AWS cdk medium security documentation change
Summary
Removed redundant 'Topics' section and replaced hardcoded example values (SSO session names, account IDs, regions, etc.) with placeholder syntax (<...>)
Security assessment
Replacing hardcoded values (e.g., account IDs, profile names) with placeholders emphasizes security best practices by discouraging accidental exposure of sensitive credentials in documentation examples. This reduces the risk of users copy-pasting real credentials into insecure contexts.
Diff
diff --git a/cdk/v2/guide/configure-access-sso-example-cli.md b/cdk/v2/guide/configure-access-sso-example-cli.md index 2732c9469..4fad42f95 100644 --- a//cdk/v2/guide/configure-access-sso-example-cli.md +++ b//cdk/v2/guide/configure-access-sso-example-cli.md @@ -13,13 +12,0 @@ In this example, we configure the AWS Command Line Interface (AWS CLI) to authen -###### Topics - - * Prerequisites - - * Step 1: Configure the AWS CLI - - * Step 2: Use the AWS CLI to generate security credentials - - * Step 3: Use the CDK CLI - - - - @@ -49,3 +36,3 @@ Next, we use the AWS CLI `aws configure sso` command to configure an IAM Identit - SSO session name (Recommended): my-sso - SSO start URL [None]: https://my-sso-portal.awsapps.com/start - SSO region [None]: us-east-1 + SSO session name (Recommended): <my-sso> + SSO start URL [None]: <https://my-sso-portal.awsapps.com/start> + SSO region [None]: <us-east-1> @@ -60,2 +47,2 @@ After establishing our session, the AWS CLI displays the AWS accounts available - > DeveloperAccount, [email protected] (123456789011) - ProductionAccount, [email protected] (123456789022) + > DeveloperAccount, [email protected] (<123456789011>) + ProductionAccount, [email protected] (<123456789022>) @@ -68 +55 @@ Next, the AWS CLI displays the IAM roles available to us from our selected accou - Using the account ID 123456789011 + Using the account ID @@ -78,3 +65,3 @@ Next, the AWS CLI prompts us to complete configuration by specifying a default o - CLI default client Region [None]: us-west-2 <ENTER>> - CLI default output format [None]: json <ENTER> - CLI profile name [123456789011_FullAccess]: my-dev-profile <ENTER> + CLI default client Region [None]: <us-west-2> <ENTER> + CLI default output format [None]: <json> <ENTER> + CLI profile name [123456789011_FullAccess]: <my-dev-profile> <ENTER> @@ -87 +74 @@ The AWS CLI displays a final message, showing how to use the named profile with - aws s3 ls --profile my-dev-profile + aws s3 ls --profile <my-dev-profile> @@ -92,6 +79,6 @@ After completing this step, our `config` file will look like the following: - [profile my-dev-profile] - sso_session = my-sso - sso_account_id = 123456789011 - sso_role_name = fullAccess - region = us-west-2 - output = json + [profile <my-dev-profile>] + sso_session = <my-sso> + sso_account_id = <123456789011> + sso_role_name = <fullAccess> + region = <us-west-2> + output = <json> @@ -99,4 +86,4 @@ After completing this step, our `config` file will look like the following: - [sso-session my-sso] - sso_region = us-east-1 - sso_start_url = https://my-sso-portal.awsapps.com/start - sso_registration_scopes = sso:account:access + [sso-session <my-sso>] + sso_region = <us-east-1> + sso_start_url = <https://my-sso-portal.awsapps.com/start> + sso_registration_scopes = <sso:account:access> @@ -113 +100 @@ We use the AWS CLI `aws sso login` command to request security credentials for o - $ aws sso login --profile my-dev-profile + $ aws sso login --profile <my-dev-profile> @@ -126 +113 @@ With any CDK CLI command, we use the `[--profile](./ref-cli-cmd.html#ref-cli-cmd - $ cdk diff --profile my-dev-profile + $ cdk diff --profile <my-dev-profile> @@ -141 +128 @@ When our credentials expire, an error message like the following will display: - $ cdk diff --profile my-dev-profile + $ cdk diff --profile <my-dev-profile> @@ -149 +136 @@ To refresh our credentials, we use the AWS CLI `aws sso login` command: - $ aws sso login --profile my-dev-profile + $ aws sso login --profile <my-dev-profile>