AWS powershell high security documentation change
Summary
Updated migration guide for AWS Tools for PowerShell V5 with new sections on nullable types, logging of sensitive information, deprecated S3 cmdlets, interactive session capabilities, and removed programming elements. Added references to security considerations for logging changes.
Security assessment
The change introduces a new section 'Logging of sensitive information' explicitly stating that logging behavior was modified to reduce exposure of sensitive data in cmdlet output, particularly in CI/CD scenarios. This directly addresses a security concern by preventing accidental leakage of credentials or other sensitive information in logs.
Diff
diff --git a/powershell/v5/userguide/migrating-v5.md b/powershell/v5/userguide/migrating-v5.md index 2ebca675c..e7b831939 100644 --- a//powershell/v5/userguide/migrating-v5.md +++ b//powershell/v5/userguide/migrating-v5.md @@ -5 +5 @@ -Minimum PowerShell versionValue typesCollectionsPipelining and $AWSHistoryCredential and profile resolutionConsistent Auto-IterationCleaning S3 key parameters +Minimum PowerShell versionNullable value typesCollectionsPipelining and $AWSHistoryThe -PassThru parameterSome DynamoDB cmdlets moved and renamedLogging of sensitive informationCredential and profile resolutionConsistent Auto-IterationS3 cmdlets deprecated and replacedCleaning and trimming S3 key parametersInteractive session capabilitiesCloudWatch alarmsLitJsonProgramming elements that were removed @@ -11 +11,3 @@ The AWS Tools for PowerShell version 5 (V5) is in preview, therefore this conten -AWS Tools for PowerShell version 5 (V5) has breaking changes, which could cause your existing scripts to stop working. This topic describes the breaking changes in V5 and possible work that you might need to do to migrate your environment or code from V4. For additional information about other noteworthy changes in the AWS Tools for PowerShell, and how to install and test the new version, see the following development-tracker issue on GitHub: [https://github.com/aws/aws-tools-for-powershell/issues/357](https://github.com/aws/aws-tools-for-powershell/issues/357). +AWS Tools for PowerShell version 5 (V5) has breaking changes, which could cause your existing scripts to stop working. This topic describes the breaking changes in V5 and possible work that you might need to do to migrate your environment or code from V4. + +For additional information about noteworthy changes in the AWS Tools for PowerShell, and how to install and test the new version, see the blog post [Preview 1 of AWS Tools for PowerShell V5](https://aws.amazon.com/blogs/developer/preview-1-of-aws-tools-for-powershell-v5/) and the [V5 Development Tracker issue in GitHub](https://github.com/aws/aws-tools-for-powershell/issues/357). In the V5 Development Tracker issue, in addition to the list of breaking changes, be sure to look at the details of each preview. @@ -23 +25 @@ For more information about the AWSPowerShell module, see [Installing on Windows] -## Value types +## Nullable value types @@ -25 +27 @@ For more information about the AWSPowerShell module, see [Installing on Windows] -The types adopted from the AWS SDK for .NET have been updated to use that SDK's new nullable changes. For example, properties of type `int` have been changed to `Nullable[int]`. For additional information, see the migration content for [Value types](https://docs.aws.amazon.com/sdk-for-net/v4/developer-guide/net-dg-v4.html#net-dg-v4-value-types) in the [AWS SDK for .NET Developer Guide](https://docs.aws.amazon.com/sdk-for-net/v4/developer-guide/). +The types adopted from the AWS SDK for .NET have been updated to use that SDK's new nullable changes. For example, properties of type `int` have been changed to `Nullable[int]`. For additional information including examples, see the blog post [Preview 1 of AWS Tools for PowerShell V5](https://aws.amazon.com/blogs/developer/preview-1-of-aws-tools-for-powershell-v5/) and the migration content for [Value types](https://docs.aws.amazon.com/sdk-for-net/v4/developer-guide/net-dg-v4.html#net-dg-v4-value-types) in