AWS appconfig documentation change
Summary
Restructured deletion protection documentation to add console configuration steps, clarify CLI commands, and document the 'DeletionProtectionCheck' parameter for bypassing protection. Removed walkthrough example and added link to dedicated bypass documentation.
Security assessment
The changes enhance documentation for a security feature (deletion protection) but do not indicate a response to a specific security vulnerability. The 'DeletionProtectionCheck' parameter documentation helps users bypass protections but is part of normal feature documentation.
Diff
diff --git a/appconfig/latest/userguide/deletion-protection.md b/appconfig/latest/userguide/deletion-protection.md index aced9633c..7a1d932e4 100644 --- a/appconfig/latest/userguide/deletion-protection.md +++ b/appconfig/latest/userguide/deletion-protection.md @@ -7 +7 @@ -AWS AppConfig provides an account setting to help prevent users from unintentionally deleting actively-used environments and configuration profiles. AWS AppConfig monitors calls to [GetLatestConfiguration](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_appconfigdata_GetLatestConfiguration.html) and [GetConfiguration](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetConfiguration.html) and tracks which configuration profiles and environments have been included in these calls within a 60-minute interval (the default setting). If you enable deletion protection and attempt to delete an active configuration profile or environment, AWS AppConfig returns an error. +AWS AppConfig provides an account setting to help prevent users from unintentionally deleting actively-used environments and configuration profiles. AWS AppConfig monitors calls to [GetLatestConfiguration](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_appconfigdata_GetLatestConfiguration.html) and [GetConfiguration](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_GetConfiguration.html) and tracks which configuration profiles and environments have been included in these calls within a 60-minute interval (the default setting). Any configuration profile or environment that was accessed within that interval will be considered active. If you attempt to delete an active configuration profile or environment, AWS AppConfig returns an error. If needed, you can bypass this error by using the `DeletionProtectionCheck` parameter. For more information, see [Bypassing or forcing a deletion protection check](./deletion-protection-check.html). @@ -9,7 +9 @@ AWS AppConfig provides an account setting to help prevent users from unintention -###### Note - -Note the following information. - - * Deletion protection is disabled by default. - - * You can increase the default interval to a maximum of 24 hours. +###### Configure deletion protection using the console @@ -16,0 +11 @@ Note the following information. +Use the following procedure to configure deletion protection by using the AWS Systems Manager console. @@ -17,0 +13 @@ Note the following information. +###### To configure deletion protection (console) @@ -18,0 +15 @@ Note the following information. + 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/appconfig/](https://console.aws.amazon.com/systems-manager/appconfig/). @@ -20 +17 @@ Note the following information. -Use the following procedures to enable and configure AWS AppConfig deletion protection. + 2. In the navigation pane, choose **Settings**. @@ -22 +19 @@ Use the following procedures to enable and configure AWS AppConfig deletion prot -###### Before you begin + 3. Use the toggle to enable or disable deletion protection. @@ -24 +21 @@ Use the following procedures to enable and configure AWS AppConfig deletion prot -Update to the latest version of the AWS CLI. For more information, see [Install or update to the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) in the _AWS Command Line Interface User Guide_. + 4. For **Protection period** , set the definition of an active resource to be between 15 and 1440 minutes. @@ -26 +23 @@ Update to the latest version of the AWS CLI. For more information, see [Install -###### To enable AWS AppConfig deletion protection + 5. Click **Apply**. @@ -28 +24,0 @@ Update to the latest version of the AWS CLI. For more information, see [Install - * Use the [UpdateAccountSettings](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_UpdateAccountSettings.html) API to enable deletion protection. Run the following command in the AWS CLI. This command doesn't specify a value for the `ProtectionPeriodInMinutes` parameter, which means the command leaves that setting unchanged. @@ -30,5 +25,0 @@ Update to the latest version of the AWS CLI. For more information, see [Install - aws appconfig update-account-settings --deletion-protection Enabled=true - -Run the following command to specify a different interval. - - aws appconfig update-account-settings --deletion-protection Enabled=true,ProtectionPeriodInMinutes=a number between 15 and 1440 @@ -36,0 +28 @@ Run the following command to specify a different interval. +###### Configure deletion protection using the AWS CLI @@ -37,0 +30 @@ Run the following command to specify a different interval. +Use the following procedure to configure deletion protection by using the AWS CLI. Replace `value` in the following commands with the value you want to use in your environment. @@ -41,10 +34 @@ Run the following command to specify a different interval. -To view the current deletion protection setting, run the following command. If you haven't configured deletion protection for your account, this command returns the default settings: - - - aws appconfig get-account-settings - -To help you manage deletion protection, the [DeleteEnvironment](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteEnvironment.html) and [DeleteConfigurationProfile](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteConfigurationProfile.html) APIs include a parameter called `DeletionProtectionCheck`. This parameter supports the following values: - - * `BYPASS`: Instructs AWS AppConfig to bypass the deletion protection check and delete a configuration profile even if deletion protection would have otherwise prevented it. - - * `APPLY`: Instructs the deletion protection check to run, even if deletion protection is disabled at the account level. `APPLY` also forces the deletion protection check to run against resources created in the past hour, which are normally excluded from deletion protection checks. +Before you begin, we recommend you update to the latest version of the AWS CLI. For more information, see [Install or update to the latest version of the AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) in the _AWS Command Line Interface User Guide_. @@ -52 +36 @@ To help you manage deletion protection, the [DeleteEnvironment](https://docs.aws - * `ACCOUNT_DEFAULT`: The default setting, which instructs AWS AppConfig to implement the deletion protection value specified in the `UpdateAccountSettings` API. +###### To configure deletion protection (CLI) @@ -53,0 +38 @@ To help you manage deletion protection, the [DeleteEnvironment](https://docs.aws + 1. Run the following command to view the current deletion protection settings. @@ -54,0 +40 @@ To help you manage deletion protection, the [DeleteEnvironment](https://docs.aws + aws appconfig get-account-settings @@ -55,0 +42 @@ To help you manage deletion protection, the [DeleteEnvironment](https://docs.aws + 2. Run the following command to enable or disable deletion protection. Specify `false` to disable deletion protection or `true` to enable it. @@ -57,19 +44 @@ To help you manage deletion protection, the [DeleteEnvironment](https://docs.aws -###### Note - -By default, `DeletionProtectionCheck` skips configuration profiles and environments created in the past hour. The default configuration is intended to prevent deletion protection from interferring with tests and demos that create short-lived resources. You can override this behavior by passing `DeletionProtectionCheck=APPLY` when calling `DeleteEnvironment` or `DeleteConfigurationProfile`. - -The following simple walkthrough uses sample commands to illustrate how to use the `DeletionProtectionCheck` parameter. - - 1. Call [GetLatestConfiguration](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_appconfigdata_GetLatestConfiguration.html) on a deployed configuration. - - aws appconfigdata get-latest-configuration --configuration-token $(aws appconfigdata start-configuration-session --application-identifier ID --environment-identifier ID --configuration-profile-identifier ID --query InitialConfigurationToken) outfile.txt - - 2. Wait 60 seconds for AWS AppConfig to register that the configuration is active. - - 3. Run the following command to call [DeleteEnvironment](https://docs.aws.amazon.com/appconfig/2019-10-09/APIReference/API_DeleteEnvironment.html) and apply deletion protection on the environment. - - aws appconfig delete-environment --environment-id ID --application-id ID --deletion-protection-check APPLY - - 4. If you call `DeleteEnvironment` again within 60 minutes, the call returns an error like the following: - - An error occurred (BadRequestException) when calling the DeleteEnvironment operation: Environment Beta is actively being used in your application and cannot be deleted. + aws appconfig update-account-settings --deletion-protection Enabled=value @@ -77 +46 @@ The following simple walkthrough uses sample commands to illustrate how to use t - 5. Run the following command to bypass deletion protection and delete the environment. + 3. You can increase the default interval to a maximum of 24 hours. Run the following command to specify a new interval. @@ -79 +48 @@ The following simple walkthrough uses sample commands to illustrate how to use t - aws appconfig delete-environment --environment-id ID --application-id ID --deletion-protection-check BYPASS + aws appconfig update-account-settings --deletion-protection Enabled=true,ProtectionPeriodInMinutes=a number between 15 and 1440 @@ -92 +61 @@ Cleaning up your environment -Security +Bypassing or forcing a deletion protection check