AWS organizations documentation change
Summary
Restructured the table of AWS services and resources that support tag policies to include additional columns for CloudFormation alias, reporting mode, enforcement mode, and enforcement for IaC. Added support for numerous new AWS services and resource types.
Security assessment
The changes are documentation updates showing expanded support for tag policies across AWS services. There's no evidence of addressing security vulnerabilities or weaknesses. The updates provide operational information about resource tagging enforcement but don't introduce new security features or address specific security incidents.
Diff
diff --git a/organizations/latest/userguide/orgs_manage_policies_supported-resources-enforcement.md b/organizations/latest/userguide/orgs_manage_policies_supported-resources-enforcement.md index ac33ab8b5..b10dc9c4f 100644 --- a//organizations/latest/userguide/orgs_manage_policies_supported-resources-enforcement.md +++ b//organizations/latest/userguide/orgs_manage_policies_supported-resources-enforcement.md @@ -9,3 +9,4 @@ The following services and resource types support enforcement with tag policies: -Service name | Resource type | JSON syntax ----|---|--- -Amazon API Gateway | +`` | `` | `` | `Basic Compliance Rules` | `Required Tag Keys` +---|---|---|---|--- +`Service` | `Tag Policies JSON syntax` | `CloudFormation Alias` | `Reporting Mode` | `Enforcement Mode` | `Reporting Mode` | `Enforce for IaC` +`AWS Amplify UI Builder [amplifyuibuilder]` | `amplifyuibuilder:theme` | @@ -13,5 +14 @@ Amazon API Gateway | - * All - * API keys - * Domain names - * REST API operations - * Stages + * `AWS::AmplifyUIBuilder::Theme` @@ -19 +16,2 @@ Amazon API Gateway | -| +| `Yes` | `No` | `No` | `No` +`amplifyuibuilder:app/environment/components` | @@ -21,5 +19 @@ Amazon API Gateway | - * `"apigateway:ALL_SUPPORTED"` - * `"apigateway:apikeys"` - * `"apigateway:domainnames"` - * `"apigateway:restapis"` - * `"apigateway:restapis/stages"` + * `AWS::AmplifyUIBuilder::Component` @@ -26,0 +21,2 @@ Amazon API Gateway | +| `Yes` | `Yes` | `No` | `No` +`amplifyuibuilder:component` | @@ -28 +24 @@ Amazon API Gateway | -AWS Amplify | + * `AWS::AmplifyUIBuilder::Component` @@ -30,3 +26,2 @@ AWS Amplify | - * All - * Component - * Theme +| `Yes` | `No` | `No` | `No` +`amplifyuibuilder:ALL_SUPPORTED` | @@ -34 +29 @@ AWS Amplify | -| + * `N/A` @@ -36,3 +31,2 @@ AWS Amplify | - * `"amplifyuibuilder:ALL_SUPPORTED"` - * `"amplifyuibuilder:app/environment/components"` - * `"amplifyuibuilder:app/environment/themes"` +| `No` | `Yes` | `No` | `No` +`AWS Amplify [amplify]` | `amplify:apps` | @@ -39,0 +34 @@ AWS Amplify | + * `AWS::Amplify::App` @@ -41 +36,2 @@ AWS Amplify | -AWS AppConfig | +| `Yes` | `No` | `Yes` | `Yes` +`AWS App Mesh [appmesh]` | `appmesh:mesh` | @@ -43,5 +39 @@ AWS AppConfig | - * Application - * Configuration Profile - * Deployment - * Deployment Strategy - * Environment + * `AWS::AppMesh::Mesh` @@ -49 +41,2 @@ AWS AppConfig | -| +| `Yes` | `Yes` | `Yes` | `Yes` +`appmesh:mesh/virtualgateway/gatewayroute` | @@ -51,5 +44 @@ AWS AppConfig | - * `"appconfig:application"` - * `"appconfig:application/configurationprofile"` - * `"appconfig:application/environment/deployment"` - * `"appconfig:deploymentstrategy"` - * `"appconfig:application/environment"` + * `AWS::AppMesh::GatewayRoute` @@ -56,0 +46,2 @@ AWS AppConfig | +| `Yes` | `Yes` | `Yes` | `Yes` +`appmesh:mesh/virtualgateway` | @@ -58 +49 @@ AWS AppConfig | -AWS App Mesh | + * `AWS::AppMesh::VirtualGateway` @@ -60,8 +51,2 @@ AWS App Mesh | - * All - * Gateway route - * Mesh - * Route - * Virtual gateway - * Virtual node - * Virtual router - * Virtual service +| `Yes` | `Yes` | `Yes` | `Yes` +`appmesh:mesh/virtualnode` | @@ -69 +54 @@ AWS App Mesh | -| + * `AWS::AppMesh::VirtualNode` @@ -71,8 +56,2 @@ AWS App Mesh | - * `"appmesh:ALL_SUPPORTED"` - * `"appmesh:mesh/virtualGateway/gatewayRoute"` - * `"appmesh:mesh"` - * `"appmesh:mesh/virtualRouter/route"` - * `"appmesh:mesh/virtualGateway"` - * `"appmesh:mesh/virtualNode"` - * `"appmesh:mesh/virtualRouter"` - * `"appmesh:mesh/virtualService"` +| `Yes` | `Yes` | `Yes` | `Yes` +`appmesh:mesh/virtualrouter/route` | @@ -79,0 +59 @@ AWS App Mesh | + * `AWS::AppMesh::Route` @@ -81 +61,2 @@ AWS App Mesh | -Amazon Athena | +| `Yes` | `Yes` | `Yes` | `Yes` +`appmesh:mesh/virtualservice` | @@ -83,2 +64 @@ Amazon Athena | - * All - * Workgroup + * `AWS::AppMesh::VirtualService` @@ -86 +66,2 @@ Amazon Athena | -| +| `Yes` | `Yes` | `Yes` | `Yes` +`appmesh:mesh/virtualrouter` | @@ -88,2 +69 @@ Amazon Athena | - * `"athena:ALL_SUPPORTED"` - * `"athena:workgroup"` + * `AWS::AppMesh::VirtualRouter` @@ -90,0 +71,2 @@ Amazon Athena | +| `Yes` | `Yes` | `Yes` | `Yes` +`appmesh:ALL_SUPPORTED` | @@ -92 +74 @@ Amazon Athena | -AWS Audit Manager | + * `N/A` @@ -94,4 +76,2 @@ AWS Audit Manager | - * All - * Assessment - * Assessment Framework - * Control +| `No` | `Yes` | `Yes` | `Yes` +`AWS App Runner [apprunner]` | `apprunner:autoscalingconfiguration` | @@ -99 +79 @@ AWS Audit Manager | -| + * `AWS::AppRunner::AutoScalingConfiguration` @@ -101,4 +81,2 @@ AWS Audit Manager | - * `"auditmanager:ALL_SUPPORTED`" - * `"auditmanager:assessment`" - * `"auditmanager:assessmentFramework`" - * `"auditmanager:control`" +| `Yes` | `No` | `Yes` | `Yes` +`apprunner:service` | @@ -105,0 +84 @@ AWS Audit Manager | + * `AWS::AppRunner::Service` @@ -107 +86,2 @@ AWS Audit Manager | -AWS Backup | +| `Yes` | `No` | `Yes` | `Yes` +`apprunner:connection` | @@ -109,6 +89 @@ AWS Backup | - * All - * Backup plan - * Vault - * Gateway - * Hyper Visor - * VM + * `N/A` @@ -116 +91,2 @@ AWS Backup | -| +| `Yes` | `No` | `No` | `No` +`apprunner:vpcingressconnection` | @@ -118,6 +94 @@ AWS Backup | - * `"backup:ALL_SUPPORTED"` - * `"backup:backup-plan"` - * `"backup:backup-vault"` - * `"backup-gateway:gateway"` - * `"backup-gateway:hypervisor"` - * `"backup-gateway:vm"` + * `AWS::AppRunner::VpcIngressConnection` @@ -124,0 +96,2 @@ AWS Backup | +| `Yes` | `No` | `Yes` | `Yes` +`apprunner:observabilityconfiguration` | @@ -126 +99 @@ AWS Backup | -AWS Batch | + * `AWS::AppRunner::ObservabilityConfiguration` @@ -128,4 +101,2 @@ AWS Batch | - * All - * Job - * Job Definition - * Job Queue +| `Yes` | `No` | `Yes` | `Yes` +`apprunner:vpcconnector` | @@ -133 +104 @@ AWS Batch | -| + * `AWS::AppRunner::VpcConnector` @@ -135,4 +106,2 @@ AWS Batch | - * `"batch:ALL_SUPPORTED"` - * `"batch:job"` - * `"batch:job-definition"` - * `"batch:job-queue"` +| `Yes` | `No` | `Yes` | `Yes` +`AWS AppConfig [appconfig]` | `appconfig:application/environment` | @@ -139,0 +109 @@ AWS Batch | + * `AWS::AppConfig::Environment` @@ -141 +111,2 @@ AWS Batch | -AWS BugBust |