AWS elasticbeanstalk documentation change
Summary
Added troubleshooting section for environments accessing secrets via environment variables, including IAM permission checks and error resolution
Security assessment
The changes document best practices for handling secrets in environment variables and IAM permissions, but do not indicate resolution of a specific security vulnerability.
Diff
diff --git a/elasticbeanstalk/latest/dg/troubleshooting-kb.md b/elasticbeanstalk/latest/dg/troubleshooting-kb.md index b82db9ead..c2fa64b41 100644 --- a/elasticbeanstalk/latest/dg/troubleshooting-kb.md +++ b/elasticbeanstalk/latest/dg/troubleshooting-kb.md @@ -5 +5 @@ -Environment creationDeploymentsHealthConfigurationDockerFAQ +Environment variables for secretsEnvironment creationDeploymentsHealthConfigurationDockerFAQ @@ -12,0 +13,2 @@ This topic provides more specific troubleshooting tips by category. + * Environments that access secrets and parameters with environment variables + @@ -27,0 +30,27 @@ This topic provides more specific troubleshooting tips by category. +## Environments that access secrets and parameters with environment variables + +**Event:** _Instance deployment failed to get one or more secrets_ + +This message indicates that Elastic Beanstalk was not able to fetch one or more of the secrets specified during your application deployment. + + * Check that the resources specified by the ARN values in your environment variable configuration exist. + + * Confirm that your Elastic Beanstalk EC2 instance profile role has the [required IAM permissions](./AWSHowTo.secrets.IAM-permissions.html#AWSHowTo.secrets.IAM-permissions.secrets-manager) to access the resources. + + * If this event was triggered through the `RestartAppServer` operation, once the issue is fixed, retry the `RestartAppServer` call to resolve the issue. + + * If the event was triggered through an `UpdateEnvironment` call, retry the `UpdateEnvironment` operation. + + + + +For examples of these commands, see [_AWS CLI examples for Elastic Beanstalk_](https://docs.aws.amazon.com/cli/latest/userguide/cli_elastic-beanstalk_code_examples.html). For more information about the API actions for these operations, see the _[AWS Elastic Beanstalk API Reference](https://docs.aws.amazon.com/elasticbeanstalk/latest/api/)_. + +**Event:** _Instance deployment detected one or more multiline environment values, which are not supported for this platform_ + +Multiline variables are not supported for Amazon Linux 2 platforms, excluding Docker and ECS managed Docker platforms. For available options to proceed, see [Multiline values](./AWSHowTo.secrets.env-vars.html#AWSHowTo.secrets.multiline). + +**Event:** _CreateEnvironment fails when a secret is specified_ + +When `CreateEnvironment` fails and you have secrets as environment variables, you need to address the underlying issue and then use `UpdateEnvironment` to complete the environment setup. Do not use `RestartAppServer`, as it will not be sufficient to bring the environment up in this situation. For examples of these commands, see [_AWS CLI examples for Elastic Beanstalk_](https://docs.aws.amazon.com/cli/latest/userguide/cli_elastic-beanstalk_code_examples.html). For more information about the API actions for these operations, see the _[AWS Elastic Beanstalk API Reference](https://docs.aws.amazon.com/elasticbeanstalk/latest/api/)_. +