AWS cli: CloudWatch alarm ActionConfiguration and tag propagation documented
Summary
Adds documentation for the new MetricAlarms ActionConfiguration/AlarmTagsPropagation structure (Enabled, IncludedTagKeys, ExcludedTagKeys) and notes the required cloudwatch:ListTagsForResource permission when tag inclusion is enabled; also bumps the CLI reference version to 2.38.2.
Security assessment
The change documents a new alarm action configuration that propagates alarm tags into notifications/state-change events and explicitly states the IAM permission (cloudwatch:ListTagsForResource) required to enable it. This is security-adjacent IAM/permission guidance and a potential information-exposure surface (tags in notifications), but it addresses no specific vulnerability.
Evidence
>>>>> When this is `true` , you must have the `cloudwatch:ListTagsForResource` permission on the alarm to create or update it.
Diff
diff --git a/cli/latest/reference/cloudwatch/describe-alarms-for-metric.md b/cli/latest/reference/cloudwatch/describe-alarms-for-metric.md index f67210f..4d2dd22 100644 --- a//cli/latest/reference/cloudwatch/describe-alarms-for-metric.md +++ b//cli/latest/reference/cloudwatch/describe-alarms-for-metric.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -1125,0 +1126,62 @@ MetricAlarms -> (list) +>> +>> ActionConfiguration -> (structure) +>> +>>> Settings that change the content of the notifications and events that the alarm sends when its state changes. These settings apply to the alarm’s actions, whichever state triggers them. +>>> +>>> AlarmTagsPropagation -> (structure) +>>> +>>>> Settings for including the alarm’s tags in its action notifications and state-change events. +>>>> +>>>> Enabled -> (boolean) [required] +>>>> +>>>>> Set to `true` to include the alarm’s tags. Set to `false` to stop including them. +>>>>> +>>>>> When this is `true` , you must have the `cloudwatch:ListTagsForResource` permission on the alarm to create or update it. +>>>> +>>>> IncludedTagKeys -> (list) +>>>> +>>>>> The tag keys to include. Only the alarm’s tags with these keys are included. +>>>>> +>>>>> You can specify 1 to 50 tag keys. Each tag key must be 1 to 128 characters long. +>>>>> +>>>>> You can’t specify both `IncludedTagKeys` and `ExcludedTagKeys` . +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `50` +>>>>> + +>>>>> +>>>>> (string) +>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `1` +>>>>>> * max: `128` +>>>>>> + +>>>> +>>>> ExcludedTagKeys -> (list) +>>>> +>>>>> The tag keys to exclude. All of the alarm’s tags except those with these keys are included. +>>>>> +>>>>> You can specify 1 to 50 tag keys. Each tag key must be 1 to 128 characters long. +>>>>> +>>>>> You can’t specify both `IncludedTagKeys` and `ExcludedTagKeys` . +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `50` +>>>>> + +>>>>> +>>>>> (string) +>>>>> +>>>>>> Constraints: +>>>>>> +>>>>>> * min: `1` +>>>>>> * max: `128` +>>>>>> + @@ -1137 +1199 @@ MetricAlarms -> (list) - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »