CloudFormation Stack Policy

Run list-stacks command (OSX/Linux/UNIX) to list the names of all CloudFormation stacks available in the selected AWS region:

aws cloudformation list-stacks
    --region us-east-1
    --output table
    --query 'StackSummaries[*].StackName'

The command output should return a table with the requested CloudFormation stack names:

--------------------
|    ListStacks    |
+------------------+
|  MyAppProdStack  |
|  MyAppTestStack  |
|  MyAppDevStack   |
+------------------+

Now run get-stack-policy command (OSX/Linux/UNIX) to expose the stack policy for the specified CloudFormation stack:

aws cloudformation get-stack-policy
	--region us-east-1
	--stack-name MyAppProdStack

The command output should return the policy document body for the selected stack, e.g.:

{
   "StackPolicyBody": "{
      "Statement" : [
        {
          "Effect" : "Deny",
          "Action" : "Update:*",
          "Principal": "*",
          "Resource" : "*"
        }
      ]
   }"
}

If the command is not returning an output, the selected CloudFormation stack does not have any policies attached, therefore the stack resources are not protected against accidental updates. To apply a policy to an existing stack, follow the steps outlined in the Remediation/Resolution section.

Repeat step no. 3 and 4 to verify if the other stacks available in the selected region have policies attached.

Perform steps no. 1 – 5 to repeat the audit process for the other AWS regions.

Define the stack policy based on the type of resources that you want to protect against accidental updates. A stack policy is a JSON-based document that contains the stack update actions performed by all CloudFormation users and the resources that these actions apply to. Based on your needs, you can use one of the example policies defined below.

1. To prevent updates to all stack resources, use the following policy document:
   {
     "Statement" : [
       {
         "Effect" : "Deny",
         "Action" : "Update:*",
         "Principal": "*",
         "Resource" : "*"
       }
     ]
   }
   

2. To prevent updates to a certain stack resource, use the following policy document. The resource used in the example below is an EC2 instance available within the stack (highlighted):
   {
     "Statement" : [
       {
         "Effect" : "Allow",
         "Action" : "Update:*",
         "Principal": "*",
         "Resource" : "*"
       },
       {
         "Effect" : "Deny",
         "Action" : "Update:*",
         "Principal": "*",
         "Resource" : "MyEC2Instance/ProductionAppServer"
       }
     ]
   }
   

3. To prevent updates to all Instances of a stack resource type, use the following policy document. The resource type used in the example below is the EC2 instance (highlighted):
   {
     "Statement" : [
       {
         "Effect" : "Allow",
         "Action" : "Update:*",
         "Principal": "*",
         "Resource" : "*"
       },
       {
         "Effect" : "Deny",
         "Action" : "Update:*",
         "Principal": "*",
         "Resource" : "*",
         "Condition" : {
           "StringEquals" : {
             "ResourceType" : ["AWS::EC2::Instance"]
           }
         }
       }
     ]
   }
   

4. To prevent updates to nested CloudFormation stacks, use the following policy document:
   {
     "Statement" : [
       {
         "Effect" : "Allow",
         "Action" : "Update:*",
         "Principal": "*",
         "Resource" : "*"
       },
       {
         "Effect" : "Deny",
         "Action" : "Update:*",
         "Principal": "*",
         "Resource" : "*",
         "Condition" : {
           "StringEquals" : {
             "ResourceType" : ["AWS::CloudFormation::Stack"]
           }
         }
       }
     ]
   }
   

Now run create-bucket command (OSX/Linux/UNIX) to create the S3 bucket that will store your stack policies. The S3 bucket must be created in the same AWS region as the CloudFormation stack:

aws s3api create-bucket
    --bucket cfn-policies
    --region us-east-1

The command output should return the new S3 bucket location:

{
    "Location": "/cfn-policies"
}

Paste one of the policy documents outlined at step no. 1 in a JSON file (e.g., cfn-custom-policy.json) based on your requirements, then run put-object command (OSX/Linux/UNIX) to upload the file to the newly created S3 bucket:

aws s3api put-object
    --bucket cfn-policies
    --key cfn-custom-policy.json
    --body cfn-custom-policy.json

The command output should return the entity tag (ETag) for the uploaded JSON file:

{
    "ETag": "\"1a9339b338972f4de8d2550180da7d31\""
}

Run set-stack-policy command (OSX/Linux/UNIX) to attach the stack policy created at step no. 4 to the selected CloudFormation stack (if successful, the command does not return an output):

aws cloudformation set-stack-policy
    --region us-east-1
    --stack-name MyAppProdStack
    --stack-policy-url https://s3.amazonaws.com/cfn-policies/cfn-custom-policy.json

Once attached, you cannot detach a stack policy. If you need to update your stack and remove the protection from all resources, you can modify the policy to explicitly allow all actions on all resources and repeat steps no. 4 – 6 to apply the new policy. The following policy allows all updates on all resources available in the stack:

{
  "Statement" : [
    {
      "Effect" : "Allow",
      "Action" : "Update:*",
      "Principal": "*",
      "Resource" : "*"
    }
  ]
}

Repeat step no. 4 – 6 to apply stack policies to other CloudFormation stacks available in the selected region.

Change the AWS region to repeat the process for the other regions.