AWS systems-manager documentation change
Summary
Updated terminology from 'AWS CloudFormation' to 'CloudFormation' throughout the document to align with branding conventions
Security assessment
The changes are purely terminological updates replacing 'AWS CloudFormation' with 'CloudFormation'. No security vulnerabilities, weaknesses, or incidents are mentioned. Permissions and policy behaviors remain unchanged.
Diff
diff --git a/systems-manager/latest/userguide/security-iam-awsmanpol.md b/systems-manager/latest/userguide/security-iam-awsmanpol.md index 4e2a4cda9..7fa40f9d8 100644 --- a//systems-manager/latest/userguide/security-iam-awsmanpol.md +++ b//systems-manager/latest/userguide/security-iam-awsmanpol.md @@ -171 +171 @@ This policy includes the following permissions. - * `cloudformation` – Allows principals to create, describe, update, and delete AWS CloudFormation stacks. This enables Automation runbooks to manage infrastructure as code through CloudFormation. + * `cloudformation` – Allows principals to create, describe, update, and delete CloudFormation stacks. This enables Automation runbooks to manage infrastructure as code through CloudFormation. @@ -381 +381 @@ This policy includes the following permissions. - * `cloudformation` – Allows principals to read information from AWS CloudFormation. This is required so Quick Setup can gather data about the AWS CloudFormation stacks used to manage the state of resources and CloudFormation stackset operations. + * `cloudformation` – Allows principals to read information from CloudFormation. This is required so Quick Setup can gather data about the CloudFormation stacks used to manage the state of resources and CloudFormation stackset operations. @@ -415 +415 @@ This policy includes the following permissions. - * `ssm` – Allows principals to read, create, update, and delete SSM documents with names beginning with "AWSQuickSetup-" or "AWSOperationsPack-" when called via AWS CloudFormation; to read specific AWS owned documents including "AWSQuickSetupType-ManageInstanceProfile"; to create, update, and delete associations for Quick Setup documents and AWS owned documents when called via AWS CloudFormation; and to clean up legacy resources tagged with `QuickSetupID`. This enables Quick Setup to deploy and manage automation workflows and associations. + * `ssm` – Allows principals to read, create, update, and delete SSM documents with names beginning with "AWSQuickSetup-" or "AWSOperationsPack-" when called via CloudFormation; to read specific AWS owned documents including "AWSQuickSetupType-ManageInstanceProfile"; to create, update, and delete associations for Quick Setup documents and AWS owned documents when called via CloudFormation; and to clean up legacy resources tagged with `QuickSetupID`. This enables Quick Setup to deploy and manage automation workflows and associations. @@ -417 +417 @@ This policy includes the following permissions. - * `cloudformation` – Allows principals to read information about AWS CloudFormation stacks and stack sets; and to create, update, and delete AWS CloudFormation stacks and change sets for resources with names beginning with "StackSet-AWS-QuickSetup-". This enables Quick Setup to manage infrastructure deployments across accounts and regions. + * `cloudformation` – Allows principals to read information about CloudFormation stacks and stack sets; and to create, update, and delete CloudFormation stacks and change sets for resources with names beginning with "StackSet-AWS-QuickSetup-". This enables Quick Setup to manage infrastructure deployments across accounts and regions. @@ -419 +419 @@ This policy includes the following permissions. - * `config` – Allows principals to read information about AWS Config conformance packs and their status; and to create and delete conformance packs with names beginning with "AWS-QuickSetup-" when called via AWS CloudFormation. This enables Quick Setup to deploy compliance monitoring configurations. + * `config` – Allows principals to read information about AWS Config conformance packs and their status; and to create and delete conformance packs with names beginning with "AWS-QuickSetup-" when called via CloudFormation. This enables Quick Setup to deploy compliance monitoring configurations. @@ -423 +423 @@ This policy includes the following permissions. - * `iam` – Allows principals to create service-linked roles for AWS Config and Systems Manager; to create, manage, and delete IAM roles with names beginning with "AWS-QuickSetup-" or "AWSOperationsPack-" when called via AWS CloudFormation; to pass these roles to Systems Manager and EventBridge services; to attach specific AWS managed policies to these roles; and to set permissions boundaries using specific Quick Setup managed policies. This enables Quick Setup to create the necessary service roles for its operations. + * `iam` – Allows principals to create service-linked roles for AWS Config and Systems Manager; to create, manage, and delete IAM roles with names beginning with "AWS-QuickSetup-" or "AWSOperationsPack-" when called via CloudFormation; to pass these roles to Systems Manager and EventBridge services; to attach specific AWS managed policies to these roles; and to set permissions boundaries using specific Quick Setup managed policies. This enables Quick Setup to create the necessary service roles for its operations. @@ -446 +446 @@ This policy includes the following permissions. - * `cloudformation` – Allows principals to read AWS CloudFormation stack information; and to control AWS CloudFormation stacks that were created by Quick Setup using AWS CloudFormation stack sets. + * `cloudformation` – Allows principals to read CloudFormation stack information; and to control