AWS elasticbeanstalk documentation change
Summary
Expanded documentation to focus on EC2 security group and instance type configuration via AWS CLI. Added detailed examples for disabling default security groups, specifying custom security groups, and handling load balancer security groups across different environment types.
Security assessment
The changes provide guidance on security group management (a security feature) but do not address a specific vulnerability or incident. The documentation explains how to configure custom security groups and disable defaults, which is a security best practice but not a direct response to a disclosed issue.
Diff
diff --git a/elasticbeanstalk/latest/dg/using-features.managing.ec2.aws-cli.md b/elasticbeanstalk/latest/dg/using-features.managing.ec2.aws-cli.md index 04123312a..62badc1f8 100644 --- a//elasticbeanstalk/latest/dg/using-features.managing.ec2.aws-cli.md +++ b//elasticbeanstalk/latest/dg/using-features.managing.ec2.aws-cli.md @@ -5 +5 @@ -# Configuring Amazon EC2 instances using the AWS CLI +EC2 security groupsInstance types @@ -7 +7,245 @@ -Use the AWS Command Line Interface (AWS CLI) to create and configure Elastic Beanstalk environments using commands in your command-line shell. This section provides examples of the [create-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/create-environment.html) and [update-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/update-environment.html) commands. +# Configuring Amazon EC2 security groups and instance types using the AWS CLI + +You can use the AWS Command Line Interface (AWS CLI) to configure the Amazon EC2 instances in your Elastic Beanstalk environments. + +## Configuring EC2 security groups + +This topic provides examples for different EC2 security group configurations for both single-instance and load balanced (multi-instance) environments. For more information about the options in these examples, see [aws:autoscaling:launchconfiguration](./command-options-general.html#command-options-general-autoscalinglaunchconfiguration). + +###### Notes + +The create environment operation provides an EC2 security group by default. It also creates an environment with an application load balancer by default. + +The update environment operation can be used to either disable or enable the default EC2 security group for your environment with the boolean option `DisableDefaultEC2SecurityGroup`. _Example 5_ shows how to set your environment back to the default security configuration if you had previously modified it. + +The following examples show a [create-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/create-environment.html) command opting out of the default EC2 security group and providing custom security groups instead. Since the `DisableDefaultEC2SecurityGroup` option is set to `true`, the default EC2 security group that Elastic Beanstalk normally associates to the EC2 instances is not created. Therefore, you must provide other security groups with the `SecurityGroups` option. + +Note that the [aws:elasticbeanstalk:environment](./command-options-general.html#command-options-general-elasticbeanstalkenvironment) `EnvironmentType` option is set to `SingleInstance`. To create a single instance environment, you must specify this option, because `LoadBalanced` is the default `EnvironmentType`. Since this environment does not include a load balancer, we don't need to specify a load balancer security group. + +###### Example 1 — New single-instance environment with custom EC2 security groups (namespace options inline) + + + aws elasticbeanstalk create-environment \ + --region us-east-1 \ + --application-name my-app \ + --environment-name my-env \ + --solution-stack-name "64bit Amazon Linux 2023 v6.5.0 applrunning Node.js 22" \ + --option-settings \ + Namespace=aws:elasticbeanstalk:environment,OptionName=EnvironmentType,Value=SingleInstance \ + Namespace=aws:autoscaling:launchconfiguration,OptionName=IamInstanceProfile,Value=aws-elasticbeanstalk-ec2-role \ + Namespace=aws:autoscaling:launchconfiguration,OptionName=DisableDefaultEC2SecurityGroup,Value=true \ + Namespace=aws:autoscaling:launchconfiguration,OptionName=SecurityGroups,Value=sg-abcdef01, sg-abcdef02 \ + Namespace=aws:autoscaling:launchconfiguration,OptionName=EC2KeyName,Value=my-keypair + +As an alternative, use an `options.json` file to specify the namespace options instead of including them inline. + +###### Example 2 — New single-instance environment with custom EC2 security groups (namespace options in `options.json` file) + + + aws elasticbeanstalk create-environment \ + --region us-east-1 \ + --application-name my-app \ + --environment-name my-env \ + --solution-stack-name "64bit Amazon Linux 2023 v6.5.0 running Node.js 22" \ + --option-settings file://options.json + + + ### example options.json ### + [ + { "Namespace" : "aws:elasticbeanstalk:environment", + "OptionName" : "EnvironmentType", + "Value" : "SingleInstance" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "IamInstanceProfile", + "Value": "aws-elasticbeanstalk-ec2-role" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "DisableDefaultEC2SecurityGroup", + "Value": "true" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "SecurityGroups", + "Value": "sg-abcdef01, sg-abcdef02" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "EC2KeyName", + "Value": "my-keypair" + } + ] + +The