the [AWS SDK for .NET Developer Guide](https://docs.aws.amazon.com/sdk-for-net/v4/developer-guide/). @@ -29 +31 @@ The types adopted from the AWS SDK for .NET have been updated to use that SDK's -Some cmdlet output has been changed to return `$null` instead of empty collections. For additional information, including how to revert to legacy behavior, see the migration content for [Collections](https://docs.aws.amazon.com/sdk-for-net/v4/developer-guide/net-dg-v4.html#net-dg-v4-collections) in the [AWS SDK for .NET Developer Guide](https://docs.aws.amazon.com/sdk-for-net/v4/developer-guide/). +Some cmdlet output has been changed to return `$null` instead of empty collections of type `List` or `Dictionary`. For additional information, including how to revert to legacy behavior, see the migration content for [Collections](https://docs.aws.amazon.com/sdk-for-net/v4/developer-guide/net-dg-v4.html#net-dg-v4-collections) in the [AWS SDK for .NET Developer Guide](https://docs.aws.amazon.com/sdk-for-net/v4/developer-guide/). @@ -33 +35,13 @@ Some cmdlet output has been changed to return `$null` instead of empty collectio -In versions of the AWS Tools for PowerShell prior to V4, a session variable called `$AWSHistory` was introduced that maintains a record of AWS cmdlet invocations and the service responses that were received for each invocation. In V4 of the Tools for PowerShell, this session variable was deprecated in favor of the `-Select *` parameter and argument, which can be used to return the entire service response. This parameter is described in [Pipelining, output, and iteration](./pstools-pipelines.html). +In versions of the AWS Tools for PowerShell prior to V4, a session variable called `$AWSHistory` was introduced that maintains a record of AWS cmdlet invocations and the service responses that were received for each invocation. + +In V4 of the Tools for PowerShell, this session variable was deprecated in favor of the `-Select *` parameter and argument, which can be used to return the entire service response. The `-Select *` parameter is described in [Pipelining, output, and iteration](./pstools-pipelines.html). + +In V5 of the Tools for PowerShell, the `$AWSHistory` session variable has been removed completely. + +## The `-PassThru` parameter + +The `-PassThru` parameter has been removed. When a cmdlet doesn't return any output by default, users can request a returned parameter value by using `-Select ^ParameterName`. For additional details and examples, see the blog post [Preview 1 of AWS Tools for PowerShell V5](https://aws.amazon.com/blogs/developer/preview-1-of-aws-tools-for-powershell-v5/). + +## Some DynamoDB cmdlets moved and renamed + +The `Get-DDBStream` and `Get-DDBStreamList` cmdlets have been moved from the DynamoDBV2 module to a new module called DynamoDBStreams. They have also been renamed to [Get-DDBSStream](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-DDBSStream.html) and [Get-DDBSStreamList](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-DDBSStreamList.html), respectively. @@ -35 +49,3 @@ In versions of the AWS Tools for PowerShell prior to V4, a session variable call -In V5 of the AWS Tools for PowerShell, the `$AWSHistory` variable has been removed. For more information, see the blog post [Notice of upcoming major version 5 of AWS Tools for PowerShell](https://aws.amazon.com/blogs/developer/notice-of-upcoming-major-version-5-of-aws-tools-for-powershell/). +## Logging of sensitive information + +Logging behavior has been changed so that potentially sensitive information is less likely to be included in cmdlet output, especially in CI/CD situations. For more information and instructions about how to revert to V4 behavior, see [Logging of sensitive information](./additional-security-considerations.html#add-sec-cons-sensitive-logs). @@ -43 +59,5 @@ The AWS Tools for PowerShell have been updated to use certain environment variab -All paginated cmdlets have been updated to auto-iterate all data by default. You can revert this behavior by using the [Set-AWSAutoIterationMode](https://docs.aws.amazon.com/powershell/latest/reference/items/Set-AWSAutoIterationMode.html) cmdlet. If