AWS AmazonCloudWatch high security documentation change
Summary
Updated region placeholder in package signature URLs from generic 'region' to 'us-east-1' and added clarification about replacing default region
Security assessment
The change ensures proper package signature verification by specifying correct regional endpoints. Incorrect signature verification could allow tampered packages to be installed, making this a security-critical documentation update.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/verify-CloudWatch-Agent-Package-Signature.md b/AmazonCloudWatch/latest/monitoring/verify-CloudWatch-Agent-Package-Signature.md index abe176dbf..65495ccaa 100644 --- a//AmazonCloudWatch/latest/monitoring/verify-CloudWatch-Agent-Package-Signature.md +++ b//AmazonCloudWatch/latest/monitoring/verify-CloudWatch-Agent-Package-Signature.md @@ -11 +11,3 @@ For Windows Server, you can use the MSI to verify the signature. For macOS compu -To find the correct signature file, use the following table. For each architecture and operating system, you can see a general link and links for each Region. For example, for Amazon Linux 2023 and Amazon Linux 2 and the x86-64 architecture, three of the valid links are: +To find the correct signature file, use the following table. For each architecture and operating system, you can see a general link and links for each Region. + +If you use the Region-specific links, replace the default Region (`us-east-1`) with the appropriate Region for your account. For example, for Amazon Linux 2023 and Amazon Linux 2 and the x86-64 architecture, three of the valid links are: @@ -28,14 +30,14 @@ Architecture | Platform | Download link | Signature file link -x86-64 | Amazon Linux 2023 and Amazon Linux 2 | https://amazoncloudwatch-agent.s3.amazonaws.com/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm.sig -x86-64 | Centos | https://amazoncloudwatch-agent.s3.amazonaws.com/centos/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/centos/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/centos/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/centos/amd64/latest/amazon-cloudwatch-agent.rpm.sig -x86-64 | Redhat | https://amazoncloudwatch-agent.s3.amazonaws.com/redhat/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/redhat/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/redhat/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/redhat/amd64/latest/amazon-cloudwatch-agent.rpm.sig -x86-64 | SUSE | https://amazoncloudwatch-agent.s3.amazonaws.com/suse/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/suse/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/suse/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/suse/amd64/latest/amazon-cloudwatch-agent.rpm.sig -x86-64 | Debian | https://amazoncloudwatch-agent.s3.amazonaws.com/debian/amd64/latest/amazon-cloudwatch-agent.deb https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/debian/amd64/latest/amazon-cloudwatch-agent.deb | https://amazoncloudwatch-agent.s3.amazonaws.com/debian/amd64/latest/amazon-cloudwatch-agent.deb.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/debian/amd64/latest/amazon-cloudwatch-agent.deb.sig -x86-64 | Ubuntu | https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb | https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb.sig -x86-64 | Oracle | https://amazoncloudwatch-agent.s3.amazonaws.com/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm.sig -x86-64 | macOS | https://amazoncloudwatch-agent.s3.amazonaws.com/darwin/amd64/latest/amazon-cloudwatch-agent.pkg https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/darwin/amd64/latest/amazon-cloudwatch-agent.pkg | https://amazoncloudwatch-agent.s3.amazonaws.com/darwin/amd64/latest/amazon-cloudwatch-agent.pkg.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/darwin/amd64/latest/amazon-cloudwatch-agent.pkg.sig -x86-64 | Windows | https://amazoncloudwatch-agent.s3.amazonaws.com/windows/amd64/latest/amazon-cloudwatch-agent.msi https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/windows/amd64/latest/amazon-cloudwatch-agent.msi | https://amazoncloudwatch-agent.s3.amazonaws.com/windows/amd64/latest/amazon-cloudwatch-agent.msi.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/windows/amd64/latest/amazon-cloudwatch-agent.msi.sig -ARM64 | Amazon Linux 2023 and Amazon Linux 2 | https://amazoncloudwatch-agent.s3.amazonaws.com/amazon_linux/arm64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/amazon_linux/arm64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/amazon_linux/arm64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/amazon_linux/arm64/latest/amazon-cloudwatch-agent.rpm.sig -ARM64 | Redhat | https://amazoncloudwatch-agent.s3.amazonaws.com/redhat/arm64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/redhat/arm64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/redhat/arm64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/redhat/arm64/latest/amazon-cloudwatch-agent.rpm.sig -ARM64 | Ubuntu | https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb | https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb.sig -ARM64 | Debian | https://amazoncloudwatch-agent.s3.amazonaws.com/debian/arm64/latest/amazon-cloudwatch-agent.deb https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/debian/arm64/latest/amazon-cloudwatch-agent.deb | https://amazoncloudwatch-agent.s3.amazonaws.com/debian/arm64/latest/amazon-cloudwatch-agent.deb.