Merge pull request #48 from tjenkinson/patch-2

document that CF action RoleArn needs access to the template, but CF service role doesn't

Author: darlaker

doc_source/action-reference-CloudFormation.md

@@ -66,6 +66,9 @@ This property is required for the following action modes:
 + DELETE\_ONLY
 + CHANGE\_SET\_REPLACE
 
+**Note**  
+CloudFormation is given an S3 signed URL to the template, and therefore this `RoleArn` does not need permission to access the artifact bucket. However, the action `RoleArn` _does_ need permission to access the artifact bucket, in order to generate the signed URL.
+
 **TemplatePath**  
 Required: Conditional  
 `TemplatePath` represents the AWS CloudFormation template file\. You include the file in an input artifact to this action\. The file name follows this format:  
@@ -194,4 +197,4 @@ InputArtifacts:
 
 The following related resources can help you as you work with this action\.
 + [Configuration Properties Reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/continuous-delivery-codepipeline-action-reference.html) – This reference chapter in the *AWS CloudFormation User Guide* provides more descriptions and examples for these CodePipeline parameters\.
-+ [AWS CloudFormation API Reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/) – The [CreateStack](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html) parameter in the *AWS CloudFormation API Reference* describes stack parameters for AWS CloudFormation templates\.
++ [AWS CloudFormation API Reference](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/) – The [CreateStack](https://docs.aws.amazon.com/AWSCloudFormation/latest/APIReference/API_CreateStack.html) parameter in the *AWS CloudFormation API Reference* describes stack parameters for AWS CloudFormation templates\.