you run `Set-AWSAutoIterationMode -IterationMode v4`, operations that auto-iterated in v4 will still auto-iterate, but the rest will revert to manual iteration. +All paginated cmdlets have been updated to auto-iterate all data by default. You can revert this behavior by using the [Set-AWSAutoIterationMode](https://docs.aws.amazon.com/powershell/latest/reference/items/Set-AWSAutoIterationMode.html) cmdlet. If you run `Set-AWSAutoIterationMode -IterationMode v4`, operations that auto-iterated in v4 will still auto-iterate, but the rest will revert to manual iteration. To determine what mode auto-iteration is set to, use the [Get-AWSAutoIterationMode](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-AWSAutoIterationMode.html) cmdlet. + +## S3 cmdlets deprecated and replaced + +For Amazon S3, the [Get-S3ACL](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-S3ACL.html) and [Set-S3ACL](https://docs.aws.amazon.com/powershell/latest/reference/items/Set-S3ACL.html) cmdlets have been deprecated. Use the following new cmdlets instead: [Get-S3BucketACL](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-S3BucketACL.html), [Set-S3BucketACL](https://docs.aws.amazon.com/powershell/latest/reference/items/Set-S3BucketACL.html), [Get-S3ObjectACL](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-S3ObjectACL.html), [Set-S3ObjectACL](https://docs.aws.amazon.com/powershell/latest/reference/items/Set-S3ObjectACL.html). @@ -45 +65 @@ All paginated cmdlets have been updated to auto-iterate all data by default. You -## Cleaning S3 key parameters +## Cleaning and trimming S3 key parameters @@ -47 +67 @@ All paginated cmdlets have been updated to auto-iterate all data by default. You -In certain Amazon S3 cmdlets that accept key parameters, `Key` and `KeyPrefix`, version 4 of the tools would clean these parameters in the following ways: remove leading spaces, forward slashes ("/"), and backslashes ("\"), convert all other backslashes to forward slashes, and remove trailing spaces. You can revert to this behavior by specifying the `-EnableLegacyKeyCleaning` parameter. +Certain Amazon S3 cmdlets accept parameters named `Key` and `KeyPrefix`. V4 of the AWS Tools for PowerShell would clean and trim these parameters in the following ways: remove leading spaces, forward slashes ("/"), and backslashes ("\"), convert all other backslashes to forward slashes, and remove trailing spaces. In V5 of the Tools for PowerShell, this is no longer the default behavior. You can revert to this behavior by specifying the `-EnableLegacyKeyCleaning` parameter. @@ -67,0 +88,28 @@ This information applies to the following cmdlets: +## Interactive session capabilities + +Interactive session capabilities have been added to the [Start-SSMSession](https://docs.aws.amazon.com/powershell/latest/reference/items/Start-SSMSession.html) cmdlet, which aligns with the AWS CLI behavior. If you need legacy behavior, include the `-DisablePluginInvocation` parameter in the `Start-SSMSession` command. For example: + + + Start-SSMSession -Target 'i-1234567890abcdef0' -DisablePluginInvocation + +## CloudWatch alarms + +The [Get-CWAlarm](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-CWAlarm.html) cmdlet has been updated to return both metric and composite Amazon CloudWatch alarms by default. To limit the output to either metric or composite alarms, you must specify the `-AlarmType` parameter: `Get-CWAlarm -AlarmType 'MetricAlarms'` or `Get-CWAlarm -AlarmType 'CompositeAlarms'`, respectively. + +## `LitJson` + +The AWS Tools for PowerShell have been updated to use `System.Text.Json` instead of `LitJson` for serialization. `LitJson` has been removed from V5 of the tools. + +## Programming elements that were removed + +The following programming elements have been removed from V5 of the Tools for PowerShell: + + * The `Invoke-LMFunctionAsync` cmdlet. + + * The `Get-EC2ImageByName` cmdlet. + + * The `CalculateContentMD5Header` parameter from the [Write-S3Object](https://docs.aws.amazon.com/powershell/latest/reference/items/Write-S3Object.html) cmdlet. + + + +