AWS elasticbeanstalk documentation change
Summary
Added 'aws:elasticbeanstalk:application:environmentsecrets' namespace and documentation for secrets integration
Security assessment
Documents new configuration options for securely referencing secrets/parameters from AWS services, enhancing security practices without addressing a specific vulnerability
Diff
diff --git a/elasticbeanstalk/latest/dg/command-options-general.md b/elasticbeanstalk/latest/dg/command-options-general.md index 23c820fa7..474f8204a 100644 --- a/elasticbeanstalk/latest/dg/command-options-general.md +++ b/elasticbeanstalk/latest/dg/command-options-general.md @@ -5 +5 @@ -aws:autoscaling:asgaws:autoscaling:launchconfigurationaws:autoscaling:scheduledactionaws:autoscaling:triggeraws:autoscaling:updatepolicy:rollingupdateaws:ec2:instancesaws:ec2:vpcaws:elasticbeanstalk:applicationaws:elasticbeanstalk:application:environmentaws:elasticbeanstalk:cloudwatch:logsaws:elasticbeanstalk:cloudwatch:logs:healthaws:elasticbeanstalk:commandaws:elasticbeanstalk:environmentaws:elasticbeanstalk:environment:process:defaultaws:elasticbeanstalk:environment:process:process_nameaws:elasticbeanstalk:environment:proxy:staticfilesaws:elasticbeanstalk:healthreporting:systemaws:elasticbeanstalk:hostmanageraws:elasticbeanstalk:managedactionsaws:elasticbeanstalk:managedactions:platformupdateaws:elasticbeanstalk:monitoringaws:elasticbeanstalk:sns:topicsaws:elasticbeanstalk:sqsdaws:elasticbeanstalk:trafficsplittingaws:elasticbeanstalk:xrayaws:elb:healthcheckaws:elb:loadbalanceraws:elb:listeneraws:elb:listener:listener_portaws:elb:policiesaws:elb:policies:policy_nameaws:elbv2:listener:defaultaws:elbv2:listener:listener_portaws:elbv2:listenerrule:rule_nameaws:elbv2:loadbalanceraws:rds:dbinstance +aws:autoscaling:asgaws:autoscaling:launchconfigurationaws:autoscaling:scheduledactionaws:autoscaling:triggeraws:autoscaling:updatepolicy:rollingupdateaws:ec2:instancesaws:ec2:vpcaws:elasticbeanstalk:applicationaws:elasticbeanstalk:application:environmentaws:elasticbeanstalk:application:environmentsecretsaws:elasticbeanstalk:cloudwatch:logsaws:elasticbeanstalk:cloudwatch:logs:healthaws:elasticbeanstalk:commandaws:elasticbeanstalk:environmentaws:elasticbeanstalk:environment:process:defaultaws:elasticbeanstalk:environment:process:process_nameaws:elasticbeanstalk:environment:proxy:staticfilesaws:elasticbeanstalk:healthreporting:systemaws:elasticbeanstalk:hostmanageraws:elasticbeanstalk:managedactionsaws:elasticbeanstalk:managedactions:platformupdateaws:elasticbeanstalk:monitoringaws:elasticbeanstalk:sns:topicsaws:elasticbeanstalk:sqsdaws:elasticbeanstalk:trafficsplittingaws:elasticbeanstalk:xrayaws:elb:healthcheckaws:elb:loadbalanceraws:elb:listeneraws:elb:listener:listener_portaws:elb:policiesaws:elb:policies:policy_nameaws:elbv2:listener:defaultaws:elbv2:listener:listener_portaws:elbv2:listenerrule:rule_nameaws:elbv2:loadbalanceraws:rds:dbinstance @@ -28,0 +29,2 @@ aws:autoscaling:asgaws:autoscaling:launchconfigurationaws:autoscaling:scheduleda + * aws:elasticbeanstalk:application:environmentsecrets + @@ -362 +364,16 @@ Any environment variable name. | Pass in key-value pairs. | None | Any enviro -See [Environment properties and other software settings](./environments-cfg-softwaresettings.html) for more information. +See [Environment variables and other software settings](./environments-cfg-softwaresettings.html) for more information. + +## aws:elasticbeanstalk:application:environmentsecrets + +Configure environment variables to serve as _environment secrets_ for your application. Environment secrets store AWS Secrets Manager secrets or AWS Systems Manager Parameter Store parameters. + +Namespace: `aws:elasticbeanstalk:application:environmentsecrets` **Name** | **Description** | **Default** | **Valid values** +---|---|---|--- +OptionName | Specifies the name of the environment variable to hold the secret store or parameter store value. | None | Any environment variable name. +Value | Specifies the ARN for the value stored in AWS Secrets Manager or AWS Systems Manager Parameter Store. During instance bootstrapping Elastic Beanstalk initiates the environment variable to the value stored in this ARN resource. + +###### Note + +Ensure that the necessary permissions are in place for your environment's EC2 instance profile role to access the secret and parameter ARNs. For more information, see [Required IAM permissions](./AWSHowTo.secrets.IAM-permissions.html). | None | Valid ARN value for an AWS Secrets Manager secret or AWS Systems Manager Parameter Store parameter value. + +For more information, see [Configuring secrets as environment variables](./AWSHowTo.secrets.env-vars.html).