AWS AWSCloudFormation medium security documentation change
Summary
Added detailed documentation for DevOpsAgent::Service resource including service registration constraints, update behavior notes, and OAuth service registration requirements
Security assessment
The change explicitly restricts OAuth-authorized services (Datadog, GitHub, Slack) to console-based registration, preventing potential insecure automated provisioning of sensitive OAuth integrations through CloudFormation. This appears to address a security concern about improper credential handling in infrastructure-as-code scenarios.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-devopsagent-service.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-devopsagent-service.md index 2ac0b3f34..6a2cd57ae 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-devopsagent-service.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-devopsagent-service.md @@ -9 +9,7 @@ This is the new _CloudFormation Template Reference Guide_. Please update your bo -The `AWS::DevOpsAgent::Service` resource Property description not available. for DevOpsAgent. +The `AWS::DevOpsAgent::Service` resource registers an external service for integration with the AWS DevOps Agent service. + +This resource does not support updates. To modify a registered service, you must replace the resource. + +###### Note + +Services that use OAuth authorization flows (ex: Datadog, GitHub, Slack) require interactive browser-based registration through the AWS DevOps Agent console. These service types cannot be registered using this resource. @@ -42 +48 @@ To declare this entity in your CloudFormation template, use the following syntax -Property description not available. +Service-specific configuration details provided during registration. The structure of this property depends on the value of `ServiceType`. @@ -48 +54 @@ _Required_ : No - _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) + _Update requires_ : Updates are not supported. @@ -53 +59 @@ _Required_ : No -Property description not available. +The type of external service to register. @@ -61 +67 @@ _Required_ : Yes - _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) + _Update requires_ : Updates are not supported. @@ -66,0 +73,4 @@ _Required_ : Yes +When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the ServiceId. + +For more information about using the `Ref` function, see [`Ref`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html). + @@ -68,0 +79,4 @@ _Required_ : Yes +The `Fn::GetAtt` intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values. + +For more information about using the `Fn::GetAtt` intrinsic function, see [`Fn::GetAtt`](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html). + @@ -74 +88 @@ _Required_ : Yes -Property description not available. +List of accessible resources for this service. @@ -79 +93 @@ Property description not available. -Property description not available. +The unique identifier of the service.