AWS elasticbeanstalk medium security documentation change
Summary
Clarified that get-config retrieves plain text environment variables and added note about secret storage limitations. Added guidance for retrieving secrets via Secrets Manager/Parameter Store.
Security assessment
Explicitly warns against using get-config for secrets and directs users to secure secret management services. Addresses potential exposure of sensitive data through environment variables.
Diff
diff --git a/elasticbeanstalk/latest/dg/custom-platforms-scripts.md b/elasticbeanstalk/latest/dg/custom-platforms-scripts.md index 180175e04..e8a4dc398 100644 --- a/elasticbeanstalk/latest/dg/custom-platforms-scripts.md +++ b/elasticbeanstalk/latest/dg/custom-platforms-scripts.md @@ -13 +13 @@ This topic describes tools that AWS Elastic Beanstalk provides for environments -Use the `get-config` tool to retrieve environment variable values and other platform and instance information. The tool is available at `/opt/elasticbeanstalk/bin/get-config`. +Use the `get-config` tool to retrieve plain text environment variable values and other platform and instance information. The tool is available at `/opt/elasticbeanstalk/bin/get-config`. @@ -51 +51 @@ To return a specific configuration option value, use the `--namespace` (`-n`) op -The `get-config environment` command returns an object containing a list of environment properties. These include both user-configured properties and those that are provided by Elastic Beanstalk. +The `get-config environment` command returns an object containing a list of environment properties, including both user-configured and provided by Elastic Beanstalk. The user-configured properties are defined in the [console](./environments-cfg-softwaresettings.html#environments-cfg-softwaresettings-console) as _Plain text_ or with the configuration option namespace [aws:elasticbeanstalk:application:environment](./command-options-general.html#command-options-general-elasticbeanstalkapplicationenvironment). @@ -64,0 +65,4 @@ To return a specific environment property, use the `--key` (`-k`) option to spec +###### Note + +The `get-config` tool cannot retrieve [environment variables that store secrets](./AWSHowTo.secrets.env-vars.html). For more information about how to programmatically retrieve values from secret or parameter stores, see [Using Secrets Manager](./AWSHowTo.secrets.Secrets-Manager-and-Parameter-Store.html#AWSHowTo.secrets.Secrets-Manager) or [Using Systems Manager Parameter Store](./AWSHowTo.secrets.Secrets-Manager-and-Parameter-Store.html#AWSHowTo.secrets.SSM-parmameter-store). +