AWS AWSCloudFormation medium security documentation change
Summary
Added AssociationDispatchAssumeRole property and Tags array with security recommendations
Security assessment
Introduces IAM role enforcement for State Manager actions with explicit warnings about service-linked role deprecation. The documentation now emphasizes security best practices for permissions control.
Diff
diff --git a/AWSCloudFormation/latest/TemplateReference/aws-resource-ssm-association.md b/AWSCloudFormation/latest/TemplateReference/aws-resource-ssm-association.md index 271caf157..6fe88e2e0 100644 --- a//AWSCloudFormation/latest/TemplateReference/aws-resource-ssm-association.md +++ b//AWSCloudFormation/latest/TemplateReference/aws-resource-ssm-association.md @@ -23,0 +24 @@ To declare this entity in your CloudFormation template, use the following syntax + "AssociationDispatchAssumeRole" : String, @@ -37,0 +39 @@ To declare this entity in your CloudFormation template, use the following syntax + "Tags" : [ [Tag](./aws-properties-ssm-association-tag.html), ... ], @@ -49,0 +52 @@ To declare this entity in your CloudFormation template, use the following syntax + AssociationDispatchAssumeRole: String @@ -66,0 +70,2 @@ To declare this entity in your CloudFormation template, use the following syntax + Tags: + - [Tag](./aws-properties-ssm-association-tag.html) @@ -84,0 +90,23 @@ _Required_ : No +`AssociationDispatchAssumeRole` + + +A role used by association to take actions on your behalf. State Manager will assume this role and call required APIs when dispatching configurations to nodes. If not specified, [ service-linked role for Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/using-service-linked-roles.html) will be used by default. + +###### Note + +It is recommended that you define a custom IAM role so that you have full control of the permissions that State Manager has when taking actions on your behalf. + +Service-linked role support in State Manager is being phased out. Associations relying on service-linked role may require updates in the future to continue functioning properly. + +_Required_ : No + + _Type_ : String + + _Pattern_ : `arn:aws(-[^:]+)?:iam::[0-9]{12}:role/.+` + +_Minimum_ : `1` + + _Maximum_ : `512` + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + @@ -296,0 +325,15 @@ _Required_ : No + + _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) + +`Tags` + + +Adds or overwrites one or more tags for a State Manager association. _Tags_ are metadata that you can assign to your AWS resources. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment. Each tag consists of a key and an optional value, both of which you define. + +_Required_ : No + + _Type_ : Array of [Tag](./aws-properties-ssm-association-tag.html) + + _Minimum_ : `0` + + _Maximum_ : `1000`