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/debian/arm64/latest/amazon-cloudwatch-agent.deb.sig -ARM64 | SUSE | https://amazoncloudwatch-agent.s3.amazonaws.com/suse/arm64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/suse/arm64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/suse/arm64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`region`.s3.`region`.amazonaws.com/suse/arm64/latest/amazon-cloudwatch-agent.rpm.sig +x86-64 | Amazon Linux 2023 and Amazon Linux 2 | https://amazoncloudwatch-agent.s3.amazonaws.com/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm.sig +x86-64 | Centos | https://amazoncloudwatch-agent.s3.amazonaws.com/centos/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/centos/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/centos/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/centos/amd64/latest/amazon-cloudwatch-agent.rpm.sig +x86-64 | Redhat | https://amazoncloudwatch-agent.s3.amazonaws.com/redhat/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/redhat/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/redhat/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/redhat/amd64/latest/amazon-cloudwatch-agent.rpm.sig +x86-64 | SUSE | https://amazoncloudwatch-agent.s3.amazonaws.com/suse/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/suse/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/suse/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/suse/amd64/latest/amazon-cloudwatch-agent.rpm.sig +x86-64 | Debian | https://amazoncloudwatch-agent.s3.amazonaws.com/debian/amd64/latest/amazon-cloudwatch-agent.deb https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/debian/amd64/latest/amazon-cloudwatch-agent.deb | https://amazoncloudwatch-agent.s3.amazonaws.com/debian/amd64/latest/amazon-cloudwatch-agent.deb.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/debian/amd64/latest/amazon-cloudwatch-agent.deb.sig +x86-64 | Ubuntu | https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb | https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb.sig +x86-64 | Oracle | https://amazoncloudwatch-agent.s3.amazonaws.com/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/oracle_linux/amd64/latest/amazon-cloudwatch-agent.rpm.sig +x86-64 | macOS | https://amazoncloudwatch-agent.s3.amazonaws.com/darwin/amd64/latest/amazon-cloudwatch-agent.pkg https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/darwin/amd64/latest/amazon-cloudwatch-agent.pkg | https://amazoncloudwatch-agent.s3.amazonaws.com/darwin/amd64/latest/amazon-cloudwatch-agent.pkg.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/darwin/amd64/latest/amazon-cloudwatch-agent.pkg.sig +x86-64 | Windows | https://amazoncloudwatch-agent.s3.amazonaws.com/windows/amd64/latest/amazon-cloudwatch-agent.msi https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/windows/amd64/latest/amazon-cloudwatch-agent.msi | https://amazoncloudwatch-agent.s3.amazonaws.com/windows/amd64/latest/amazon-cloudwatch-agent.msi.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/windows/amd64/latest/amazon-cloudwatch-agent.msi.sig +ARM64 | Amazon Linux 2023 and Amazon Linux 2 | https://amazoncloudwatch-agent.s3.amazonaws.com/amazon_linux/arm64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/amazon_linux/arm64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/amazon_linux/arm64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/amazon_linux/arm64/latest/amazon-cloudwatch-agent.rpm.sig +ARM64 | Redhat | https://amazoncloudwatch-agent.s3.amazonaws.com/redhat/arm64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/redhat/arm64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/redhat/arm64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/redhat/arm64/latest/amazon-cloudwatch-agent.rpm.sig +ARM64 | Ubuntu | https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb | https://amazoncloudwatch-agent.s3.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/ubuntu/arm64/latest/amazon-cloudwatch-agent.deb.sig +ARM64 | Debian | https://amazoncloudwatch-agent.s3.amazonaws.com/debian/arm64/latest/amazon-cloudwatch-agent.deb https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/debian/arm64/latest/amazon-cloudwatch-agent.deb | https://amazoncloudwatch-agent.s3.amazonaws.com/debian/arm64/latest/amazon-cloudwatch-agent.deb.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/debian/arm64/latest/amazon-cloudwatch-agent.deb.sig +ARM64 | SUSE | https://amazoncloudwatch-agent.s3.amazonaws.com/suse/arm64/latest/amazon-cloudwatch-agent.rpm https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/suse/arm64/latest/amazon-cloudwatch-agent.rpm | https://amazoncloudwatch-agent.s3.amazonaws.com/suse/arm64/latest/amazon-cloudwatch-agent.rpm.sig https://amazoncloudwatch-agent-`us-east-1`.s3.`us-east-1`.amazonaws.com/suse/arm64/latest/amazon-cloudwatch-agent.rpm.sig