AWS cli medium security documentation change
Summary
Updated AWS CLI version from 2.31.3 to 2.31.5, restructured parameters (swapped --listener-identifier and --service-identifier positions), modified regex patterns for service/listener/rule identifiers, reorganized action/match structures, added explicit status code constraints for fixedResponse, and added case sensitivity controls for path matching.
Security assessment
The change adds explicit validation constraints for HTTP status codes in fixedResponse (only 404/500 allowed) and introduces case sensitivity controls for path matching. These changes help prevent misconfigurations that could lead to unintended behavior or bypassing of security controls. The regex pattern modifications (removing ^/$ anchors) might weaken input validation, but the added case sensitivity and status code restrictions directly address potential security configuration issues.
Diff
diff --git a/cli/latest/reference/vpc-lattice/get-rule.md b/cli/latest/reference/vpc-lattice/get-rule.md index f476065c3..309bab4be 100644 --- a//cli/latest/reference/vpc-lattice/get-rule.md +++ b//cli/latest/reference/vpc-lattice/get-rule.md @@ -15 +15 @@ - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) » @@ -66,0 +67 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la + --service-identifier <value> @@ -69 +69,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la - --service-identifier <value> @@ -94 +94 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -`--listener-identifier` (string) [required] +`--service-identifier` (string) [required] @@ -96 +96 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> The ID or ARN of the listener. +> The ID or ARN of the service. @@ -100 +100 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * min: `20` +> * min: `17` @@ -102 +102 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * pattern: `^((listener-[0-9a-z]{17})|(^arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}/listener/listener-[0-9a-z]{17}$))$` +> * pattern: `((svc-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}))` @@ -106 +106 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -`--rule-identifier` (string) [required] +`--listener-identifier` (string) [required] @@ -108 +108 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> The ID or ARN of the listener rule. +> The ID or ARN of the listener. @@ -114 +114 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * pattern: `^((rule-[0-9a-z]{17})|(^arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}/listener/listener-[0-9a-z]{17}/rule/rule-[0-9a-z]{17}$))$` +> * pattern: `((listener-[0-9a-z]{17})|(^arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}/listener/listener-[0-9a-z]{17}$))` @@ -118 +118 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -`--service-identifier` (string) [required] +`--rule-identifier` (string) [required] @@ -120 +120 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> The ID or ARN of the service. +> The ID or ARN of the listener rule. @@ -124 +124 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * min: `17` +> * min: `20` @@ -126 +126 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * pattern: `^((svc-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}))$` +> * pattern: `((rule-[0-9a-z]{17})|(^arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}/listener/listener-[0-9a-z]{17}/rule/rule-[0-9a-z]{17}$))` @@ -229,67 +228,0 @@ Disable automatically prompt for CLI input parameters. -action -> (tagged union structure) - -> The action for the default rule. -> -> ### Note -> -> This is a Tagged Union structure. Only one of the following top level keys can be set: `fixedResponse`, `forward`. -> -> fixedResponse -> (structure) -> ->> The fixed response action. The rule returns a custom HTTP response. ->> ->> statusCode -> (integer) [required] ->> ->>> The HTTP response code. ->>> ->>> Constraints: ->>> ->>> * min: `100` ->>> * max: `599` ->>> - -> -> forward -> (structure) -> ->> The forward action. Traffic that matches the rule is forwarded to the specified target groups. ->> ->> targetGroups -> (list) [required] ->> ->>> The target groups. Traffic matching the rule is forwarded to the specified target groups. With forward actions, you can assign a weight that controls the prioritization and selection of each target group. This means that requests are distributed to individual target groups based on their weights. For example, if two target groups have the same weight, each target group receives half of the traffic. ->>> ->>> The default value is 1. This means that if only one target group is provided, there is no need to set the weight; 100% of the traffic goes to that target group. ->>> ->>> Constraints: ->>> ->>> * min: `1` ->>> * max: `10` ->>> - ->>> ->>> (structure) ->>> ->>>> Describes the weight of a target group. ->>>> ->>>> targetGroupIdentifier -> (string) [required] ->>>> ->>>>> The ID or ARN of the target group. ->>>>> ->>>>> Constraints: ->>>>> ->>>>> * min: `17` ->>>>> * max: `2048` ->>>>> * pattern: `^((tg-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:targetgroup/tg-[0-9a-z]{17}))$` ->>>>> - ->>>> ->>>> weight -> (integer) ->>>> ->>>>> Only required if you specify multiple target groups for a forward action. The weight determines how requests are distributed to the target group. For example, if you specify two target groups, each with a weight of 10, each target group receives half the requests. If you specify two target groups, one with a weight of 10 and the other with a weight of 20, the target group with a weight of 20 receives twice as many requests as the other target group. If there’s only one target group specified, then the default value is 100. ->>>>> ->>>>> Constraints: ->>>>> ->>>>> * min: `0` ->>>>> * max: `999` ->>>>> - - @@ -304 +237 @@ arn -> (string) -> * pattern: `^arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}/listener/listener-[0-9a-z]{17}/rule/rule-[0-9a-z]{17}$` +> * pattern: `arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:service/svc-[0-9a-z]{17}/listener/listener-[0-9a-z]{17}/rule/rule-[0-9a-z]{17}` @@ -308,4 +240,0 @@ arn -> (string) -createdAt -> (timestamp) - -> The date and time that the listener rule was created, in ISO-8601 format. - @@ -320 +249 @@ id -> (string) -> * pattern: `^rule-[0-9a-z]{17}$` +> * pattern: `rule-[0-9a-z]{17}` @@ -324 +253 @@ id -> (string) -isDefault -> (boolean) +name -> (string) @@ -326 +255,8 @@ isDefault -> (boolean) -> Indicates whether this is the default rule. +> The name of the listener. +> +> Constraints: +> +> * min: `3` +> * max: `63` +> * pattern: `(?!rule-)(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+` +> @@ -328 +263,0 @@ isDefault -> (boolean) -lastUpdatedAt -> (timestamp) @@ -330 +265,3 @@ lastUpdatedAt -> (timestamp) -> The date and time that the listener rule was last updated, in ISO-8601 format. +isDefault -> (boolean) + +> Indicates whether this is the default rule. @@ -343,0 +281,51 @@ match -> (tagged union structure) +>> method -> (string) +>> +>>> The HTTP method type. +>>> +>>> Constraints: +>>> +>>> * min: `0` +>>> * max: `16` +>>> + +>> +>> pathMatch -> (structure) +>> +>>> The path match. +>>> +>>> match -> (tagged union structure) [required] +>>> +>>>> The type of path match. +>>>> +>>>> ### Note +>>>> +>>>> This is a Tagged Union structure. Only one of the following top level keys can be set: `exact`, `prefix`. +>>>> +>>>> exact -> (string) +>>>> +>>>>> An exact match of the path. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `200` +>>>>> * pattern: `/[a-zA-Z0-9@:%_+.~#?&/=-]*` +>>>>> + +>>>> +>>>> prefix -> (string) +>>>> +>>>>> A prefix match of the path. +>>>>> +>>>>> Constraints: +>>>>> +>>>>> * min: `1` +>>>>> * max: `200` +>>>>> * pattern: `/[a-zA-Z0-9@:%_+.~#?&/=-]*` +>>>>> + +>>> +>>> caseSensitive -> (boolean) +>>> +>>>> Indicates whether the match is case sensitive. +>> @@ -359 +347 @@ match -> (tagged union structure) ->>>> caseSensitive -> (boolean) +>>>> name -> (string) [required] @@ -361 +349,8 @@ match -> (tagged union structure) ->>>>> Indicates whether the match is case sensitive.