AWS gameliftstreams medium security documentation change
Summary
Updated documentation with quota adjustment instructions, added application log bucket policy details, corrected CLI command syntax examples, and improved resource identifiers
Security assessment
Added explicit S3 bucket permission policy requirements for application logs. This addresses potential misconfiguration risks by providing exact IAM policy requirements, which is a security-related documentation improvement to prevent insecure bucket permissions.
Diff
diff --git a/gameliftstreams/latest/developerguide/applications.md b/gameliftstreams/latest/developerguide/applications.md index 10c31aed6..bc8e28847 100644 --- a//gameliftstreams/latest/developerguide/applications.md +++ b//gameliftstreams/latest/developerguide/applications.md @@ -5 +5 @@ -Before you uploadUpload your application to an Amazon S3 bucketCreate an applicationEdit an applicationDelete an applicationLinked stream groups +Before you uploadUpload your application to an Amazon S3 bucketCreate an applicationEdit an applicationDelete an applicationApplication log bucket permission policyLinked stream groups @@ -19 +19 @@ Name | Default | Adjustable | Description -Files per application | 30,000 files | No* | The maximum number of files that you can have in an application, in this account. +Files per application | 30,000 files | Yes* | The maximum number of files that you can have in an application, in this account. @@ -21 +21 @@ Single file size | 80 GiB | No | The maximum size of a single file in an applica -Application size | 100 GiB | No* | The maximum total size of an Amazon GameLift Streams application, in this account. Note that a gibibyte (GiB) equals 1024*1024*1024 bytes. +Application size | 100 GiB | Yes* | The maximum total size of an Amazon GameLift Streams application, in this account. Note that a gibibyte (GiB) equals 1024*1024*1024 bytes. @@ -23 +23 @@ Application size | 100 GiB | No* | The maximum total size of an Amazon GameLift -*To request an increase, reach out to your AWS Account Manager. +*To request an increase, sign in to the AWS Management Console and open the Service Quotas console to [Amazon GameLift Streams](https://console.aws.amazon.com/servicequotas/home/services/gameliftstreams/quotas), where you can review your current quotas in the **Applied account-level quota value** column and submit a request to increase a value. @@ -129 +129 @@ You can edit this field at any time. -To save log files on your behalf, Amazon GameLift Streams must be given permission to your S3 bucket for saving. If you let Amazon GameLift Streams create the bucket for logging, the permission policy will be applied automatically upon creation. If you provide your own bucket, you will need to apply the permission policy, yourself. +To save log files on your behalf, Amazon GameLift Streams must be given permission to your S3 bucket for saving. If you let Amazon GameLift Streams create the bucket for logging, the permission policy will be applied automatically upon creation. If you provide your own bucket, you will need to apply the permission policy, yourself. For more information, see Application log bucket permission policy. @@ -173,3 +172 @@ You must configure the AWS CLI with your user credentials and your chosen AWS Re -In your AWS CLI enter the following command, customized for your settings. - -###### Example : `create-application` +In your AWS CLI use the [CreateApplication](https://docs.aws.amazon.com/gameliftstreams/latest/apireference/API_CreateApplication.html) command, customized for your content. @@ -179,5 +176,4 @@ In your AWS CLI enter the following command, customized for your settings. - --description ""MyGame v1"" \ - --runtime-environment 'Type=PROTON, Version=20241007'' \ - --executable-path ""launcher.exe"" \ - --application-source-uri ""s3://amzn-s3-demo-bucket/example"" - + --description "MyGame v1" \ + --runtime-environment '{"Type":"PROTON", "Version":"20241007"}' \ + --executable-path "launcher.exe" \ + --application-source-uri "s3://amzn-s3-demo-bucket/example" @@ -201 +197 @@ Choose from one of the following runtime environments. - * Ubuntu 22.04 LTS(`UBUNTU, 22_04_LTS`) + * Ubuntu 22.04 LTS(`Type=UBUNTU, Version=22_04_LTS`) @@ -205 +201 @@ Choose from one of the following runtime environments. - * Microsoft Windows Server 2022 Base (`WINDOWS, 2022`) + * Microsoft Windows Server 2022 Base (`Type=WINDOWS, Version=2022`) @@ -207,3 +203 @@ Choose from one of the following runtime environments. - * Proton 8.0-2c (`PROTON, 20230704`) - - * Proton 8.0-5 (`PROTON, 20241007`) + * Proton 8.0-2c (`Type=PROTON, Version=20230704`) @@ -211 +205 @@ Choose from one of the following runtime environments. - * `application-source-uri`: + * Proton 8.0-5 (`Type=PROTON, Version=20241007`) @@ -213 +207 @@ Choose from one of the following runtime environments. -This is the Amazon S3 URI to your application's root folder in the Amazon S3 bucket. The folder should contain your build executable and any supporting files. + * `executable-path`: @@ -215 +209 @@ This is the Amazon