AWS cli: Add --action-configuration (alarm tags propagation) to PutCompositeAlarm
Summary
Documents a new --action-configuration structure with AlarmTagsPropagation (Enabled, IncludedTagKeys, ExcludedTagKeys), including shorthand and JSON syntax, and notes that enabling tag propagation requires the cloudwatch:ListTagsForResource permission on the alarm.
Security assessment
The new option controls what tag data is embedded in alarm notifications/state-change events and explicitly introduces a required IAM permission (cloudwatch:ListTagsForResource) for enabling it. This is security-adjacent configuration/permission guidance with potential tag-data exposure in notifications, but it documents a feature rather than fixing a vulnerability.
Evidence
>>> When this is `true` , you must have the `cloudwatch:ListTagsForResource` permission on the alarm to create or update it.
Diff
diff --git a/cli/latest/reference/cloudwatch/put-composite-alarm.md b/cli/latest/reference/cloudwatch/put-composite-alarm.md index f198653..4217a86 100644 --- a//cli/latest/reference/cloudwatch/put-composite-alarm.md +++ b//cli/latest/reference/cloudwatch/put-composite-alarm.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -107,0 +108 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/monito + [--action-configuration <value>] @@ -399,0 +401,80 @@ JSON Syntax: +`--action-configuration` (structure) + +> Settings that change the content of the notifications and events that the alarm sends when its state changes. These settings apply to the alarm’s actions, whichever state triggers them. +> +> AlarmTagsPropagation -> (structure) +> +>> Settings for including the alarm’s tags in its action notifications and state-change events. +>> +>> Enabled -> (boolean) [required] +>> +>>> Set to `true` to include the alarm’s tags. Set to `false` to stop including them. +>>> +>>> When this is `true` , you must have the `cloudwatch:ListTagsForResource` permission on the alarm to create or update it. +>> +>> IncludedTagKeys -> (list) +>> +>>> The tag keys to include. Only the alarm’s tags with these keys are included. +>>> +>>> You can specify 1 to 50 tag keys. Each tag key must be 1 to 128 characters long. +>>> +>>> You can’t specify both `IncludedTagKeys` and `ExcludedTagKeys` . +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `50` +>>> + +>>> +>>> (string) +>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `128` +>>>> + +>> +>> ExcludedTagKeys -> (list) +>> +>>> The tag keys to exclude. All of the alarm’s tags except those with these keys are included. +>>> +>>> You can specify 1 to 50 tag keys. Each tag key must be 1 to 128 characters long. +>>> +>>> You can’t specify both `IncludedTagKeys` and `ExcludedTagKeys` . +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `50` +>>> + +>>> +>>> (string) +>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `128` +>>>> + + +Shorthand Syntax: + + + AlarmTagsPropagation={Enabled=boolean,IncludedTagKeys=[string,string],ExcludedTagKeys=[string,string]} + + +JSON Syntax: + + + { + "AlarmTagsPropagation": { + "Enabled": true|false, + "IncludedTagKeys": ["string", ...], + "ExcludedTagKeys": ["string", ...] + } + } + + @@ -549 +630 @@ None - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »