AWS CloudFormation Security - Reference

AWS CloudFormation Security - Reference

This reference guide contains detailed information about AWS CloudFormation resources and configurations for infrastructure security, encryption, and secrets management.

AWS::KMS::Key

Creates a customer master key (CMK) in AWS Key Management Service.

Properties

Key Policy Structure

KeyPolicy:
  Version: "2012-10-17"
  Id: "key-policy-identifier"
  Statement:
    - Sid: "EnableIAMPolicies"
      Effect: Allow
      Principal:
        AWS: "arn:aws:iam::account-id:role/role-name"
      Action:
        - kms:Create*
        - kms:Describe*
        - kms:Enable*
        - kms:List*
        - kms:Put*
        - kms:Update*
        - kms:Revoke*
        - kms:Disable*
        - kms:Get*
        - kms:Delete*
        - kms:TagResource
        - kms:UntagResource
      Resource: "*"
    - Sid: "AllowCryptographicOperations"
      Effect: Allow
      Principal:
        AWS: "arn:aws:iam::account-id:role/role-name"
      Action:
        - kms:Encrypt
        - kms:Decrypt
        - kms:GenerateDataKey*
        - kms:ReEncrypt*
      Resource: "*"

Key Policy Conditions

Conditions:
  - StringEquals:
      aws:PrincipalOrgID: "o-organization-id"
  - StringEquals:
      aws:SourceAccount: !Ref AWS::AccountId
  - ArnEquals:
      aws:SourceArn: "arn:aws:lambda:region:account:function:function-name"

Example

Resources:
  SecureKmsKey:
    Type: AWS::KMS::Key
    Properties:
      Description: "KMS Key for sensitive data encryption"
      KeyPolicy:
        Version: "2012-10-17"
        Id: "secure-key-policy"
        Statement:
          - Sid: "EnableIAMPolicies"
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:role/AdminRole"
            Action: kms:*
            Resource: "*"
          - Sid: "AllowCryptographicOperations"
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:role/AppRole"
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:GenerateDataKey*
            Resource: "*"
          - Sid: "AllowAWSServiceAccess"
            Effect: Allow
            Principal:
              Service: s3.amazonaws.com
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:GenerateDataKey*
            Resource: "*"
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
      EnableKeyRotation: true
      PendingWindowInDays: 30

Attributes

AWS::KMS::Alias

Creates an alias for a KMS key.

Properties

Example

Resources:
  KmsKeyAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: !Sub "alias/application-${Environment}"
      TargetKeyId: !Ref SecureKmsKey

AWS::SecretsManager::Secret

Creates a secret in AWS Secrets Manager.

Properties

SecretGenerator Structure

GenerateSecretString:
  SecretStringTemplate: '{"username": "admin"}'
  GenerateSecretKey: "password"
  PasswordLength: 32
  ExcludeCharacters: '"@/'
  ExcludeLowercase: false
  ExcludeUppercase: false
  ExcludeNumbers: false
  ExcludePunctuation: true

RotationRules Structure

RotationRules:
  AutomaticallyAfterDays: 30
  Duration: 8h
  ScheduleExpression: "rate(30 days)"

Resource Policy Example

ResourcePolicy:
  Version: "2012-10-17"
  Statement:
    - Sid: "AllowLambdaAccess"
      Effect: Allow
      Principal:
        AWS: "arn:aws:iam::account-id:role/LambdaRole"
      Action:
        - secretsmanager:GetSecretValue
        - secretsmanager:DescribeSecret
      Resource: "*"
      Condition:
        StringEquals:
          aws:ResourceTag/Environment: "production"

Example

Resources:
  DatabaseSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub "${AWS::StackName}/database/credentials"
      Description: "Database credentials with automatic rotation"
      SecretString: !Sub |
        {
          "username": "${DBUsername}",
          "password": "${DBPassword}",
          "host": "${DBHost}",
          "port": "${DBPort}"
        }
      KmsKeyId: !Ref SecretsKmsKeyId
      RotationRules:
        AutomaticallyAfterDays: 30
      ResourcePolicy:
        Version: "2012-10-17"
        Statement:
          - Sid: "AllowAppAccess"
            Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:role/AppRole"
            Action:
              - secretsmanager:GetSecretValue
            Resource: "*"

Attributes

AWS::SSM::Parameter

Creates a parameter in AWS Systems Manager Parameter Store.

Parameter Types

Properties

Example

Parameters:
  DBCredentials:
    Type: AWS::SSM::Parameter::Value<SecureString>
    NoEcho: true
    Description: Database credentials
    Value: "/app/database/credentials"

  ApiEndpoint:
    Type: AWS::SSM::Parameter::Value<String>
    Description: API endpoint URL
    Value: "https://api.example.com"

  AllowedIPs:
    Type: AWS::SSM::Parameter::Value<StringList>
    Description: List of allowed IP addresses
    Value: "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"

Resources:
  CustomParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: !Sub "/${AWS::StackName}/custom/setting"
      Type: SecureString
      Value: "sensitive-value"
      Description: "Custom secure parameter"
      AllowedPattern: "^[a-zA-Z0-9_-]+$"

AWS::IAM::Role

Creates an IAM role for AWS services or cross-account access.

Properties

Assume Role Policy Examples

# Service role for Lambda
AssumeRolePolicyDocument:
  Version: "2012-10-17"
  Statement:
    - Effect: Allow
      Principal:
        Service: lambda.amazonaws.com
      Action: sts:AssumeRole
      Condition:
        StringEquals:
          aws:SourceAccount: !Ref AWS::AccountId

# Cross-account role
AssumeRolePolicyDocument:
  Version: "2012-10-17"
  Statement:
    - Effect: Allow
      Principal:
        AWS:
          - !Sub "arn:aws:iam::account-id:root"
      Action: sts:AssumeRole
      Condition:
        StringEquals:
          aws:PrincipalAccount: "trusted-account-id"
        Bool:
          aws:MultiFactorAuthPresent: true

Example

Resources:
  SecureRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${AWS::StackName}-secure-role"
      Description: "IAM role with least privilege"
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      MaxSessionDuration: 3600
      PermissionsBoundary: !Ref PermissionsBoundary
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: SecretsPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - secretsmanager:GetSecretValue
                Resource: !Ref SecretArn

Attributes

AWS::EC2::SecurityGroup

Creates a security group for VPC resources.

Properties

Security Group Rule Structure

SecurityGroupIngress:
  - IpProtocol: tcp
    FromPort: 443
    ToPort: 443
    CidrIp: 0.0.0.0/0
    Description: "HTTPS from internet"
  - IpProtocol: tcp
    FromPort: 5432
    ToPort: 5432
    SourceSecurityGroupId: !Ref AppSecurityGroup
    Description: "PostgreSQL from app tier"

Example

Resources:
  SecureSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub "${AWS::StackName}-secure-sg"
      GroupDescription: "Security group with restricted rules"
      VpcId: !Ref VPCId
      Tags:
        - Key: Environment
          Value: !Ref Environment
      SecurityGroupIngress:
        # HTTPS from ALB
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          SourceSecurityGroupId: !Ref ALBSecurityGroup
          Description: "HTTPS from ALB"

        # SSH from bastion only
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          SourceSecurityGroupId: !Ref BastionSecurityGroup
          Description: "SSH from bastion host"

      SecurityGroupEgress:
        # HTTPS outbound
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
          Description: "HTTPS outbound"

AWS::CertificateManager::Certificate

Creates an SSL/TLS certificate in AWS Certificate Manager.

Properties

CertificateOptions Structure

Options:
  CertificateTransparencyLoggingPreference: ENABLED | DISABLED

Example

Resources:
  SSLCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      DomainName: example.com
      SubjectAlternativeNames:
        - "*.example.com"
        - "api.example.com"
      ValidationMethod: DNS
      DomainValidationOptions:
        - DomainName: example.com
          Route53HostedZoneId: !Ref HostedZoneId
        - DomainName: "*.example.com"
          Route53HostedZoneId: !Ref HostedZoneId
      Options:
        CertificateTransparencyLoggingPreference: ENABLED

Attributes

AWS::WAFv2::WebACL

Creates a Web ACL for AWS WAF.

Properties

Rule Structure

Rules:
  - Name: "RateLimitRule"
    Priority: 1
    Statement:
      RateBasedStatement:
        Limit: 2000
        EvaluationWindowSec: 60
        AggregationKeyType: IP
    Action:
      Block:
        CustomResponse:
          ResponseCode: 429
          ResponseBody: "Too many requests"
    VisibilityConfig:
      SampledRequestsEnabled: true
      CloudWatchMetricsEnabled: true
      MetricName: RateLimitRule

Action Types

Action:
  Block:
    CustomResponse:
      ResponseCode: 403
      ResponseBody: "Request blocked"
      ResponseHeaders:
        - Name: X-Frame-Options
          Value: DENY
  Allow:
    CustomRequestHandling:
      InsertHeaders:
        - Name: X-Content-Type-Options
          Value: nosniff
  Count: {}

