AWS elasticbeanstalk high security documentation change
Summary
Updated private repository authentication to use Parameter Store secrets instead of environment variables, added IAM requirements, and modified platform hook script security practices.
Security assessment
Replaces insecure environment variable usage with secure parameter retrieval, implements credential handling that prevents shell history exposure, and enforces IAM permissions for secret access. Directly addresses credential storage security.
Diff
diff --git a/elasticbeanstalk/latest/dg/docker-configuration.remote-repo.md b/elasticbeanstalk/latest/dg/docker-configuration.remote-repo.md index 5ebb37030..7615952d1 100644 --- a/elasticbeanstalk/latest/dg/docker-configuration.remote-repo.md +++ b/elasticbeanstalk/latest/dg/docker-configuration.remote-repo.md @@ -74 +74 @@ You can configure Elastic Beanstalk to log in to your private repository before -This configuration initiates events in the _prebuild_ phase of the Elastic Beanstalk deployment process. You set this up in the [.ebextentions](./ebextensions.html) configuration directory. The configuration uses [platform hook](./platforms-linux-extend.hooks.html) scripts that call **docker login** to authenticate to the online registry that hosts the private repository. A detailed breakdown of these configuration steps follows. +This configuration initiates events in the _prebuild_ phase of the Elastic Beanstalk deployment process. You set this up in the [.ebextentions](./ebextensions.html) configuration directory. The configuration uses [platform hook](./platforms-linux-extend.hooks.html) scripts that call **docker login** to authenticate to the online registry that hosts the private repository. The platform hook scripts securely read the credential data from Elastic Beanstalk environment variables that are initialized by a configuration that sources the values from AWS Systems Manager Parameter Store. Your Elastic Beanstalk Docker and ECS managed Docker platforms must be a version released on or after [March 26, 2025](https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2025-03-26-windows.html) to support this [environment variable configuration](./AWSHowTo.secrets.env-vars.html). A detailed breakdown of these configuration steps follows. @@ -76 +76 @@ This configuration initiates events in the _prebuild_ phase of the Elastic Beans -###### To configure Elastic Beanstalk to authenticate to your private repository with AWS SSM +###### To configure Elastic Beanstalk to authenticate to your private repository with AWS Systems Manager Parameter Store @@ -80 +80 @@ This configuration initiates events in the _prebuild_ phase of the Elastic Beans -You need to set up AWS Systems Manager to complete these steps. For more information, see the [AWS Systems Manager User Guide](https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started.html) +You need to set up your credentials in the AWS Systems Manager Parameter Store and also set up required IAM permissions to complete these steps. For more information, see [Prerequisites to configure secrets as environment variables](./AWSHowTo.secrets.env-vars.html#AWSHowTo.secrets.configure-env-vars.prerequisites). @@ -95 +95 @@ You need to set up AWS Systems Manager to complete these steps. For more informa - 2. Use the [AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started.html) Parameter Store to save the credentials of your private repository so that Elastic Beanstalk can retrieve your credentials when required. For this, run the [**put-parameter**](https://docs.aws.amazon.com/cli/latest/reference/ssm/put-parameter.html) command. + 2. Use the [AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/getting-started.html) Parameter Store to save the credentials of your private repository. Run the following AWS CLI Systems Manager **put-parameter** command to create these in the Parameter Store. @@ -100 +100 @@ You need to set up AWS Systems Manager to complete these steps. For more informa - 3. Create the following `env.config` file and place it in the `.ebextensions` directory as shown in the preceding directory structure. This configuration uses the [aws:elasticbeanstalk:application:environment](./command-options-general.html#command-options-general-elasticbeanstalkapplicationenvironment) namespace to initialize the `USER` and `PASSWD` Elastic Beanstalk environment variables to the values in the SSM Parameter Store. + 3. Create the following `env.config` file and place it in the `.ebextensions` directory as shown in the preceding directory structure. This configuration uses the [aws:elasticbeanstalk:application:environmentsecrets](./command-options-general.html#command-options-general-elasticbeanstalk-application-environmentsecrets) namespace to initialize the `USER` and `PASSWD` Elastic Beanstalk environment variables to the values that are stored in the Systems Manager Parameter Store. @@ -107,3 +107,3 @@ You need to set up AWS Systems Manager to complete these steps. For more informa - aws:elasticbeanstalk:application:environment: - USER: '{{resolve:ssm:USER:1}}' - PASSWD: '{{resolve:ssm:PASSWD:1}}' + aws:elasticbeanstalk:application:environmentsecrets: + USER: arn:aws:ssm:us-east-1:111122223333:parameter/user + PASSWD: arn:aws:secretsmanager:us-east-1:111122223333:passwd @@ -119,2 +119 @@ You need to set up AWS Systems Manager to complete these steps. For more informa - USER=/opt/elasticbeanstalk/bin/get-config environment -k USER - /opt/elasticbeanstalk/bin/get-config environment -k PASSWD | docker login -u $USER --password-stdin + echo $PASSWD | docker login -u $USER --password-stdin @@ -122 +121 @@ You need to set up AWS Systems Manager to complete these steps. For more informa -The `01login.sh` script calls the [get-config](./custom-platforms-scripts.html#custom-platforms-scripts.get-config) platform script to retrieve the repository credentials. It stores the user name in the `USER` variable. In the next line, it retrieves the password. Instead of storing the password in a variable, the script pipes the password directly to the **docker login** command in the `stdin` input stream. The `--password-stdin` option uses the input stream, so you don't have to store the password in a variable. For more information about authentication with the Docker command line interface, see [docker login](https://docs.docker.com/engine/reference/commandline/login/) on the Docker documentation website. +The `01login.sh` references the Elastic Beanstalk environment variables that you configured in **Step 3** to store the repository credentials, and it pipes the password directly to the **docker login** command in the `stdin` input stream. The `--password-stdin` option uses the input stream, preventing the password from persisting in the shell history or audit logs. For more information about authentication with the Docker command line interface, see [docker login](https://docs.docker.com/engine/reference/commandline/login/) on the Docker documentation website.