AWS AWSCloudFormation documentation change
Summary
Expanded pre-deployment validation documentation to cover CreateStack/UpdateStack operations, added disable validation option, new validation types (service quota, recorder conflict, ECR delete readiness), updated prerequisites with required IAM permissions, and restructured CLI/console instructions.
Security assessment
Changes focus on operational reliability and deployment validation enhancements. No evidence of addressing specific security vulnerabilities; additions are feature expansions (new validation types) and usability improvements (disable option). IAM permission updates are routine operational requirements, not security fixes.
Diff
diff --git a/AWSCloudFormation/latest/UserGuide/validate-stack-deployments.md b/AWSCloudFormation/latest/UserGuide/validate-stack-deployments.md index 3b60681f4..69975964d 100644 --- a//AWSCloudFormation/latest/UserGuide/validate-stack-deployments.md +++ b//AWSCloudFormation/latest/UserGuide/validate-stack-deployments.md @@ -7 +7 @@ -How pre-deployment validation worksConsiderationsPrerequisitesValidate a stack deployment (console)Validate a stack deployment (AWS CLI)Validation typesResource limitations +How pre-deployment validation worksConsiderationsPrerequisitesDisable pre-deployment validationValidate a stack deployment (console)Validate a stack deployment (AWS CLI)Validation typesResource limitations @@ -11 +11 @@ How pre-deployment validation worksConsiderationsPrerequisitesValidate a stack d -With pre-deployment validation, you can identify and resolve potential deployment issues before executing your CloudFormation change sets. This feature validates your templates against common failure scenarios, helping you catch issues early in the development cycle. +With pre-deployment validation, you can identify and resolve potential deployment issues before CloudFormation provisions resources. Pre-deployment validation runs automatically on Create Stack, Update Stack, and Create Change Set operations, catching common errors in seconds. @@ -20,0 +21,2 @@ With pre-deployment validation, you can identify and resolve potential deploymen + * Disable pre-deployment validation + @@ -36 +38 @@ Pre-deployment validation involves these phases: - 1. Create your change set – Generate a change set as you normally would for your CloudFormation stack updates. Pre-deployment validation is enabled by default when creating your change set. + 1. Initiate a stack operation – Create a stack, update a stack, or create a change set as you normally would. Pre-deployment validation is enabled by default on all three operations. @@ -38 +40 @@ Pre-deployment validation involves these phases: - 2. Validation execution – CloudFormation runs multiple validation checks against your template and target environment. Currently 3 types of validation are supported: Property syntax validation against resource schemas, resource name conflict detection with existing resources, and S3 bucket emptiness validation for deletion operations. + 2. Validation execution – CloudFormation runs multiple validation checks against your template and target environment. CloudFormation supports six types of pre-deployment validation. Property syntax validation and resource name conflict detection run on all supported operations. Four additional validations run during change set creation only: S3 bucket emptiness validation, service quota checks, Recorder conflict detection, and ECR repository delete readiness. @@ -44 +46,3 @@ Pre-deployment validation involves these phases: - 5. Execute with confidence – Deploy your change set knowing that common failure scenarios have been validated upfront. + 5. Execute with confidence – Proceed with your deployment knowing that common failure scenarios have been validated upfront. + + @@ -46,0 +51 @@ Pre-deployment validation involves these phases: +###### Note @@ -47,0 +53 @@ Pre-deployment validation involves these phases: +For Create Stack and Update Stack operations, validation runs as part of the operation itself. If validation fails in FAIL mode, the operation stops before any resources are provisioned and the stack status reflects the validation failure. For change sets, the change set status shows `FAILED`. @@ -53 +59 @@ As you use pre-deployment validation, keep the following in mind: - * Pre-deployment validation focuses on the three common deployment failure scenarios. It doesn't guarantee that your deployment will succeed, but reduces the likelihood of common failures. + * Pre-deployment validation focuses on common deployment failure scenarios. It doesn't guarantee that your deployment will succeed, but reduces the likelihood of common failures. @@ -57 +63 @@ As you use pre-deployment validation, keep the following in mind: - * FAIL mode prevents change set execution when validation detects errors, ensuring problematic templates cannot proceed to deployment. This applies to property syntax errors and resource naming conflicts. + * FAIL mode stops the operation before any resources are provisioned when validation detects errors. For CreateStack and UpdateStack, the operation fails and the stack status reflects the validation failure. For CreateChangeSet, the change set status shows FAILED. This applies to property syntax errors and resource naming conflicts. @@ -61 +67 @@ As