AWS AWSCloudFormation documentation change
Summary
Updated EMR Cluster CloudFormation resource documentation: changed Configurations property type reference, removed MonitoringConfiguration property, and added VisibleToAllUsers property with detailed documentation about IAM user visibility controls.
Security assessment
The change adds documentation for the VisibleToAllUsers property which controls IAM user access to EMR clusters. This is a security feature that helps enforce least privilege by restricting cluster visibility. The documentation explicitly states the default behavior difference between CloudFormation (false) and console/API (true), which is important for security posture. No evidence of addressing a specific security vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-emr-cluster.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-emr-cluster.md index 11d7d373d..fce77635f 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-emr-cluster.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-emr-cluster.md @@ -28 +28 @@ To declare this entity in your CloudFormation template, use the following syntax - "Configurations" : [ [EMRConfiguration](./aws-properties-emr-cluster-emrconfiguration.html), ... ], + "Configurations" : [ [Configuration](./aws-properties-emr-cluster-configuration.html), ... ], @@ -39 +38,0 @@ To declare this entity in your CloudFormation template, use the following syntax - "MonitoringConfiguration" : [MonitoringConfiguration](./aws-properties-emr-cluster-monitoringconfiguration.html), @@ -49 +48,2 @@ To declare this entity in your CloudFormation template, use the following syntax - "Tags" : [ [Tag](./aws-properties-emr-cluster-tag.html), ... ] + "Tags" : [ [Tag](./aws-properties-emr-cluster-tag.html), ... ], + "VisibleToAllUsers" : Boolean @@ -68 +68 @@ To declare this entity in your CloudFormation template, use the following syntax - - [EMRConfiguration](./aws-properties-emr-cluster-emrconfiguration.html) + - [Configuration](./aws-properties-emr-cluster-configuration.html) @@ -82,2 +81,0 @@ To declare this entity in your CloudFormation template, use the following syntax - MonitoringConfiguration: - [MonitoringConfiguration](./aws-properties-emr-cluster-monitoringconfiguration.html) @@ -96,0 +95 @@ To declare this entity in your CloudFormation template, use the following syntax + VisibleToAllUsers: Boolean @@ -175 +174 @@ _Required_ : No - _Type_ : Array of [EMRConfiguration](./aws-properties-emr-cluster-emrconfiguration.html) + _Type_ : Array of [Configuration](./aws-properties-emr-cluster-configuration.html) @@ -301,11 +299,0 @@ _Required_ : No -`MonitoringConfiguration` - - -Contains Cloudwatch log configuration metadata and settings. - -_Required_ : No - - _Type_ : [MonitoringConfiguration](./aws-properties-emr-cluster-monitoringconfiguration.html) - - _Update requires_ : [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) - @@ -429,0 +418,15 @@ _Required_ : No +`VisibleToAllUsers` + + +Indicates whether the cluster is visible to all IAM users of the AWS account associated with the cluster. If this value is set to `true`, all IAM users of that AWS account can view and manage the cluster if they have the proper policy permissions set. If this value is `false`, only the IAM user that created the cluster can view and manage it. This value can be changed using the SetVisibleToAllUsers action. + +###### Note + +When you create clusters directly through the EMR console or API, this value is set to `true` by default. However, for `AWS::EMR::Cluster` resources in CloudFormation, the default is `false`. + +_Required_ : No + + _Type_ : Boolean + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) +