AWS code-library medium security documentation change
Summary
Added a new 'Scenarios' section with detailed S3 bucket management script demonstrating security configurations, versioning, encryption, and cleanup procedures
Security assessment
The change adds explicit security configurations including public access blocking, versioning, and default encryption. The script now includes security best practices for bucket creation and data protection. Specific security-related code includes 'put-public-access-block' configuration and encryption settings. The cleanup improvements for versioned object deletion also help prevent accidental data exposure.
Diff
diff --git a/code-library/latest/ug/bash_2_s3_code_examples.md b/code-library/latest/ug/bash_2_s3_code_examples.md index 462f2dabd..8b4d1b503 100644 --- a//code-library/latest/ug/bash_2_s3_code_examples.md +++ b//code-library/latest/ug/bash_2_s3_code_examples.md @@ -5 +5 @@ -BasicsActions +BasicsActionsScenarios @@ -16,0 +17,2 @@ _Actions_ are code excerpts from larger programs and must be run in context. Whi +_Scenarios_ are code examples that show you how to accomplish specific tasks by calling multiple functions within a service or combined with other AWS services. + @@ -24,0 +27,2 @@ Each example includes a link to the complete source code, where you can find ins + * Scenarios + @@ -1039,0 +1044,323 @@ There's more on GitHub. Find the complete example and learn how to set up and ru +## Scenarios + +The following code example shows how to: + + * Create an S3 bucket with unique naming and regional configuration + + * Configure bucket security settings including public access blocking + + * Enable versioning and default encryption for data protection + + * Upload objects with and without custom metadata + + * Download objects from the bucket to local storage + + * Copy objects within the bucket to organize data in folders + + * List bucket contents and objects with specific prefixes + + * Add tags to buckets for resource management + + * Clean up all resources including versioned objects + + + + +**AWS CLI with Bash script** + + +###### Note + +There's more on GitHub. Find the complete example and learn how to set up and run in the [Sample developer tutorials](https://github.com/aws-samples/sample-developer-tutorials/tree/main/tuts/003-s3-gettingstarted) repository. + + + #!/bin/bash + + # Amazon S3 Getting Started Tutorial Script + # This script demonstrates basic S3 operations including: + # - Creating a bucket + # - Configuring bucket settings + # - Uploading, downloading, and copying objects + # - Deleting objects and buckets + + # Latest fixes: + # 1. Fixed folder creation using temporary file + # 2. Corrected versioned object deletion in cleanup + # 3. Improved error handling for cleanup operations + + # Set up error handling + set -e + trap 'cleanup_handler $?' EXIT + + # Log file setup + LOG_FILE="s3-tutorial-$(date +%Y%m%d-%H%M%S).log" + exec > >(tee -a "$LOG_FILE") 2>&1 + + # Function to log messages + log() { + echo "[$(date +"%Y-%m-%d %H:%M:%S")] $1" + } + + # Function to handle errors + handle_error() { + log "ERROR: $1" + exit 1 + } + + # Function to check if a bucket exists + bucket_exists() { + if aws s3api head-bucket --bucket "$1" 2>/dev/null; then + return 0 + else + return 1 + fi + } + + # Function to delete all versions of objects in a bucket + delete_all_versions() { + local bucket=$1 + log "Deleting all object versions from bucket $bucket..." + + # Get and delete all versions + versions=$(aws s3api list-object-versions --bucket "$bucket" --query 'Versions[].{Key:Key,VersionId:VersionId}' --output json 2>/dev/null) + if [ -n "$versions" ] && [ "$versions" != "null" ]; then + echo "{\"Objects\": $versions}" | aws s3api delete-objects --bucket "$bucket" --delete file:///dev/stdin >/dev/null 2>&1 || log "Warning: Some versions could not be deleted" + fi + + # Get and delete all delete markers + markers=$(aws s3api list-object-versions --bucket "$bucket" --query 'DeleteMarkers[].{Key:Key,VersionId:VersionId}' --output json 2>/dev/null) + if [ -n "$markers" ] && [ "$markers" != "null" ]; then + echo "{\"Objects\": $markers}" | aws s3api delete-objects --bucket "$bucket" --delete file:///dev/stdin >/dev/null 2>&1 || log "Warning: Some delete markers could not be deleted" + fi + } + + # Function to handle cleanup on exit + cleanup_handler() { + local exit_code=$1 + + # Only run cleanup if it hasn't been run already + if [ -z "$CLEANUP_DONE" ]; then + cleanup + fi + + exit $exit_code + } + + # Function to clean up resources + cleanup() { + log "Starting cleanup process..." + CLEANUP_DONE=1 + + # List all resources created for confirmation + log "Resources created:" + if [ -n "$BUCKET_NAME" ]; then + log "- S3 Bucket: $BUCKET_NAME" + + # Only try to list objects if the bucket exists + if bucket_exists "$BUCKET_NAME"; then + # Check if any objects were created + OBJECTS=$(aws s3api list-objects-v2 --bucket "$BUCKET_NAME" --query 'Contents[].Key' --output text 2>/dev/null || echo "") + if [ -n "$OBJECTS" ]; then + log "- Objects in bucket:" + echo "$OBJECTS" | tr '\t' '\n' | while read -r obj; do + log " - $obj" + done + fi + + # Ask for confirmation before cleanup + read -p "Do you want to proceed with cleanup and delete all resources? (y/n): " confirm + if [[ $confirm != [yY] && $confirm != [yY][eE][sS] ]]; then + log "Cleanup aborted by user." + return + fi + + # Delete all versions of objects + delete_all_versions "$BUCKET_NAME" + + # Delete the bucket + log "Deleting bucket $BUCKET_NAME..." + aws s3api delete-bucket --bucket "$BUCKET_NAME" || log "Warning: Failed to delete bucket" + else + log "Bucket $BUCKET_NAME does not exist, skipping cleanup" + fi + fi + + # Clean up local files + log "Removing local files..." + rm -f sample-file.txt sample-document.txt downloaded-sample-file.txt empty-file.tmp + + log "Cleanup completed." + } + + # Generate a random bucket name + generate_bucket_name() { + local hex_id + hex_id=$(openssl rand -hex 6) + echo "demo-s3-bucket-$hex_id" + } + + # Main script execution + main() { + log "Starting Amazon S3 Getting Started Tutorial" + + # Generate a unique bucket name + BUCKET_NAME=$(generate_bucket_name) + log "Generated bucket name: $BUCKET_NAME" + + # Step 1: Create a bucket + log "Step 1: Creating S3 bucket..." + + # Get the current region or default to us-east-1 + REGION=$(aws configure get region) + REGION=${REGION:-us-east-1} + log "Using region: $REGION" + + if [ "$REGION" = "us-east-1" ]; then + aws s3api create-bucket --bucket "$BUCKET_NAME" || handle_error "Failed to create bucket" + else + aws s3api create-bucket \ + --bucket "$BUCKET_NAME" \ + --region "$REGION" \ + --create-bucket-configuration LocationConstraint="$REGION" || handle_error "Failed to create bucket" + fi + log "Bucket created successfully" + + # Configure bucket settings + log "Configuring bucket settings..."