AWS security-ir documentation change
Summary
Simplified CloudFormation StackSet documentation for security incident response containment roles, removing detailed StackSet deployment code and providing more concise template description
Security assessment
This change restructures documentation about deploying security incident response containment roles via CloudFormation StackSets. It removes complex deployment code and provides clearer instructions, but doesn't address any specific security vulnerability. The change improves security documentation clarity for containment role deployment.
Diff
diff --git a/security-ir/latest/userguide/working-with-stacksets.md b/security-ir/latest/userguide/working-with-stacksets.md index ab322f560..d539dcc0e 100644 --- a//security-ir/latest/userguide/working-with-stacksets.md +++ b//security-ir/latest/userguide/working-with-stacksets.md @@ -5 +5 @@ -# Working with CloudFormation stacksets +# Working with CloudFormation StackSets @@ -9 +9 @@ -AWS Security Incident Response does not enable containment capabilities by default, to execute these containment actions, you must first grant the necessary permissions to the service using roles. You can create these roles individually per account or across your entire organization by deploying CloudFormation StackSets, which create the required roles. +AWS Security Incident Response doesn't enable containment capabilities by default. To run these containment actions, you must grant the necessary permissions to the service using AWS Identity and Access Management roles. You can create these roles individually for each account or across your entire organization by deploying CloudFormation StackSets, The StackSets create the required roles. @@ -11 +11 @@ AWS Security Incident Response does not enable containment capabilities by defau -You can find specific instructions on how to [ Create a stack set with service-managed permissions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-getting-started-create.html). +For specific instructions on how to create a StackSet with service-managed permissions, see [ Create CloudFormation StackSets with service-managed permissions](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-orgs-associate-stackset-with-org.html) in the _AWS CloudFormation User Guide_. @@ -13 +13 @@ You can find specific instructions on how to [ Create a stack set with service-m -Following are template stacksets to create the _AWSSecurityIncidentResponseContainment_ and _AWSSecurityIncidentResponseContainmentExecution_ roles. +The following are templates to create the _AWSSecurityIncidentResponseContainment_ and _AWSSecurityIncidentResponseContainmentExecution_ roles. @@ -17,21 +17 @@ Following are template stacksets to create the _AWSSecurityIncidentResponseConta - Description: 'Deploy containment roles as managed StackSet to all organization accounts' - - Resources: - ContainmentRolesStackSet: - Type: AWS::CloudFormation::StackSet - Properties: - StackSetName: SecurityIRContainmentRoles - Description: Deploy security incident response containment roles across organization - PermissionModel: SERVICE_MANAGED - AutoDeployment: - Enabled: true - RetainStacksOnAccountRemoval: false - Capabilities: - - CAPABILITY_NAMED_IAM - OperationPreferences: - RegionConcurrencyType: PARALLEL - MaxConcurrentPercentage: 100 - FailureTolerancePercentage: 10 - TemplateBody: | - AWSTemplateFormatVersion: '2010-09-09' - Description: 'Template for AWS Security Incident Response containment roles' + Description: 'Template for production SIR containment roles' @@ -296,24 +275,0 @@ Following are template stacksets to create the _AWSSecurityIncidentResponseConta - StackSetDeploymentOperation: - Type: AWS::CloudFormation::StackInstances - Properties: - StackSetName: !Ref ContainmentRolesStackSet - DeploymentTargets: - OrganizationalUnitIds: - - r-xxxx # Replace with your root OU ID - Regions: - - us-east-1 - OperationPreferences: - RegionConcurrencyType: PARALLEL - MaxConcurrentPercentage: 100 - FailureTolerancePercentage: 10 - - Outputs: - StackSetId: - Description: ID of the created StackSet - Value: !Ref ContainmentRolesStackSet - StackSetArn: - Description: ARN of the created StackSet - Value: !GetAtt ContainmentRolesStackSet.StackSetId - - -