AWS AWSCloudFormation documentation change
Summary
Updated documentation for ECR repository filters to clarify their use in automatic image signing with wildcard patterns instead of replication
Security assessment
The changes describe how repository filters determine which images are automatically signed, which relates to image integrity and authenticity. However, there is no evidence of addressing a specific security vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-ecr-signingconfiguration-repositoryfilter.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-ecr-signingconfiguration-repositoryfilter.md index 43c378293..12c3b8fbf 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-ecr-signingconfiguration-repositoryfilter.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-ecr-signingconfiguration-repositoryfilter.md @@ -9 +9 @@ This is the new _CloudFormation Template Reference Guide_. Please update your bo -The filter settings used with image replication. Specifying a repository filter to a replication rule provides a method for controlling which repositories in a private registry are replicated. If no filters are added, the contents of all repositories are replicated. +A repository filter used to determine which repositories have their images automatically signed on push. Each filter consists of a filter type and filter value. @@ -36 +36,12 @@ To declare this entity in your CloudFormation template, use the following syntax -The repository filter details. When the `PREFIX_MATCH` filter type is specified, this value is required and should be the repository name prefix to configure replication for. +The filter value used to match repository names. When using `WILDCARD_MATCH`, the `*` character matches any sequence of characters. + +Examples: + + * `myapp/*` \- Matches all repositories starting with `myapp/` + + * `*/production` \- Matches all repositories ending with `/production` + + * `*prod*` \- Matches all repositories containing `prod` + + + @@ -53 +64 @@ _Minimum_ : `1` -The repository filter type. The only supported value is `PREFIX_MATCH`, which is a repository name prefix specified with the `filter` parameter. +The type of filter to apply. Currently, only `WILDCARD_MATCH` is supported, which uses wildcard patterns to match repository names.