AWS AWSCloudFormation medium security documentation change

Service: AWSCloudFormation · 2026-07-01 · Security-related medium

File: AWSCloudFormation/latest/TemplateReference/aws-properties-route53resolver-firewallrulegroup-firewallrule.md

Summary

Added 'Status' property to firewall rules with lifecycle states (CREATING/COMPLETE/CREATION_FAILED) and provisioning details

Security assessment

Documents firewall rule failure states (CREATION_FAILED) that leave rules immutable, potentially creating security gaps if unaddressed. Explicitly covers security enforcement states and entitlement verification for threat protection.

Diff

diff --git a/AWSCloudFormation/latest/TemplateReference/aws-properties-route53resolver-firewallrulegroup-firewallrule.md b/AWSCloudFormation/latest/TemplateReference/aws-properties-route53resolver-firewallrulegroup-firewallrule.md
index d0b8754e3..705b8fd06 100644
--- a//AWSCloudFormation/latest/TemplateReference/aws-properties-route53resolver-firewallrulegroup-firewallrule.md
+++ b//AWSCloudFormation/latest/TemplateReference/aws-properties-route53resolver-firewallrulegroup-firewallrule.md
@@ -33 +33,2 @@ To declare this entity in your CloudFormation template, use the following syntax
-      "Qtype" : String
+      "Qtype" : String,
+      "Status" : String
@@ -53,0 +55 @@ To declare this entity in your CloudFormation template, use the following syntax
+      Status: String
@@ -324,0 +327,24 @@ _Required_ : No
+`Status`
+    
+
+The lifecycle state of the firewall rule. Possible values:
+
+  * `CREATING` — DNS Firewall is provisioning the rule. Rules created with the `PartnerThreatProtection` rule type begin in this state while DNS Firewall verifies the calling account's AWS Marketplace entitlement.
+
+  * `COMPLETE` — The rule is provisioned and enforcing matches.
+
+  * `CREATION_FAILED` — Provisioning failed. `StatusMessage` contains a human-readable reason. A rule in this state is immutable: UpdateFirewallRule rejects the request, and the rule must be removed with DeleteFirewallRule.
+
+
+
+
+For rules that do not require asynchronous provisioning, this field may be absent.
+
+_Required_ : No
+
+ _Type_ : String
+
+ _Allowed values_ : `COMPLETE | CREATING | CREATION_FAILED`
+
+ _Update requires_ : [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)
+