB cluster is disabled by default. If you want to enable deletion protection for your cluster, complete the following steps. Otherwise, choose **Next** to continue to the next step. +When you launch an CloudFormation stack, deletion protection for your Amazon DocumentDB cluster is disabled by default. If you want to enable deletion protection for your cluster, complete the following steps. Otherwise, choose **Next** to continue to the next step. @@ -100 +100 @@ When you launch an AWS CloudFormation stack, deletion protection for your Amazo - 2. Modify the template using the integrated JSON and YAML editor in the resulting AWS CloudFormation Designer page of the console. Scroll to the `Resources` section and modify it to include `DeletionProtection`, as follows. For more information about using AWS CloudFormation Designer, see [ What Is AWS CloudFormation Designer?](https://docs.aws.amazon.com/en_us/AWSCloudFormation/latest/UserGuide/working-with-templates-cfn-designer.html). + 2. Modify the template using the integrated JSON and YAML editor in the resulting CloudFormation Designer page of the console. Scroll to the `Resources` section and modify it to include `DeletionProtection`, as follows. For more information about using CloudFormation Designer, see [ What Is CloudFormation Designer?](https://docs.aws.amazon.com/en_us/AWSCloudFormation/latest/UserGuide/working-with-templates-cfn-designer.html). @@ -182 +182 @@ Choose **Next** to save your changes and continue. - * **Permissions** — Optional. Choose an IAM role to explicitly define how AWS CloudFormation can create, modify, or delete resources in the stack. If you don't choose a role, AWS CloudFormation uses permissions based on your user credentials. Before you specify a service role, ensure that you have permission to pass it (`iam:PassRole`). The `iam:PassRole` permission specifies which roles you can use. + * **Permissions** — Optional. Choose an IAM role to explicitly define how CloudFormation can create, modify, or delete resources in the stack. If you don't choose a role, CloudFormation uses permissions based on your user credentials. Before you specify a service role, ensure that you have permission to pass it (`iam:PassRole`). The `iam:PassRole` permission specifies which roles you can use. @@ -186 +186 @@ Choose **Next** to save your changes and continue. -When you specify a service role, AWS CloudFormation always uses that role for all operations that are performed on that stack. Other users that have permissions to perform operations on this stack will be able to use this role, even if they don't have permission to pass it. If the role includes permissions that the user shouldn't have, you can unintentionally escalate a user's permissions. Ensure that the role grants [ least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege). +When you specify a service role, CloudFormation always uses that role for all operations that are performed on that stack. Other users that have permissions to perform operations on this stack will be able to use this role, even if they don't have permission to pass it. If the role includes permissions that the user shouldn't have, you can unintentionally escalate a user's permissions. Ensure that the role grants [ least privilege](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege). @@ -194 +194 @@ You can enter the stack policy directly as JSON, or upload a JSON file containin - * **Rollback configuration** — Optional. Specify CloudWatch Logs alarms for AWS CloudFormation to monitor when creating and updating the stack. If the operation breaches an alarm threshold, AWS CloudFormation rolls it back. + * **Rollback configuration** — Optional. Specify CloudWatch Logs alarms for CloudFormation to monitor when creating and updating the stack. If the operation breaches an alarm threshold, CloudFormation rolls it back. @@ -208 +208 @@ You can enter the stack policy directly as JSON, or upload a JSON file containin -AWS CloudFormation termination protection is different from the Amazon DocumentDB concept of deletion protection. For more information, see Termination protection and deletion protection. +CloudFormation termination protection is different from the Amazon DocumentDB concept of deletion protection. For more information, see Termination protection and deletion protection. @@ -223 +223 @@ Choose **Next** to continue. -Once the AWS CloudFormation stack has been completed, you can use an Amazon EC2 instance to connect to your Amazon DocumentDB cluster. For information about connecting to an Amazon EC2 instance using SSH, see [ Connect to Your Linux Instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstances.html) in the _Amazon EC2 User Guide_. +Once the CloudFormation stack has been completed, you can use an Amazon EC2 instance to connect to your Amazon DocumentDB cluster. For information about connecting to an Amazon EC2 instance using SSH, see [ Connect to Your Linux Instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AccessingInstances.html) in the _Amazon EC2 User Guide_. @@ -240 +240 @@ It is an Amazon DocumentDB best practice to enable deletion protection and termi - * **Termination protection** — You can prevent a stack from being accidentally deleted by enabling termination protection for your CloudFormation stack. If a user attempts to delete a stack with termination protection enabled on it, the deletion fails and the stack remains unchanged. Termination protection is disabled by default when you create a stack using CloudFormation. You can enable termination protection on a stack when you create it. For more information, see [ Setting AWS CloudFormation Stack Options](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-add-tags.html). + * **Termination protection** — You can prevent a stack from being accidentally deleted by enabling termination protection for your CloudFormation stack. If a user attempts to delete a stack with termination protection enabled on it, the deletion fails and the stack remains unchanged. Termination protection is disabled by default when you create a stack using CloudFormation. You can enable termination protection on a stack when you create it. For more information, see [ Setting CloudFormation Stack Options](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-add-tags.html).