AWS cli medium security documentation change
Summary
Updated command parameters ordering, added validation constraints for status codes in fixedResponse, modified regex patterns for resource identifiers, and restructured documentation format
Security assessment
The change restricts fixedResponse status codes to only 404 and 500 (previously allowed 100-599). This prevents potential misuse of arbitrary HTTP status codes which could be used for misleading responses. The explicit limitation to error codes improves security by enforcing valid error handling.
Diff
diff --git a/cli/latest/reference/vpc-lattice/create-listener.md b/cli/latest/reference/vpc-lattice/create-listener.md index c0f180065..bd41bb1ef 100644 --- a//cli/latest/reference/vpc-lattice/create-listener.md +++ b//cli/latest/reference/vpc-lattice/create-listener.md @@ -15 +15 @@ - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) » @@ -68,2 +68 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la - [--client-token <value>] - --default-action <value> + --service-identifier <value> @@ -71 +69,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la - [--port <value>] @@ -73 +71,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la - --service-identifier <value> + [--port <value>] + --default-action <value> + [--client-token <value>] @@ -99 +99 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -`--client-token` (string) +`--service-identifier` (string) [required] @@ -101 +101,37 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. If you retry a request that completed successfully using the same client token and parameters, the retry succeeds without performing any actions. If the parameters aren’t identical, the retry fails. +> The ID or ARN of the service. +> +> Constraints: +> +> * min: `17` +> * max: `2048` +> * pattern: `((svc-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}))` +> + + +`--name` (string) [required] + +> The name of the listener. A listener name must be unique within a service. The valid characters are a-z, 0-9, and hyphens (-). You can’t use a hyphen as the first or last character, or immediately after another hyphen. +> +> Constraints: +> +> * min: `3` +> * max: `63` +> * pattern: `(?!listener-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+` +> + + +`--protocol` (string) [required] + +> The listener protocol. +> +> Possible values: +> +> * `HTTP` +> * `HTTPS` +> * `TLS_PASSTHROUGH` +> + + +`--port` (integer) + +> The listener port. You can specify a value from 1 to 65535. For HTTP, the default is 80. For HTTPS, the default is 443. @@ -106,2 +142 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * max: `64` -> * pattern: `[!-~]+` +> * max: `65535` @@ -117,16 +152 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> This is a Tagged Union structure. Only one of the following top level keys can be set: `fixedResponse`, `forward`. -> -> fixedResponse -> (structure) -> ->> The fixed response action. The rule returns a custom HTTP response. ->> ->> statusCode -> (integer) [required] ->> ->>> The HTTP response code. ->>> ->>> Constraints: ->>> ->>> * min: `100` ->>> * max: `599` ->>> - +> This is a Tagged Union structure. Only one of the following top level keys can be set: `forward`, `fixedResponse`. @@ -163 +183 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la ->>>>> * pattern: `^((tg-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:targetgroup/tg-[0-9a-z]{17}))$` +>>>>> * pattern: `((tg-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:targetgroup/tg-[0-9a-z]{17}))` @@ -176,0 +197,15 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la +> +> fixedResponse -> (structure) +> +>> The fixed response action. The rule returns a custom HTTP response. +>> +>> statusCode -> (integer) [required] +>> +>>> The HTTP response code. Only `404` and `500` status codes are supported. +>>> +>>> Constraints: +>>> +>>> * min: `100` +>>> * max: `599` +>>> + @@ -182,3 +216,0 @@ JSON Syntax: - "fixedResponse": { - "statusCode": integer - }, @@ -192,0 +225,3 @@ JSON Syntax: + }, + "fixedResponse": { + "statusCode": integer @@ -197,13 +232 @@ JSON Syntax: -`--name` (string) [required] - -> The name of the listener. A listener name must be unique within a service. The valid characters are a-z, 0-9, and hyphens (-). You can’t use a hyphen as the first or last character, or immediately after another hyphen. -> -> Constraints: -> -> * min: `3` -> * max: `63` -> * pattern: `^(?!listener-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+$` -> - - -`--port` (integer) +`--client-token` (string) @@ -211 +234 @@ JSON Syntax: -> The listener port. You can specify a value from 1 to 65535. For HTTP, the default is 80. For HTTPS, the default is 443. +> A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. If you retry a request that completed successfully using the same client token and parameters, the retry succeeds without performing any actions. If the parameters aren’t identical, the retry fails. @@ -216,25 +239,2 @@ JSON Syntax: -> * max: `65535` -> - - -`--protocol` (string) [required] - -> The listener protocol. -> -> Possible values: -> -> * `HTTP` -> * `HTTPS` -> * `TLS_PASSTHROUGH` -> - - -`--service-identifier` (string) [required] - -> The ID or ARN of the service. -> -> Constraints: -> -> * min: `17` -> * max: `2048` -> * pattern: `^((svc-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}))$` +> * max: `64` +> * pattern: `.*[!-~]+.*` @@ -462,26 +462 @@ arn -> (string) -> * pattern: `^arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}/listener/listener-[0-9a-z]{17}$` -> - - -defaultAction -> (tagged union structure) - -> The action for the default rule. -> -> ### Note -> -> This is a Tagged Union structure. Only one of the following top level keys can be set: `fixedResponse`, `forward`. -> -> fixedResponse -> (structure) -> ->> The fixed response action. The rule returns a custom HTTP response. ->> ->> statusCode -> (integer) [required] ->> ->>> The HTTP response code. ->>> ->>> Constraints: ->>> ->>> * min: `100` ->>> * max: `599` ->>> - +> * pattern: `arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}/listener/listener-[0-9a-z]{17}` @@ -489,42 +463,0 @@ defaultAction -> (tagged union structure) -> forward -> (structure) -> ->> The forward action. Traffic that matches the rule is forwarded to the specified target groups. ->> ->> targetGroups -> (list) [required] ->> ->>> The target groups. Traffic matching the rule is forwarded to the specified target groups. With forward actions, you can assign a weight that controls the prioritization and selection of each target group. This means that requests are distributed to individual target groups based on their weights. For example, if two target groups have the same weight, each target group receives half of the traffic. ->>> ->>> The default value is 1. This means that if only one target group is provided, there is no need to set the weight; 100% of the traffic goes to that target group. ->>> ->>> Constraints: ->>> ->>> * min: `1` ->>> * max: `10` ->>> -