AWS AWSCloudFormation medium security documentation change
Summary
Updated documentation for EBS volume creation, including volume copies, encryption behavior, cooldown periods, and parameter constraints.
Security assessment
The change explicitly states that volume copies inherit encryption from the source volume and prohibits copying unencrypted volumes. This enforces encryption requirements for volume copies, addressing potential data exposure risks. Specific security-related additions include notes under 'Encrypted' and 'KmsKeyId' parameters about encryption inheritance and restrictions.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.md index 786cb84f4..e8bd846c1 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-volume.md @@ -9 +9 @@ This is the new _CloudFormation Template Reference Guide_. Please update your bo -Specifies an Amazon Elastic Block Store (Amazon EBS) volume. +Specifies an Amazon Elastic Block Store (Amazon EBS) volume. You can create an empty volume, a volume from a snapshot, or a volume copy from an existing source volume. @@ -11 +11 @@ Specifies an Amazon Elastic Block Store (Amazon EBS) volume. -When you use AWS CloudFormation to update an Amazon EBS volume that modifies `Iops`, `Size`, or `VolumeType`, there is a cooldown period before another operation can occur. This can cause your stack to report being in `UPDATE_IN_PROGRESS` or `UPDATE_ROLLBACK_IN_PROGRESS` for long periods of time. +###### Important @@ -13,3 +13 @@ When you use AWS CloudFormation to update an Amazon EBS volume that modifies `Io -Amazon EBS does not support sizing down an Amazon EBS volume. AWS CloudFormation does not attempt to modify an Amazon EBS volume to a smaller size on rollback. - -Some common scenarios when you might encounter a cooldown period for Amazon EBS include: + * When you use AWS CloudFormation to update an Amazon EBS volume that modifies `Iops`, `Size`, or `VolumeType`, there is a cooldown period before another operation can occur. This can cause your stack to report being in `UPDATE_IN_PROGRESS` or `UPDATE_ROLLBACK_IN_PROGRESS` for long periods of time. Some common scenarios when you might encounter a cooldown period for Amazon EBS include: @@ -20,0 +19,3 @@ Some common scenarios when you might encounter a cooldown period for Amazon EBS +For more information, see [Requirements for EBS volume modifications](https://docs.aws.amazon.com/ebs/latest/userguide/modify-volume-requirements.html). + + * Amazon EBS does not support sizing down an Amazon EBS volume. AWS CloudFormation does not attempt to modify an Amazon EBS volume to a smaller size on rollback. @@ -24 +24,0 @@ Some common scenarios when you might encounter a cooldown period for Amazon EBS -For more information, see [Requirements for EBS volume modifications](https://docs.aws.amazon.com/ebs/latest/userguide/modify-volume-requirements.html). @@ -105,0 +106,2 @@ Either `AvailabilityZone` or `AvailabilityZoneId` must be specified, but not bot +If you are creating a volume copy, omit this parameter. The volume copy is created in the same Availability Zone as the source volume. + @@ -115 +117,5 @@ _Required_ : No -The ID of the Availability Zone for the volume. +The ID of the Availability Zone in which to create the volume. For example, `use1-az1`. + +Either `AvailabilityZone` or `AvailabilityZoneId` must be specified, but not both. + +If you are creating a volume copy, omit this parameter. The volume copy is created in the same Availability Zone as the source volume. @@ -126 +132 @@ _Required_ : No -Indicates whether the volume should be encrypted. The effect of setting the encryption state to `true` depends on the volume origin (new or from a snapshot), starting encryption state, ownership, and whether encryption by default is enabled. For more information, see [Encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/work-with-ebs-encr.html#encryption-by-default) in the _Amazon EBS User Guide_. +Indicates whether the volume should be encrypted. The effect of setting the encryption state to `true` depends on the volume origin (new, from a snapshot, or from an existing volume), starting encryption state, ownership, and whether encryption by default is enabled. For more information, see [Encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/work-with-ebs-encr.html#encryption-by-default) in the _Amazon EBS User Guide_. @@ -128 +134 @@ Indicates whether the volume should be encrypted. The effect of setting the encr -Encrypted Amazon EBS volumes must be attached to instances that support Amazon EBS encryption. For more information, see [Supported instance types](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-encryption-requirements.html#ebs-encryption_supported_instances). +If you are creating a volume copy, omit this parameter. The volume is automatically encrypted with the same KMS key as the source volume. You can't copy unencrypted volumes. @@ -181,0 +188,2 @@ Alternatively, if you want to specify a different key, you can specify one of th +If you are creating a volume copy, omit this parameter. The volume is automatically encrypted with the same KMS key as the source volume. You can't copy unencrypted volumes. + @@ -204 +212,3 @@ _Required_ : No -The Amazon Resource Name (ARN) of the Outpost. +The Amazon Resource Name (ARN) of the Outpost on which to create the volume. + +If you intend to use a volume with an instance running on an outpost, then you must create the volume on the same outpost as the instance. You can't use a volume created in an AWS Region with an instance on an AWS outpost, or the other way around. @@ -215 +225,6 @@ _Required_ : No -The size of the volume, in GiBs. You must specify either a snapshot ID or a volume size. If you specify a snapshot, the default is the snapshot size, and you can specify a volume size that is equal to or larger than the snapshot size. +The size of the volume, in GiBs. + + * Required for new empty volumes. + + * Optional for volumes created from snapshots and volume copies. In this case, the size defaults to the size of the snapshot or source volume. You can optionally specify a size that is equal to or larger than the size of the source snapshot or volume. + @@ -217 +232,3 @@ The size of the volume, in GiBs. You must specify either a snapshot ID or a volu -Valid sizes: + + +Supported volume sizes: @@ -243 +260 @@ _Required_ : Conditional -The snapshot from which to create the volume. You must specify either a snapshot ID or a volume size. +The snapshot from which to create the volume. Only specify to create a volume from a snapshot. To create a new empty volume, omit this parameter and specify a value for `Size` instead. To create a volume copy, omit this parameter and specify `SourceVolumeId` instead. @@ -254 +271 @@ _Required_ : Conditional -The ID of the source volume from which the volume copy was created. Only for volume copies. +The ID of the source EBS volume to copy. When specified, the volume is created as an exact copy of the specified volume. Only specify to create a volume copy. To create a new empty volume or to create a volume from a snapshot, omit this parameter, @@ -334 +351,5 @@ The volume type. This parameter can be one of the following values: -For more information, see [Amazon EBS volume types](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-volume-types.html). +###### Important + +Throughput Optimized HDD (`st1`) and Cold HDD (`sc1`) volumes can't be used as boot volumes. + +For more information, see [Amazon EBS volume types](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-volume-types.html) in the _Amazon EBS User Guide_.