AWS cli: Add --action-configuration (alarm tags propagation) to PutLogAlarm
Summary
Documents a new --action-configuration structure with AlarmTagsPropagation (Enabled, IncludedTagKeys, ExcludedTagKeys), including shorthand and JSON syntax, and notes that enabling tag propagation requires the cloudwatch:ListTagsForResource permission on the alarm, plus a CLI version bump.
Security assessment
Identical feature addition to the log-alarm command: it governs propagation of alarm tags into notifications/events and documents the IAM permission required to enable it, making it security-adjacent (permission and data-exposure consideration) but not a fix for a specific vulnerability.
Evidence
>>> When this is `true` , you must have the `cloudwatch:ListTagsForResource` permission on the alarm to create or update it.
Diff
diff --git a/cli/latest/reference/cloudwatch/put-log-alarm.md b/cli/latest/reference/cloudwatch/put-log-alarm.md index eefd7ed..e7aac4f 100644 --- a//cli/latest/reference/cloudwatch/put-log-alarm.md +++ b//cli/latest/reference/cloudwatch/put-log-alarm.md @@ -15 +15 @@ - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) » @@ -92,0 +93 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/monito + [--action-configuration <value>] @@ -574,0 +576,80 @@ JSON Syntax: +`--action-configuration` (structure) + +> Settings that change the content of the notifications and events that the alarm sends when its state changes. These settings apply to the alarm’s actions, whichever state triggers them. +> +> AlarmTagsPropagation -> (structure) +> +>> Settings for including the alarm’s tags in its action notifications and state-change events. +>> +>> Enabled -> (boolean) [required] +>> +>>> Set to `true` to include the alarm’s tags. Set to `false` to stop including them. +>>> +>>> When this is `true` , you must have the `cloudwatch:ListTagsForResource` permission on the alarm to create or update it. +>> +>> IncludedTagKeys -> (list) +>> +>>> The tag keys to include. Only the alarm’s tags with these keys are included. +>>> +>>> You can specify 1 to 50 tag keys. Each tag key must be 1 to 128 characters long. +>>> +>>> You can’t specify both `IncludedTagKeys` and `ExcludedTagKeys` . +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `50` +>>> + +>>> +>>> (string) +>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `128` +>>>> + +>> +>> ExcludedTagKeys -> (list) +>> +>>> The tag keys to exclude. All of the alarm’s tags except those with these keys are included. +>>> +>>> You can specify 1 to 50 tag keys. Each tag key must be 1 to 128 characters long. +>>> +>>> You can’t specify both `IncludedTagKeys` and `ExcludedTagKeys` . +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `50` +>>> + +>>> +>>> (string) +>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `128` +>>>> + + +Shorthand Syntax: + + + AlarmTagsPropagation={Enabled=boolean,IncludedTagKeys=[string,string],ExcludedTagKeys=[string,string]} + + +JSON Syntax: + + + { + "AlarmTagsPropagation": { + "Enabled": true|false, + "IncludedTagKeys": ["string", ...], + "ExcludedTagKeys": ["string", ...] + } + } + + @@ -700 +781 @@ None - * [AWS CLI 2.38.1 Command Reference](../../index.html) » + * [AWS CLI 2.38.2 Command Reference](../../index.html) »