AWS glue high security documentation change
Summary
Updated multiple regular expression patterns for input validation, including adding KMS ARN validation and reordering existing patterns. Added new custom string pattern #62.
Security assessment
The change updates pattern #42 to validate KMS ARNs, which is critical for encryption configuration. Incorrect validation could lead to security misconfigurations. This directly addresses potential security vulnerabilities by enforcing proper ARN formats for encryption keys.
Diff
diff --git a/glue/latest/dg/aws-glue-api-common.md b/glue/latest/dg/aws-glue-api-common.md index adbf696ad..b039f7651 100644 --- a//glue/latest/dg/aws-glue-api-common.md +++ b//glue/latest/dg/aws-glue-api-common.md @@ -453 +453 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #42 – "`^subnet-[a-z0-9]+$`" + * Custom string pattern #42 – "`^$|arn:aws[a-z0-9-]*:kms:.*`" @@ -455 +455 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #43 – "`[\p{L}\p{N}\p{P}]*`" + * Custom string pattern #43 – "`^subnet-[a-z0-9]+$`" @@ -457 +457 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #44 – "`[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`" + * Custom string pattern #44 – "`[\p{L}\p{N}\p{P}]*`" @@ -459 +459 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #45 – "`[a-zA-Z0-9-_$#.]+`" + * Custom string pattern #45 – "`[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}`" @@ -461 +461 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #46 – "`^\d{12}$`" + * Custom string pattern #46 – "`[a-zA-Z0-9-_$#.]+`" @@ -463 +463 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #47 – "`^(\w+\.)+\w+$`" + * Custom string pattern #47 – "`^\d{12}$`" @@ -465 +465 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #48 – "`^([2-3]|3[.]9)$`" + * Custom string pattern #48 – "`^(\w+\.)+\w+$`" @@ -467 +467 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #49 – "`arn:aws(-(cn|us-gov|iso(-[bef])?))?:glue:.*`" + * Custom string pattern #49 – "`^([2-3]|3[.]9)$`" @@ -469 +469 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #50 – "`(^arn:aws(-(cn|us-gov|iso(-[bef])?))?:iam::\w{12}:root)`" + * Custom string pattern #50 – "`arn:aws(-(cn|us-gov|iso(-[bef])?))?:glue:.*`" @@ -471 +471 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #51 – "`^arn:aws(-(cn|us-gov|iso(-[bef])?))?:iam::[0-9]{12}:role/.+`" + * Custom string pattern #51 – "`(^arn:aws(-(cn|us-gov|iso(-[bef])?))?:iam::\w{12}:root)`" @@ -473 +473 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #52 – "`[\s\S]*`" + * Custom string pattern #52 – "`^arn:aws(-(cn|us-gov|iso(-[bef])?))?:iam::[0-9]{12}:role/.+`" @@ -475 +475 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #53 – "`([\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF]|[^\S\r\n"'= ;])*`" + * Custom string pattern #53 – "`[\s\S]*`" @@ -477 +477 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #54 – "`^[A-Z\_]+$`" + * Custom string pattern #54 – "`([\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF]|[^\S\r\n"'= ;])*`" @@ -479 +479 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #55 – "`^[A-Za-z0-9]+$`" + * Custom string pattern #55 – "`^[A-Z\_]+$`" @@ -481 +481 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #56 – "`[*A-Za-z0-9_-]*`" + * Custom string pattern #56 – "`^[A-Za-z0-9]+$`" @@ -483 +483 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #57 – "`([\u0020-\u007E\r\s\n])*`" + * Custom string pattern #57 – "`[*A-Za-z0-9_-]*`" @@ -485 +485 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #58 – "`[A-Za-z0-9_-]*`" + * Custom string pattern #58 – "`([\u0020-\u007E\r\s\n])*`" @@ -487 +487 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #59 – "`([\u0009\u000B\u000C\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF])*`" + * Custom string pattern #59 – "`[A-Za-z0-9_-]*`" @@ -489 +489 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #60 – "`([\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF\s])*`" + * Custom string pattern #60 – "`([\u0009\u000B\u000C\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF])*`" @@ -491 +491,3 @@ The API uses the following regular expressions to define what is valid content f - * Custom string pattern #61 – "`([^\r\n])*`" + * Custom string pattern #61 – "`([\u0020-\uD7FF\uE000-\uFFFD\uD800\uDC00-\uDBFF\uDFFF\s])*`" + + * Custom string pattern #62 – "`([^\r\n])*`"