AWS AWSCloudFormation medium security documentation change
Summary
Expanded tag documentation with detailed structure, restrictions, and AWS reserved prefixes
Security assessment
Added explicit guidance about reserved 'aws:' prefix which prevents users from modifying AWS-controlled tags. This addresses potential security risks of unauthorized tag manipulation and clarifies access control boundaries.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-ses-template-tag.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-ses-template-tag.md index 63d5ba77b..a28fb8eb4 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-ses-template-tag.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-ses-template-tag.md @@ -9 +9,14 @@ This is the new _CloudFormation Template Reference Guide_. Please update your bo -The `Tag` property type specifies Property description not available. for an [AWS::SES::Template](./aws-resource-ses-template.html). +An object that defines the tags that are associated with a resource. A _tag_ is a label that you optionally define and associate with a resource. Tags can help you categorize and manage resources in different ways, such as by purpose, owner, environment, or other criteria. A resource can have as many as 50 tags. + +Each tag consists of a required _tag key_ and an associated _tag value_ , both of which you define. A tag key is a general label that acts as a category for a more specific tag value. A tag value acts as a descriptor within a tag key. A tag key can contain as many as 128 characters. A tag value can contain as many as 256 characters. The characters can be Unicode letters, digits, white space, or one of the following symbols: _ . : / = + -. The following additional restrictions apply to tags: + + * Tag keys and values are case sensitive. + + * For each associated resource, each tag key must be unique and it can have only one value. + + * The `aws:` prefix is reserved for use by AWS; you can’t use it in any tag keys or values that you define. In addition, you can't edit or remove tag keys or values that use this prefix. Tags that use this prefix don’t count against the limit of 50 tags per resource. + + * You can associate tags with public or shared resources, but the tags are available only for your AWS account, not any other accounts that share the resource. In addition, the tags are available only for resources that are located in the specified AWS Region for your AWS account. + + + @@ -36 +49 @@ To declare this entity in your CloudFormation template, use the following syntax -Property description not available. +One part of a key-value pair that defines a tag. The maximum length of a tag key is 128 characters. The minimum length is 1 character. @@ -51 +64 @@ _Required_ : Yes -Property description not available. +The optional part of a key-value pair that defines a tag. The maximum length of a tag value is 256 characters. The minimum length is 0 characters. If you don't want a resource to have a specific tag value, don't specify a value for this parameter. If you don't specify a value, Amazon SES sets the value to an empty string.