you use pre-deployment validation, keep the following in mind: - * Validation results are tied to the specific change set. If you modify your template, you'll need to create a new change set to get updated validation results. + * For change set operations, validation results are tied to the specific change set. If you modify your template, create a new change set to get updated validation results. For CreateStack and UpdateStack operations, use the `describe-events` command with the operation ID to access validation results. @@ -64,0 +71,2 @@ As you use pre-deployment validation, keep the following in mind: + * Pre-deployment validation adds a small amount of latency to Create Stack and Update Stack operations while validations run. This is typically a few seconds. If you need to skip validation for a specific operation, use the `DisableValidation` parameter. + @@ -72 +80,7 @@ To use pre-deployment validation, you must have: - * The necessary IAM permissions to create change sets and read resources in your account. For S3 bucket emptiness check, you need `s3:ListBucket` permission. + * The necessary IAM permissions to create stacks, update stacks, or create change sets, and read resources in your account. The validation checks that run during change set creation require the following additional permissions: + + * Service quota check – `cloudwatch:GetMetricData`, `lambda:GetAccountSettings`, `servicequotas:GetServiceQuota`, `ec2:DescribeSecurityGroups`, and `iam:GetAccountSummary` + + * Recorder conflict check – `config:ListConfigurationRecorders` + + * S3 bucket emptiness and ECR repository checks – `s3:ListBucketV2` and `ecr:ListImages` @@ -80,0 +95,29 @@ To use pre-deployment validation, you must have: +## Disable pre-deployment validation + +Pre-deployment validation runs by default. To skip validation for a specific operation, use the `DisableValidation` parameter. + +Disable validation in the following situations: + + * When you have already validated your template through other means (such as `cfn-lint`, `cdk validate`, or CI checks) + + * When you need to minimize operation latency for time-sensitive deployments + + * When a known false positive is blocking your deployment and you need to proceed + + + + +AWS CLI examples: + + + aws cloudformation create-stack --stack-name MyStack --template-body file://template.yaml --disable-validation + + + aws cloudformation update-stack --stack-name MyStack --template-body file://template.yaml --disable-validation + +API: Set the `DisableValidation` parameter to `true` on the `CreateStack` or `UpdateStack` API call. + +###### Note + +Disabling validation means CloudFormation does not catch common errors until it attempts to provision resources. + @@ -83 +126,11 @@ To use pre-deployment validation, you must have: -Use the following procedure to validate your stack deployment using the console. +Pre-deployment validation runs automatically on CreateStack and UpdateStack operations. No additional steps are required. + +###### To validate during stack creation or update + + 1. Create or update your stack as you normally would. + + 2. If validation detects errors, the operation stops before provisioning begins. The stack status reflects the validation failure. + + 3. To review validation results, open the stack's **Events** tab and choose the operation ID—or choose the link in the banner or the **Status reason** column. The Operation view page opens directly on the **Deployment validations** tab, which shows validation details, including Logical ID, Resource type, Validation type, Mode, and Status reason. + + 4. Fix the identified issues in your template and retry the operation. @@ -85 +138,8 @@ Use the following procedure to validate your stack deployment using the console. -###### To validate a template before deployment + + + +### Validate using a change set (console) + +You can also use change sets to validate your template before deployment. Change sets support all six validation types, including WARN-mode validations (S3 bucket emptiness, service quota, Config Recorder conflict, and ECR repository delete readiness) that are only available during change set creation. You can use a change set to validate a new stack before you create it, or to validate an update to an existing stack. + +###### To validate using a change set @@ -103 +163 @@ Use the following procedure to validate your stack deployment using the console. - 9. CloudFormation will create the change set and run validation checks. Review the validation results in the **Deployment validation** tab. + 9. CloudFormation creates the change set and runs validation checks. Review the validation results in the **Deployment validation** tab. @@ -114 +174 @@ Use the following procedure to validate your stack deployment using the console. -The AWS CLI commands for pre-deployment validation include: +Pre-deployment validation runs automatically on `create-stack` and `update-stack` commands. @@ -116,5 +176 @@ The AWS CLI commands for pre-deployment validation include: - * [create-change-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-change-set.html) automatically validating during change set creation. - - * [describe-change-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-change-set.html) to verify the change set status - - * [describe-events](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-events.html) to review validation results. +###### Create a stack with validation @@ -121,0 +178 @@ The AWS CLI commands for pre-deployment validation include: +Use the following command to create a stack. Pre-deployment validation runs automatically. @@ -123,0 +181,3 @@ The AWS CLI commands for pre-deployment validation include: + aws cloudformation create-stack \ + --stack-name MyStack \ + --template-body file://template.yaml @@ -125 +185 @@ The AWS CLI commands for pre-deployment validation include: -Use the following procedure to validate your stack deployment using the AWS CLI. +###### Update a stack with validation @@ -127 +187 @@ Use the following procedure to validate your stack deployment using the AWS CLI. -###### To validate a template before deployment +Use the following command to update a stack. Pre-deployment validation runs automatically. @@ -129 +188,0 @@ Use the following procedure to validate your stack deployment using the AWS CLI. - 1. Use the [create-change-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-change-set.html) command: @@ -131 +190 @@ Use the following procedure to validate your stack deployment using the AWS CLI. - aws cloudformation create-change-set \ + aws cloudformation update-stack \ @@ -133,2 +191,0 @@ Use the following procedure to validate your stack deployment using the AWS CLI. - --change-set-name MyChangeSet \ - --change-set-type "CREATE" \ @@ -137 +194,3 @@ Use the following procedure to validate your stack deployment using the AWS CLI. -The command returns both the change set ARN and the stack ARN. +###### View validation results + +Use the following command to view validation results for a stack operation. @@ -139 +197,0 @@ The command returns both the change set ARN and the stack ARN. - 2. Use the [describe-events](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-events.html) command with either the change set ARN or the change set name to review validation status and results. @@ -142 +200,3 @@ The command returns both the change set ARN and the stack ARN. - --change-set-name "arn:aws:cloudformation:us-east-1:123456789012:changeSet/MyChangeSet/94498df5-1afb-43b1-9869-9f82b2d877ac" + --stack-name MyStack + +Example output of validation errors: @@ -144 +203,0 @@ The command returns both the change set ARN and the stack ARN. -Example output of a validation errors: @@ -152 +211 @@ Example output of a validation errors: - "OperationType":"CREATE_CHANGESET", + "OperationType":"CREATE_STACK", @@ -163 +222 @@ Example output of a validation errors: - "OperationType":"CREATE_CHANGESET", + "OperationType":"CREATE_STACK", @@ -177,0 +237,21 @@ Example output of a validation errors: +### Validate using a change set (AWS CLI) + +Change sets also surface WARN-mode validations that are not available on direct stack operations. + +###### To validate using a change set + + 1. Use the [create-change-set](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/create-change-set.html) command: + + aws cloudformation create-change-set \ + --stack-name MyStack \ + --change-set-name MyChangeSet \ + --change-set-type "CREATE" \ + --template-body file://updated-template.yaml + +The command returns both the change set ARN and the stack ARN. + + 2. Use the [describe-events](https://docs.aws.amazon.com/cli/latest/reference/cloudformation/describe-events.html) command with the change set ARN to review validation status and results. + + aws cloudformation describe-events \ + --change-set-name "arn:aws:cloudformation:us-east-1:123456789012:changeSet/MyChangeSet/94498df5-1afb-43b1-9869-9f82b2d877ac" + @@ -180 +260 @@ Example output of a validation errors: - 4. Once validation passes, execute the change set: + 4. After validation passes, execute the change set: @@ -198,0 +279,6 @@ Pre-deployment validation includes the following types of checks: + * Service Quota Validation – Checks whether creating resources would exceed your AWS service quotas. This validation currently runs during change set creation only and operates in WARN mode. The operation proceeds, and you receive alerts about potential quota issues. + + * Recorder Conflict Detection – Warns when your template adds rules to an account that doesn't have recording enabled, or defines an Recorder in an account where one is already active. This validation currently runs during change set creation only and operates in WARN mode. + + * ECR Repository Delete Readiness – Validates that ECR repositories targeted for deletion are empty or have appropriate force-delete settings. This validation currently runs during change set creation only and operates in WARN mode. + @@ -201,0 +288,11 @@ Pre-deployment validation includes the following types of checks: +The following table summarizes each validation type, its mode, and the operations on which it runs. + +Validation type | Mode | Available on +---|---|--- +Property syntax validation | FAIL | CreateStack, UpdateStack, CreateChangeSet +Resource name conflict (RAE) | FAIL | CreateStack, UpdateStack, CreateChangeSet +S3 bucket emptiness | WARN | CreateChangeSet +Service Quota | WARN | CreateChangeSet +Recorder conflict | WARN | CreateChangeSet +ECR Repository delete readiness | WARN | CreateChangeSet + @@ -1037,0 +1135,14 @@ The following resource types are not supported for pre-deployment validation: