AWS cli documentation change
Summary
Enhanced KMS key documentation, clarified SSM Agent removal behavior, added amiTags constraints, and introduced logging configuration details
Security assessment
Adds security documentation about encryption key management (KMS ARNs), tag key constraints to prevent reserved AWS tags, and logging configuration patterns for audit purposes. The logging constraints (`^[a-zA-Z0-9\-_/\.]{1,512}$`) help prevent log group naming abuses but don't fix an existing vulnerability.
Diff
diff --git a/cli/latest/reference/imagebuilder/get-image.md b/cli/latest/reference/imagebuilder/get-image.md index 20560eb55..7b0f15415 100644 --- a//cli/latest/reference/imagebuilder/get-image.md +++ b//cli/latest/reference/imagebuilder/get-image.md @@ -15 +15 @@ - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) » @@ -632 +632 @@ image -> (structure) ->>>>>> Use to configure the KMS key to use when encrypting the device. +>>>>>> The Amazon Resource Name (ARN) that uniquely identifies the KMS key to use when encrypting the device. This can be either the Key ARN or the Alias ARN. For more information, see [Key identifiers (KeyId)](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN) in the _Key Management Service Developer Guide_ . @@ -766 +766,3 @@ image -> (structure) ->>>>> Controls whether the Systems Manager agent is removed from your final build image, prior to creating the new AMI. If this is set to true, then the agent is removed from the final image. If it’s set to false, then the agent is left in, so that it is included in the new AMI. The default value is false. +>>>>> Controls whether the Systems Manager agent is removed from your final build image, prior to creating the new AMI. If this is set to true, then the agent is removed from the final image. If it’s set to false, then the agent is left in, so that it is included in the new AMI. default value is false. +>>>>> +>>>>> The default behavior of uninstallAfterBuild is to remove the SSM Agent if it was installed by EC2 Image Builder @@ -790,0 +793,29 @@ image -> (structure) +>> +>> amiTags -> (map) +>> +>>> Tags that are applied to the AMI that Image Builder creates during the Build phase prior to image distribution. +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `50` +>>> + +>>> +>>> key -> (string) +>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `128` +>>>> * pattern: `^(?!aws:)[a-zA-Z+-=._:/]+$` +>>>> + +>>> +>>> value -> (string) +>>> +>>>> Constraints: +>>>> +>>>> * max: `256` +>>>> + @@ -1014 +1045 @@ image -> (structure) ->>>>>>> Use to configure the KMS key to use when encrypting the device. +>>>>>>> The Amazon Resource Name (ARN) that uniquely identifies the KMS key to use when encrypting the device. This can be either the Key ARN or the Alias ARN. For more information, see [Key identifiers (KeyId)](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN) in the _Key Management Service Developer Guide_ . @@ -1100 +1131 @@ image -> (structure) ->>> Identifies which KMS key is used to encrypt the container image for distribution to the target Region. +>>> The Amazon Resource Name (ARN) that uniquely identifies which KMS key is used to encrypt the container image for distribution to the target Region. This can be either the Key ARN or the Alias ARN. For more information, see [Key identifiers (KeyId)](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN) in the _Key Management Service Developer Guide_ . @@ -1624 +1655 @@ image -> (structure) ->>>>>> The KMS key identifier used to encrypt the distributed image. +>>>>>> The Amazon Resource Name (ARN) that uniquely identifies the KMS key used to encrypt the distributed image. This can be either the Key ARN or the Alias ARN. For more information, see [Key identifiers (KeyId)](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#key-id-key-ARN) in the _Key Management Service Developer Guide_ . @@ -2447,0 +2479,16 @@ image -> (structure) +> +> loggingConfiguration -> (structure) +> +>> The logging configuration that’s defined for the image. Image Builder uses the defined settings to direct execution log output during image creation. +>> +>> logGroupName -> (string) +>> +>>> The log group name that Image Builder uses for image creation. If not specified, the log group name defaults to `/aws/imagebuilder/image-name` . +>>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `512` +>>> * pattern: `^[a-zA-Z0-9\-_/\.]{1,512}$` +>>> + @@ -2459 +2506 @@ image -> (structure) - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) »