following example creates a load-balanced environment. It specifies the [aws:elasticbeanstalk:environment](./command-options-general.html#command-options-general-elasticbeanstalkenvironment) namespace option `LoadBalancerType` set to `application`. Since we're disabling the default EC2 security group with the `DisableDefaultEC2SecurityGroup` option, we need to provide our own custom security groups for the EC2 instances again, with the [aws:autoscaling:launchconfiguration](./command-options-general.html#command-options-general-autoscalinglaunchconfiguration) `SecurityGroups` option, like the previous example. Since this environment has a load balancer to route traffic, we must provide security groups for the load balancer as well. + +To create an environment with a with a classic load balancer, but otherwise the same configuration, update the configuration for the [aws:elasticbeanstalk:environment](./command-options-general.html#command-options-general-elasticbeanstalkenvironment) namespace option `LoadBalancerType` to `classic`. + +The different load balancer types have different namespaces that hold the options to specify the security groups: + + * application load balancer – [aws:elbv2:loadbalancer](./command-options-general.html#command-options-general-elbv2) `SecurityGroups` option + + * classic load balancer – [aws:elb:loadbalancer](./command-options-general.html#command-options-general-elbloadbalancer) `SecurityGroups` option + + * network load balancer – since network load balancers do not have security groups, configure the EC2 security groups with VPC identifiers. For more information, see [ Update the security groups for your Network Load Balancer](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-security-groups.html) in the _User Guide for Network Load Balancers_. + + + + +###### Example 3 — New multi-instance environment with custom EC2 security groups (namespace options in `options.json` file) + + + aws elasticbeanstalk create-environment \ + --region us-east-1 \ + --application-name my-app \ + --environment-name my-env \ + --solution-stack-name "64bit Amazon Linux 2023 v6.5.0 running Node.js 22" \ + --option-settings file://options.json + + + ### example options.json ### + [ + { + "Namespace" : "aws:elasticbeanstalk:environment", + "OptionName" : "EnvironmentType", + "Value" : "LoadBalanced" + }, + { + "Namespace" : "aws:elasticbeanstalk:environment", + "OptionName" : "LoadBalancerType", + "Value" : "application" + }, + { + "Namespace" : "aws:elbv2:loadbalancer", + "OptionName" : "SecurityGroups", + "Value" : "sg-abcdefghikl012345" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "IamInstanceProfile", + "Value": "aws-elasticbeanstalk-ec2-role" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "DisableDefaultEC2SecurityGroup", + "Value": "true" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "SecurityGroups", + "Value": "sg-abcdef01, sg-abcdef02" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "EC2KeyName", + "Value": "my-keypair" + } + ] + +You can disable the default EC2 security group for an existing environment with the [update-environment](https://docs.aws.amazon.com/cli/latest/reference/elasticbeanstalk/update-environment.html) command. The following example command disables the default EC2 security group and assigns the environment's EC2 instances custom EC2 security groups. + +Use the example `options.jason` files in examples 4(a), 4(b), or 4(c), depending on whether the environment is load balanced and the type of load balancer. Configuration file 4(a) specifies the security groups for a single-instance environment. Since it doesn't require a load balancer, we only provide the security group for the EC2 instances. Configuration files 4(b) and 4(c) specify the security groups for an application load balancer and a classic load balancer. For these cases we also need to specify security groups for the load balancer. + +###### Example 4 — Update an existing environment to disable default EC2 security group (namespace options in `options.json` file) + + + aws elasticbeanstalk update-environment \ + --region us-east-1 \ + --application-name my-app \ + --environment-name my-env \ + --solution-stack-name "64bit Amazon Linux 2023 v6.5.0 running Node.js 22" \ + --option-settings file://options.json + +###### Example 4(a) — Configuration file for single-instance environment (no load balancer) + + + ### example options.json ### + [ + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "DisableDefaultEC2SecurityGroup", + "Value": "true" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "SecurityGroups", + "Value": "sg-abcdef01, sg-abcdef02" + } + ] + +To update an environment that uses an application load balancer, use the `aws:elbv2:loadbalancer` namespace to specify the security groups for the load balancer. + +###### Example 4(b) — Configuration file for environment with an application load balancer + + + ### example options.json ### + [ + { + "Namespace" : "aws:elbv2:loadbalancer", + "OptionName" : "SecurityGroups", + "Value" : "sg-abcdefghikl012345" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "DisableDefaultEC2SecurityGroup", + "Value": "true" + }, + { + "Namespace": "aws:autoscaling:launchconfiguration", + "OptionName": "SecurityGroups", + "Value": "sg-abcdef01, sg-abcdef02"