AWS cli documentation change
Summary
Updated KMS key documentation to clarify ARN usage, added details about SSM Agent removal default behavior, and introduced amiTags constraints with security patterns
Security assessment
The change adds security-relevant documentation about KMS key identifiers (including ARN formats) and enforces a tag key pattern (`^(?!aws:)[a-zA-Z+-=._:/]+$`) to prevent reserved AWS tags. While these improve security practices, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/cli/latest/reference/imagebuilder/get-image-recipe.md b/cli/latest/reference/imagebuilder/get-image-recipe.md index ad5037d8b..41eefe498 100644 --- a//cli/latest/reference/imagebuilder/get-image-recipe.md +++ b//cli/latest/reference/imagebuilder/get-image-recipe.md @@ -15 +15 @@ - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) » @@ -416 +416 @@ imageRecipe -> (structure) ->>>>> Use to configure the KMS key to use when encrypting the device. +>>>>> The Amazon Resource Name (ARN) that uniquely identifies the KMS key to use when encrypting the device. This can be either the Key ARN or the Alias ARN. For more information, see [Key identifiers (KeyId)](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN) in the _Key Management Service Developer Guide_ . @@ -550 +550,3 @@ imageRecipe -> (structure) ->>>> Controls whether the Systems Manager agent is removed from your final build image, prior to creating the new AMI. If this is set to true, then the agent is removed from the final image. If it’s set to false, then the agent is left in, so that it is included in the new AMI. The default value is false. +>>>> Controls whether the Systems Manager agent is removed from your final build image, prior to creating the new AMI. If this is set to true, then the agent is removed from the final image. If it’s set to false, then the agent is left in, so that it is included in the new AMI. default value is false. +>>>> +>>>> The default behavior of uninstallAfterBuild is to remove the SSM Agent if it was installed by EC2 Image Builder @@ -574,0 +577,29 @@ imageRecipe -> (structure) +> +> amiTags -> (map) +> +>> Tags that are applied to the AMI that Image Builder creates during the Build phase prior to image distribution. +>> +>> Constraints: +>> +>> * min: `1` +>> * max: `50` +>> + +>> +>> key -> (string) +>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `128` +>>> * pattern: `^(?!aws:)[a-zA-Z+-=._:/]+$` +>>> + +>> +>> value -> (string) +>> +>>> Constraints: +>>> +>>> * max: `256` +>>> + @@ -586 +617 @@ imageRecipe -> (structure) - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) »