AWS elasticbeanstalk documentation change
Summary
Expanded documentation for DisableDefaultEC2SecurityGroup option to clarify requirements when disabling default security groups, including load balancer security group configuration dependencies. Added cross-references to security group requirements in multiple namespaces.
Security assessment
The changes enhance documentation about security group configuration requirements when opting out of default security groups. While this improves security posture guidance, there is no evidence of addressing a specific existing vulnerability. The updates help prevent misconfigurations that could lead to exposure, but don't reference any patched security issue.
Diff
diff --git a/elasticbeanstalk/latest/dg/command-options-general.md b/elasticbeanstalk/latest/dg/command-options-general.md index d2cf40a50..e68654ba9 100644 --- a//elasticbeanstalk/latest/dg/command-options-general.md +++ b//elasticbeanstalk/latest/dg/command-options-general.md @@ -111 +111,7 @@ Namespace: `aws:autoscaling:launchconfiguration` **Name** | **Description** | ** -DisableDefaultEC2SecurityGroup | When set to the default value of `false`, Elastic Beanstalk creates a default security group that allows traffic from the internet or load balancer on the standard ports for HTTP (80). It attaches this security group to the EC2 instances of the environment when it creates the environment. When set to `true`, Elastic Beanstalk will not assign the default security group to the EC2 instances. The `SecurityGroups` option of this namespace will require at least one value if you set this option to `true`. Use the `SecurityGroups` option to define your chosen security groups. For more information, see [Managing EC2 security groups](./using-features.managing.ec2.instances.sg.html). If a value is specified for EC2KeyName in an environment that has `DisableDefaultEC2SecurityGroup` set to `true` a default security group will not be associated with the EC2 instances. | `false` | `true` `false` +DisableDefaultEC2SecurityGroup | When set to the default value of `false`, Elastic Beanstalk creates a default security group that allows traffic from the internet or load balancer on the standard ports for HTTP (80). It attaches this security group to the EC2 instances of the environment when it creates the environment. When set to `true` Elastic Beanstalk will not assign the default security group to the EC2 instances for a new environment. For an existing environment, Elastic Beanstalk will unassign the default EC2 security group from your environment's EC2 instances. As a result, you must also set the following configurations: + + * The `SecurityGroups` option of this namespace will require at least one value to define your custom security group(s). + * For environments with a load balancer, you will also need to set the `SecurityGroups` options in another namespace to configure custom security groups for the load balancer. For application load balancers, set the option in the aws:elbv2:loadbalancer namespace. For classic load balancers, set the option in the aws:elb:loadbalancer namespace. + * For more information, see [Managing EC2 security groups](./using-features.managing.ec2.instances.sg.html). + +If a value is specified for EC2KeyName in an environment that has `DisableDefaultEC2SecurityGroup` set to `true` a default security group will not be associated with the EC2 instances. | `false` | `true` `false` @@ -649 +655 @@ If you use the Elastic Beanstalk console or EB CLI to create an environment, you -SecurityGroups | Assign one or more security groups that you created to the load balancer. | None | One or more security group IDs. +SecurityGroups | Assign one or more security groups that you created to the load balancer. Required if `DisableDefaultEC2SecurityGroup` (aws:autoscaling:launchconfiguration) is set to `true`. Load balanced environments that have opted out of the default Elastic Beanstalk EC2 security group must provide one or more security groups with this option. For more information, see [Managing EC2 security groups](./using-features.managing.ec2.instances.sg.html). | None | One or more security group IDs. @@ -784 +790 @@ ManagedSecurityGroup | Assign an existing security group to your environment’ -SecurityGroups | A list of security groups to attach to the load balancer. For a shared load balancer, if you don't specify this value, Elastic Beanstalk checks if an existing security group that it manages is already attached to the load balancer. If one isn't attached to the load balancer, Elastic Beanstalk creates a security group and attaches it to the load balancer. Elastic Beanstalk deletes this security group when the last environment sharing the load balancer terminates. The load balancer security groups are used to set up the Amazon EC2 instance security group ingress rule. | The security group that Elastic Beanstalk creates for your load balancer. | Comma-separated list of security group IDs. +SecurityGroups | A list of security groups to attach to the load balancer. Required if `DisableDefaultEC2SecurityGroup` (aws:autoscaling:launchconfiguration) is set to `true`. Load balanced environments that have opted out of the default Elastic Beanstalk EC2 security group must provide one or more security groups with this option. For more information, see [Managing EC2 security groups](./using-features.managing.ec2.instances.sg.html). For a shared load balancer, if you don't specify this value, Elastic Beanstalk checks if an existing security group that it manages is already attached to the load balancer. If one isn't attached to the load balancer, Elastic Beanstalk creates a security group and attaches it to the load balancer. Elastic Beanstalk deletes this security group when the last environment sharing the load balancer terminates. The load balancer security groups are used to set up the Amazon EC2 instance security group ingress rule. | The security group that Elastic Beanstalk creates for your load balancer. | Comma-separated list of security group IDs.