AWS elasticbeanstalk documentation change
Summary
Clarified how environment variables are initialized with secrets from Secrets Manager and Parameter Store, simplified examples by removing redundant CLI commands and consolidating options.json usage.
Security assessment
The changes provide clearer documentation on securely managing secrets via AWS services but do not indicate resolution of a specific security vulnerability.
Diff
diff --git a/elasticbeanstalk/latest/dg/AWSHowTo.secrets.env-vars.md b/elasticbeanstalk/latest/dg/AWSHowTo.secrets.env-vars.md index c365848b8..0cacda0b4 100644 --- a//elasticbeanstalk/latest/dg/AWSHowTo.secrets.env-vars.md +++ b//elasticbeanstalk/latest/dg/AWSHowTo.secrets.env-vars.md @@ -159 +159 @@ You can use Elastic Beanstalk [configuration files](./ebextensions.html) to conf -You can use the AWS Command Line Interface (AWS CLI) to configure secrets as Elastic Beanstalk environment variables. This section provides examples of the [create-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/create-environment.html) and [update-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/update-environment.html) commands with the [aws:elasticbeanstalk:application:environmentsecrets](./command-options-general.html#command-options-general-elasticbeanstalk-application-environmentsecrets) namespace. +You can use the AWS Command Line Interface (AWS CLI) to configure secrets as Elastic Beanstalk environment variables. This section provides examples of the [create-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/create-environment.html) and [update-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/update-environment.html) commands with the [aws:elasticbeanstalk:application:environmentsecrets](./command-options-general.html#command-options-general-elasticbeanstalk-application-environmentsecrets) namespace. When Elastic Beanstalk bootstraps the EC2 instances for the environments that these command reference, it initializes the environment variables with the fetched secret and the parameter values. It fetches these values from the respective ARNs of Secrets Manager and Systems Manager Parameter Store. @@ -161 +161 @@ You can use the AWS Command Line Interface (AWS CLI) to configure secrets as Ela -The two following examples use the [create-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/create-environment.html) command to add a secret and a parameter, configured as environment variables, to the new environment that the command creates. When Elastic Beanstalk bootstraps the EC2 instances for this environment, it will initialize the environment variables with the values it fetches for the secret and the parameter from the respective ARNs of Secrets Manager and Systems Manager Parameter Store. +The two following examples use the [create-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/create-environment.html) command to add a secret and a parameter, configured as environment variables named `MY_SECRET`and `MY_PARAMETER`. @@ -202,15 +202 @@ As an alternative, use an `options.json` file to specify the namespace options i -The next two examples use the [update-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/update-environment.html) command to add a secret and a parameter, configured as environment variables, to an existing environment. When Elastic Beanstalk bootstraps the EC2 instances for this environment, it will initialize the environment variables with the values it fetches for the secret and the parameter from the respective ARNs of Secrets Manager and Systems Manager Parameter Store. - -###### Example of update-environment with secrets configured as environment variables (namespace options inline) - - - aws elasticbeanstalk update-environment \ - --region us-east-1 \ - --application-name my-app \ - --environment-name my-env \ - --solution-stack-name "64bit Amazon Linux 2023 v6.5.0 running Node.js 20" \ - --option-settings \ - Namespace=aws:elasticbeanstalk:application:environmentsecrets,OptionName=MY_SECRET,Value=arn:aws:secretsmanager:us-east-1:111122223333:secret:mysecret \ - Namespace=aws:elasticbeanstalk:application:environmentsecrets,OptionName=MY_PARAMETER,Value=arn:aws:ssm:us-east-1:111122223333:parameter/myparam - -As an alternative, use an `options.json` file to specify the namespace options instead of including them inline. +The next example configures environment variables, named `MY_SECRET`and `MY_PARAMETER`, to store a secret and a parameter for an existing environment. The [update-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/update-environment.html) command passes options with the same syntax as the `create-environment` command, either inline or with an `options.json` file. The following example demonstrates the command using the same `options.json` file that's also used in the previous example. @@ -228,15 +213,0 @@ As an alternative, use an `options.json` file to specify the namespace options i - - ### example options.json ### - [ - { - "Namespace": "aws:elasticbeanstalk:application:environmentsecrets", - "OptionName": "MY_SECRET", - "Value": "arn:aws:secretsmanager:us-east-1:111122223333:secret:mysecret" - }, - { - "Namespace": "aws:elasticbeanstalk:application:environmentsecrets", - "OptionName": "MY_PARAMETER", - "Value": "arn:aws:ssm:us-east-1:111122223333:parameter/myparam" - } - ] -