S3 URI to your application's root folder in the Amazon S3 buc -A valid URI is the bucket prefix that contains all the files needed to run and stream the application. For example, a bucket called `mygamebuild` contains three complete versions of the game build files, each in a separate folder. You want to stream the build in the folder `mygamebuild-EN101`. In this example, the URI is `s3://amzn-s3-demo-bucket/mygamebuild-EN101`. +This is the Amazon S3 URI to the executable file that Amazon GameLift Streams will stream. The file must be contained within the application's root folder. Enter the path relative to the `application-source-uri`. @@ -219 +213 @@ A valid URI is the bucket prefix that contains all the files needed to run and s - * `executable-path`: + * `application-source-uri`: @@ -221 +215,3 @@ A valid URI is the bucket prefix that contains all the files needed to run and s -This is the Amazon S3 URI to the executable file that Amazon GameLift Streams will stream. The file must be contained within the application's root folder. Enter the path relative to the `application-source-uri`. +This is the Amazon S3 URI to your application's root folder in the Amazon S3 bucket. The folder should contain your build executable and any supporting files. + +A valid URI is the bucket prefix that contains all the files needed to run and stream the application. For example, a bucket called `mygamebuild` contains three complete versions of the game build files, each in a separate folder. You want to stream the build in the folder `mygamebuild-EN101`. In this example, the URI is `s3://amzn-s3-demo-bucket/mygamebuild-EN101`. @@ -232 +228 @@ If the request is successful, Amazon GameLift Streams returns a response similar - "Arn": "arn:aws:gameliftstreams:us-east-2::application/HLYTnpHa1", + "Arn": "arn:aws:gameliftstreams:us-west-2:123456789012:application/a-9ZY8X7Wv6", @@ -240 +236 @@ If the request is successful, Amazon GameLift Streams returns a response similar - "Id": "HLYTnpHa1", + "Id": "a-9ZY8X7Wv6", @@ -246,2 +242 @@ If the request is successful, Amazon GameLift Streams returns a response similar - -To check the status of your application, call `aws gameliftstreams get-application`, as shown in the following example. +To check the status of your application, call the [GetApplication](https://docs.aws.amazon.com/gameliftstreams/latest/apireference/API_GetApplication.html) command, as shown in the following example. @@ -251,2 +246 @@ To check the status of your application, call `aws gameliftstreams get-applicati - --identifier [application Id value] - + --identifier a-9ZY8X7Wv6 @@ -296 +290 @@ You can edit this field at any time. -To save log files on your behalf, Amazon GameLift Streams must be given permission to your S3 bucket for saving. If you let Amazon GameLift Streams create the bucket for logging, the permission policy will be applied automatically upon creation. If you provide your own bucket, you will need to apply the permission policy, yourself. +To save log files on your behalf, Amazon GameLift Streams must be given permission to your S3 bucket for saving. If you let Amazon GameLift Streams create the bucket for logging, the permission policy will be applied automatically upon creation. If you provide your own bucket, you will need to apply the permission policy, yourself. For more information, see Application log bucket permission policy. @@ -315 +309 @@ CLI -You must configure the AWS CLI with your user credentials and your chosen AWS Region. See [Download the AWS CLI](./setting-up.html#setting-up-prereqs). +You must configure the AWS CLI with your user credentials and your chosen AWS Region. For setup instructions, refer to [Download the AWS CLI](./setting-up.html#setting-up-prereqs). @@ -319,3 +313 @@ You must configure the AWS CLI with your user credentials and your chosen AWS Re -In your AWS CLI enter the following command, customized for your settings. - -###### Example : `update-application` +In your AWS CLI use the [UpdateApplication](https://docs.aws.amazon.com/gameliftstreams/latest/apireference/API_UpdateApplication.html) command, customized for your content. @@ -325 +317 @@ In your AWS CLI enter the following command, customized for your settings. - --identifier arn:aws:gameliftstreams:us-west-2:123456789012:application/1AB2C3De4 \ + --identifier a-9ZY8X7Wv6 \ @@ -327 +319 @@ In your AWS CLI enter the following command, customized for your settings. - --application-log-paths '[".\\logs"]' + --application-log-paths '[".\\logs"]' \ @@ -332,0 +324,8 @@ where + * `identifier`: The application to edit. + +This value is an [Amazon Resource Name (ARN)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) or ID that uniquely identifies the application resource. + +ARN example: `arn:aws:gameliftstreams:us-west-2:123456789012:application/a-9ZY8X7Wv6` + +ID example: `a-9ZY8X7Wv6` + @@ -349 +348 @@ You can edit this field at any time. -To save log files on your behalf, Amazon GameLift Streams must be given permission to your S3 bucket for saving. If you let Amazon GameLift Streams create the bucket for logging, the permission policy will be applied automatically upon creation. If you provide your own bucket, you will need to apply the permission policy, yourself. +To save log files on your behalf, Amazon GameLift Streams must be given permission to your S3 bucket for saving. If you let Amazon GameLift Streams create the bucket for logging, the permission policy will be applied automatically upon creation. If you provide your own bucket, you will need to apply the permission policy, yourself. For more information, see Application log bucket permission policy. @@ -362 +361 @@ You can only delete an application that meets the following conditions: - * The application is not the default application of any stream groups. You must first delete the stream group by using the Amazon GameLift Streams console, or by using `DeleteStreamGroup` in the Amazon GameLift Streams API. + * The application is not the default application of any stream groups. You must first delete the stream group by using the Amazon GameLift Streams console, or by using [DeleteStreamGroup](https://docs.aws.amazon.com/gameliftstreams/latest/apireference/API_DeleteStreamGroup.html) in the Amazon GameLift Streams API. @@ -364 +363 @@ You can only delete an application that meets the following conditions: - * The application is not linked to any stream groups. You must first unlink the stream group by using the Amazon GameLift Streams console, or by using `DisassociateApplications` in the Amazon GameLift Streams API. + * The application is not linked to any stream groups. You must first unlink the stream group by using the Amazon GameLift Streams console, or by using [DisassociateApplications](https://docs.aws.amazon.com/gameliftstreams/latest/apireference/API_DisassociateApplications.html) in the Amazon GameLift Streams API. @@ -366 +365 @@ You can only delete an application that meets the following conditions: - * An application is not streaming in any ongoing stream session. You must wait until the client ends the stream session or call `TerminateStreamSession` in the Amazon GameLift Streams API to end the stream. + * An application is not streaming in any ongoing stream session. You must wait until the client ends the stream session or call [TerminateStreamSession](https://docs.aws.amazon.com/gameliftstreams/latest/apireference/API_TerminateStreamSession.html) in the Amazon GameLift Streams API to end the stream. @@ -396 +395 @@ You must configure the AWS CLI with your user credentials and your chosen AWS Re -In your AWS CLI enter the following command, customized for your settings: +In your AWS CLI use the [DeleteApplication](https://docs.aws.amazon.com/gameliftstreams/latest/apireference/API_DeleteApplication.html) command, customized for your content. @@ -400,2 +399 @@ In your AWS CLI enter the following command, customized for your settings: - --identifier application Id - + --identifier arn:aws:gameliftstreams:us-west-2:123456789012:application/a-9ZY8X7Wv6 @@ -407 +405,5 @@ where -This value is an Amazon Resource Name (ARN) or an ID that uniquely identifies the application resource. Format example: ARN—`arn:aws:gameliftstreams:us-west-2:123456789012:application/9ZY8X7Wv6` or ID—`9ZY8X7Wv6`. +This value is an [Amazon Resource Name (ARN)](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html) or ID that uniquely identifies the application resource. + +ARN example: `arn:aws:gameliftstreams:us-west-2:123456789012:application/a-9ZY8X7Wv6` + +ID example: `a-9ZY8X7Wv6` @@ -413,0 +416,26 @@ Amazon GameLift Streams begins deleting the application. During this time, the a +## Application log bucket permission policy + +If you provide your own application log Amazon S3 bucket, you will need to apply a permission policy to the bucket so that Amazon GameLift Streams can save log files to the bucket. Use the following template to update the permissions in Amazon S3. + +**Bucket permission policy template** + +Copy the following policy code and apply it to the bucket that you want to use for application logs. Be sure to replace **amzn-s3-demo-bucket** with the name of your existing S3 bucket. + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "PutPolicy", + "Effect": "Allow", + "Principal": { + "Service": [ + "gameliftstreams.amazonaws.com" + ] + }, + "Action": "s3:PutObject", + "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/*" + } + ] + } + @@ -416 +444 @@ Amazon GameLift Streams begins deleting the application. During this time, the a -If you want to stream multiple application by using the same pool of compute resources, you can link multiple applications to the same stream group. Similarly, if you want to stream an application by using different sets of compute resources, you can link an application to multiple stream groups. +If you want to stream multiple applications by using the same pool of compute resources, you can link multiple applications to the same stream group. Similarly, if you want to stream an application by using different sets of compute resources, you can link an application to multiple stream groups.