CloudFormation stacks that were created by Quick Setup using CloudFormation stack sets. @@ -560 +560 @@ This policy includes the following permissions. - * `cloudformation` – Allows principals to list and describe AWS CloudFormation stacks. + * `cloudformation` – Allows principals to list and describe CloudFormation stacks. @@ -915 +915 @@ To view more details about the policy, including the latest version of the JSON -The `AWSQuickSetupSSMLifecycleManagementExecutionPolicy` policy grants administrative permissions that allow Quick Setup to run the a AWS CloudFormation custom resource on lifecycle events during Quick Setup deployment in Systems Manager. +The `AWSQuickSetupSSMLifecycleManagementExecutionPolicy` policy grants administrative permissions that allow Quick Setup to run the a CloudFormation custom resource on lifecycle events during Quick Setup deployment in Systems Manager. @@ -944 +944 @@ This policy includes the following permissions. - * `ssm` – Allows principals to manage associations for certain resources that are created using AWS CloudFormation templates and a specific set of SSM documents; to manage roles and role policies using for diagnosing and remediating managed nodes through AWS CloudFormation templates; and to attach and delete policies for Quick Setup lifecycle events + * `ssm` – Allows principals to manage associations for certain resources that are created using AWS CloudFormation templates and a specific set of SSM documents; to manage roles and role policies using for diagnosing and remediating managed nodes through CloudFormation templates; and to attach and delete policies for Quick Setup lifecycle events @@ -948 +948 @@ This policy includes the following permissions. - * `lambda` – Allows principals to tag and manage functions for the Quick Setup lifecycle in the principal account using AWS CloudFormation templates. + * `lambda` – Allows principals to tag and manage functions for the Quick Setup lifecycle in the principal account using CloudFormation templates. @@ -950 +950 @@ This policy includes the following permissions. - * `cloudformation` – Allows principals to read information from AWS CloudFormation. This is required so Quick Setup can gather data about the AWS CloudFormation stacks used to manage the state of resources and CloudFormation stackset operations. + * `cloudformation` – Allows principals to read information from CloudFormation. This is required so Quick Setup can gather data about the CloudFormation stacks used to manage the state of resources and CloudFormation stackset operations. @@ -959 +959 @@ To view more details about the policy, including the latest version of the JSON -The `AWSQuickSetupSSMDeploymentS3BucketRolePolicy` policy grants permissions for listing all S3 buckets in an account; and for managing and retrieving information about specific buckets in the principal account that are managed through AWS CloudFormation templates. +The `AWSQuickSetupSSMDeploymentS3BucketRolePolicy` policy grants permissions for listing all S3 buckets in an account; and for managing and retrieving information about specific buckets in the principal account that are managed through CloudFormation templates. @@ -967 +967 @@ This policy includes the following permissions. - * `s3` – Allows principals list all S3 buckets in an account; and to manage and retrieve information about specific buckets in the principal account that are managed through AWS CloudFormation templates. + * `s3` – Allows principals list all S3 buckets in an account; and to manage and retrieve information about specific buckets in the principal account that are managed through CloudFormation templates. @@ -1066 +1066 @@ This policy includes the following permissions. - * `cloudformation` – Allows principals to create, update, delete, and read AWS CloudFormation stacks. + * `cloudformation` – Allows principals to create, update, delete, and read CloudFormation stacks. @@ -1068 +1068 @@ This policy includes the following permissions. - * `ssm` – Allows principals to create, delete, update, and read State Manager associations that are called by AWS CloudFormation. + * `ssm` – Allows principals to create, delete, update, and read State Manager associations that are called by CloudFormation. @@ -1070 +1070 @@ This policy includes the following permissions. - * `iam` – Allows principals create, delete, read and tag IAM roles that are called by AWS CloudFormation. + * `iam` – Allows principals create, delete, read and tag IAM roles that are called by CloudFormation. @@ -1327 +1327 @@ AWSQuickSetupSSMManageResourcesExecutionPolicy – New policy | Systems Manager -AWSQuickSetupSSMLifecycleManagementExecutionPolicy – New policy | Systems Manager added a new policy to support Quick Setup running a AWS CloudFormation custom resource on lifecycle events during a Quick Setup deployment. | November 21, 2024 +AWSQuickSetupSSMLifecycleManagementExecutionPolicy – New policy | Systems Manager added a new policy to support Quick Setup running a CloudFormation custom resource on lifecycle events during a Quick Setup deployment. | November 21, 2024 @@ -1329 +1329 @@ AWSQuickSetupSSMDeploymentRolePolicy – New policy | Systems Manager added a ne -AWSQuickSetupSSMDeploymentS3BucketRolePolicy – New policy | Systems Manager added a new policy to support managing and retrieving information about specific buckets in the principal account that are managed through AWS CloudFormation templates | November 21, 2024 +AWSQuickSetupSSMDeploymentS3BucketRolePolicy – New policy | Systems Manager added a new policy to support managing and retrieving information about specific buckets in the principal account that are managed through CloudFormation templates | November 21, 2024