AWS codepipeline documentation change
Summary
Added documentation for DeploySpec file configuration, updated parameter requirements, and provided examples for EC2 deploy action configurations using both action settings and spec files
Security assessment
The changes introduce documentation for a DeploySpec file that allows specifying custom file permissions and security-conscious parameters like 'runas' user context for scripts. While this adds security configuration capabilities, there is no evidence of addressing a specific vulnerability. The documentation now explicitly shows how to implement security best practices like least-privilege execution.
Diff
diff --git a/codepipeline/latest/userguide/action-reference-EC2Deploy.md b/codepipeline/latest/userguide/action-reference-EC2Deploy.md index db31b9aba..6f630a518 100644 --- a//codepipeline/latest/userguide/action-reference-EC2Deploy.md +++ b//codepipeline/latest/userguide/action-reference-EC2Deploy.md @@ -5 +5 @@ -Action typeConfiguration parameters Input artifactsOutput artifactsService role policy permissions for the EC2 deploy actionAction declarationSee also +Action typeConfiguration parameters Input artifactsOutput artifactsService role policy permissions for the EC2 deploy actionDeploy spec file referenceAction declarationAction declaration with Deploy spec exampleSee also @@ -32,0 +33,2 @@ This action is only supported for V2 type pipelines. + * Deploy spec file reference + @@ -34,0 +37,2 @@ This action is only supported for V2 type pipelines. + * Action declaration with Deploy spec example + @@ -65 +69 @@ The tag key of the instances that you created in Amazon EC2, such as `Name`. -Required: Yes +Required: No @@ -68,0 +73,2 @@ The tag value of the instances that you created in Amazon EC2, such as `my-insta +When this value is not specified, all instances with **InstanceTagKey** will be matched. + @@ -85 +91 @@ When you create the instance, you create or use an existing EC2 instance role. T -Required: Yes +Required: Yes (If script is specified) @@ -88,0 +95,7 @@ The directory to be used on your Amazon EC2 instance to run scripts. +**DeploySpec** + + +Required: Yes (If deploy spec is specified) + +The file to be used to configure deployment install and lifecycle events. For deploy spec field descriptions and information, see Deploy spec file reference. To view an action configuration with the deploy spec file specified, see the example in Action declaration with Deploy spec example. + @@ -126 +139,5 @@ The script to be run after the action Deploy phase. -The following image shows an example of the Edit page for the action. +The following image shows an example of the **Edit** page for the action where **Use action configurations** is chosen. + + + +The following image shows an example of the **Edit** page for the action where **Use a DeploySpec file** is chosen. @@ -128 +145 @@ The following image shows an example of the Edit page for the action. - + @@ -252,0 +270,51 @@ To view logs in the console using the action details dialog page, the permission +## Deploy spec file reference + +When CodePipeline runs the action, you can specify a spec file to configure deployment to your instances. The deploy spec file specifies what to install and which lifecycle event hooks to run in response to deployment lifecycle events. The deploy spec file is always YAML-formatted. The deploy spec file is used to: + + * Map the source files in your application revision to their destinations on the instance. + + * Specify custom permissions for deployed files. + + * Specify scripts to be run on each instance at various stages of the deployment process. + + + + +The deploy spec file supports specific deployment configuration parameters supported by CodeDeploy with the AppSpec file. You can use your existing AppSpec file directly, and any unsupported parameters will be ignored. For more information about the AppSpec file in CodeDeploy, see the Application Specification file reference in the _[CodeDeploy](https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file.html) User Guide_. + +The file deployment parameters are specified as follows. + + * `files` \- The deploy spec file designates the `source:` and `destination:` for the deployment files. + + * `scripts` \- The scripted events for the deployment. Two events are supported: `BeforeDeploy` and `AfterDeploy`. + + * `hooks` \- The lifecycle hooks for the event. The following hooks are supported: `ApplicationStop`, `BeforeInstall`, `AfterInstall`, `ApplicationStart`, and `ValidateService`. + +###### Note + +The hooks parameter is available for AppSpec compatibility with CodeDeploy and is only available in version 0.0 (AppSpec format). For this format, CodePipeline will perform a best effort mapping of the events. + + + + +Correct YAML spacing must be used in the spec file; otherwise, an error is raised if the locations and number of spaces in a deploy spec file are not correct. For more information about spacing, see the [YAML](http://www.yaml.org/) specification. + +An example deploy spec file is below. + + + version: 0.1 + files: + - source: /index.html + destination: /var/www/html/ + scripts: + BeforeDeploy: + - location: scripts/install_dependencies + timeout: 300 + runas: myuser + AfterDeploy: + - location: scripts/start_server + timeout: 300 + runas: myuser + +To view an action configuration with the deploy spec file specified, see the example in Action declaration with Deploy spec example. + @@ -312,0 +381,58 @@ JSON +## Action declaration with Deploy spec example + +YAML + + + + name: DeployEC2 + actions: + - name: EC2 + actionTypeId: + category: Deploy + owner: AWS + provider: EC2 + version: '1' + runOrder: 1 + configuration: + DeploySpec: "deployspec.yaml" + InstanceTagKey: Name + InstanceTagValue: my-instances + InstanceType: EC2 + outputArtifacts: [] + inputArtifacts: + - name: SourceArtifact + region: us-east-1 + +JSON + + + + { + "name": "DeployEC2", + "actions": [ + { + "name": "EC2Deploy", + "actionTypeId": { + "category": "Deploy", + "owner": "AWS", + "provider": "EC2", + "version": "1" + }, + "runOrder": 1, + "configuration": { + "DeploySpec": "deployspec.yaml", + "InstanceTagKey": "Name", + "InstanceTagValue": "my-instances", + "InstanceType": "EC2" + }, + "outputArtifacts": [], + "inputArtifacts": [ + { + "name": "SourceArtifact" + } + ], + "region": "us-east-1" + } + ] + }, +