Example

Resources:
  SecureWebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: !Sub "${AWS::StackName}-waf"
      Scope: REGIONAL
      DefaultAction:
        Allow: {}
      Rules:
        - Name: BlockSQLInjection
          Priority: 1
          Statement:
            SqliMatchStatement:
              FieldToMatch:
                Body:
                  OversizeHandling: CONTINUE
              SensitivityLevel: HIGH
          Action:
            Block:
              CustomResponse:
                ResponseCode: 403
                ResponseBody: "Request blocked - SQL injection detected"
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: BlockSQLInjection

        - Name: BlockXSS
          Priority: 2
          Statement:
            XssMatchStatement:
              FieldToMatch:
                QueryString:
                  OversizeHandling: CONTINUE
          Action:
            Block:
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: BlockXSS

        - Name: ManagedRuleSet
          Priority: 3
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet
              Version: Version_1.0
              ExcludedRules:
                - Name: SizeRestrictions_BODY
          Action:
            Count: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: ManagedRuleSet

      VisibilityConfig:
        CloudWatchMetricsEnabled: true
        MetricName: !Sub "${AWS::StackName}-WAF"
        SampledRequestsEnabled: true

AWS::Logs::LogGroup

Creates a CloudWatch Logs log group.

Properties

Example

Resources:
  EncryptedLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub "/aws/${AWS::StackName}/application"
      RetentionInDays: 30
      KmsKeyId: !Ref ApplicationKmsKey
      LogGroupClass: STANDARD

Attributes

AWS::EC2::VPCEndpoint

Creates a VPC endpoint for private connectivity to AWS services.

Properties

Example

Resources:
  SecretsManagerEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPCId
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.secretsmanager"
      VpcEndpointType: Interface
      Subnets:
        - !Ref PrivateSubnet1
        - !Ref PrivateSubnet2
      SecurityGroups:
        - !Ref AppSecurityGroup
      PrivateDnsEnabled: true

  S3Endpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPCId
      ServiceName: !Sub "com.amazonaws.${AWS::Region}.s3"
      VpcEndpointType: Gateway
      RouteTableIds:
        - !Ref PrivateRouteTable1
        - !Ref PrivateRouteTable2

Intrinsic Functions per Security

!GetAtt for Security Resources

# Get KMS key ARN
KmsKeyArn: !GetAtt ApplicationKmsKey.Arn

# Get secret ARN
SecretArn: !Ref DatabaseSecret

# Get security group ID
SecurityGroupId: !Ref ApplicationSecurityGroup

# Get log group ARN
LogGroupArn: !GetAtt EncryptedLogGroup.Arn

!Sub with AWS Variables

# Construct ARN with account and region
RoleArn: !Sub "arn:aws:iam::${AWS::AccountId}:role/${RoleName}"

# Construct secret name
SecretName: !Sub "${AWS::StackName}/${Service}/${Environment}"

!ImportValue per Cross-Stack References

# Import from network stack
VPCId: !ImportValue !Sub "${NetworkStackName}-VPCId"

# Import with function
SecurityGroupId: !ImportValue
  Fn::Sub: "${NetworkStackName}-SecurityGroupId"

Condition Functions per Security

Conditions:
  IsProduction: !Equals [!Ref Environment, production]
  EnableDetailedMonitoring: !Equals [!Ref Environment, production]
  UseCustomKMS: !Not [!Equals [!Ref KMSKeyId, ""]]
  EnableCrossAccount: !Equals [!Ref EnableCrossAccountAccess, true]

Resources:
  # Conditional KMS key
  ConditionalKmsKey:
    Type: AWS::KMS::Key
    Condition: UseCustomKMS
    Properties:
      Description: "Conditional KMS key"
      KeyPolicy: !Ref KeyPolicy

  # Conditional encryption
  EncryptedResource:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: !If [UseCustomKMS, aws:kms, AES256]
              KMSMasterKeyID: !If [UseCustomKMS, !Ref CustomKmsKey, !Ref AWS::NoValue]

KMS Key States

Secrets Manager Limits

Security Group Limits

Common Security Tags

Resources:
  SecureResource:
    Type: AWS::KMS::Key
    Properties:
      Tags:
        - Key: Environment
          Value: !Ref Environment
        - Key: Project
          Value: !Ref ProjectName
        - Key: ManagedBy
          Value: CloudFormation
        - Key: SecurityClassification
          Value: "confidential"
        - Key: Compliance
          Value: "SOC2,ISO27001"
        - Key: Owner
          Value: "security-team@example.com"