AWS AWSCloudFormation documentation change
Summary
Clarified tagged union behavior for FirewallRuleType and updated property descriptions with specific examples
Security assessment
Improved documentation for security feature configuration (content/threat categories) with concrete examples. Enhances security documentation without addressing a specific vulnerability.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-route53resolver-firewallrulegroup-firewallruletype.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-route53resolver-firewallrulegroup-firewallruletype.md index 409aaf692..5b183ede8 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-properties-route53resolver-firewallrulegroup-firewallruletype.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-route53resolver-firewallrulegroup-firewallruletype.md @@ -11 +11,3 @@ This is the new _CloudFormation Template Reference Guide_. Please update your bo -The configuration for a rule type in a DNS Firewall rule. This is a union type — exactly one member should be set. +The rule-type configuration for a DNS Firewall rule. `FirewallRuleType` is a tagged union — exactly one member must be set per rule, and the member determines what the rule matches against. This shape is mutually exclusive with the top-level `FirewallDomainListId` and `DnsThreatProtection` fields on CreateFirewallRule and UpdateFirewallRule. + +Call ListFirewallRuleTypes to discover which rule-type variants and which values within each variant are available in your account and Region. @@ -40 +42 @@ To declare this entity in your CloudFormation template, use the following syntax -The configuration for a content category-based filtering rule. +Configures the rule to match an AWS-managed content category (for example, `VIOLENCE_AND_HATE_SPEECH`). See FirewallAdvancedContentCategoryConfig. @@ -51 +53 @@ _Required_ : No -The configuration for a threat category-based filtering rule. +Configures the rule to match an AWS-managed advanced threat category (for example, `PHISHING`). See FirewallAdvancedThreatCategoryConfig.