By Implementation

Service Control PoliciesConfig RulesAuto Remediation RulesConformance PacksAmazon GuardDutyAmazon InspectorAWS Security HubAWS Network FirewallAmazon MacieS3 Bucket PoliciesCloudWatch Alarms and Event RulesAWS WAFAWS Secrets ManagerAWS Systems ManagerSecurity Groups & NACLsAWS KMSIAM Policies

By Service Protected

Configuration Packages

Strategy Guides

Other

IAM Policies

Prevent Creating or Updating CloudFormation Stacks that Contain Specific AWS Resource Types

An IAM policy that prevents creating or updating CloudFormation stacks that contain specific resource types by using the cloudformation:ResourceTypes condition key (This policy uses IAM resources as the default example). This policy also provides the permissions necessary to complete this action on the console.

AWS Blog: CloudFormation Security Best Practices
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "cloudformation:UpdateStack",
                "cloudformation:DeleteStack"
            ],
            "Resource": "*",
            "Effect": "Deny",
            "Condition": {
                "StringNotEquals": {
                    "cloudformation:ResourceTypes": [
                        "AWS::IAM::*"
                    ]
                }
            }
        },
        {
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:UpdateStack"
            ],
            "Resource": "*",
            "Effect": "Deny",
            "Condition": {
                "Null": {
                    "cloudformation:ResourceTypes": "true"
                }
            }
        }
    ]
}

Actions



Customize Template

Policy Parameters

* Required field