AWS cli medium security documentation change
Summary
Updated CLI version reference from 2.31.3 to 2.31.5, modified regex patterns (removed start/end anchors), restructured field descriptions (e.g., swapped 'arn' and 'id' fields), updated constraints for identifiers, and reordered parameters like securityGroupIds.
Security assessment
The removal of regex anchors (^ and $) in patterns for critical identifiers like securityGroupIds (changed from `^sg-...$` to `sg-...`) weakens input validation, potentially allowing partial matches. This could enable injection of malformed resource IDs if the service relies on these patterns for validation. The securityGroupIds pattern change (min:5→max:200 to min:5→max:200 with relaxed regex) specifically impacts security group ID validation, a key network security control.
Diff
diff --git a/cli/latest/reference/vpc-lattice/get-service-network-vpc-association.md b/cli/latest/reference/vpc-lattice/get-service-network-vpc-association.md index fc7fd36b0..10aa7c773 100644 --- a//cli/latest/reference/vpc-lattice/get-service-network-vpc-association.md +++ b//cli/latest/reference/vpc-lattice/get-service-network-vpc-association.md @@ -15 +15 @@ - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) » @@ -101 +101 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/vpc-la -> * pattern: `^((snva-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:servicenetworkvpcassociation/snva-[0-9a-z]{17}))$` +> * pattern: `((snva-[0-9a-z]{17})|(arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:servicenetworkvpcassociation/snva-[0-9a-z]{17}))` @@ -243 +243 @@ For more information, see [Manage VPC associations](https://docs.aws.amazon.com/ -arn -> (string) +id -> (string) @@ -245 +245 @@ arn -> (string) -> The Amazon Resource Name (ARN) of the association. +> The ID of the association. @@ -249,3 +249,3 @@ arn -> (string) -> * min: `20` -> * max: `2048` -> * pattern: `^arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:servicenetworkvpcassociation/snva-[0-9a-z]{17}$` +> * min: `22` +> * max: `22` +> * pattern: `snva-[0-9a-z]{17}` @@ -255,5 +255 @@ arn -> (string) -createdAt -> (timestamp) - -> The date and time that the association was created, in ISO-8601 format. - -createdBy -> (string) +status -> (string) @@ -261 +257 @@ createdBy -> (string) -> The account that created the association. +> The status of the association. @@ -263 +259 @@ createdBy -> (string) -> Constraints: +> Possible values: @@ -265,3 +261,7 @@ createdBy -> (string) -> * min: `1` -> * max: `12` -> * pattern: `^[0-9]{12}$` +> * `CREATE_IN_PROGRESS` +> * `ACTIVE` +> * `UPDATE_IN_PROGRESS` +> * `DELETE_IN_PROGRESS` +> * `CREATE_FAILED` +> * `DELETE_FAILED` +> * `UPDATE_FAILED` @@ -271,9 +271 @@ createdBy -> (string) -failureCode -> (string) - -> The failure code. - -failureMessage -> (string) - -> The failure message. - -id -> (string) +arn -> (string) @@ -281 +273 @@ id -> (string) -> The ID of the association. +> The Amazon Resource Name (ARN) of the association. @@ -285,15 +277,3 @@ id -> (string) -> * min: `22` -> * max: `22` -> * pattern: `^snva-[0-9a-z]{17}$` -> - - -lastUpdatedAt -> (timestamp) - -> The date and time that the association was last updated, in ISO-8601 format. - -securityGroupIds -> (list) - -> The IDs of the security groups. -> -> (string) +> * min: `20` +> * max: `2048` +> * pattern: `arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:servicenetworkvpcassociation/snva-[0-9a-z]{17}` @@ -301,6 +280,0 @@ securityGroupIds -> (list) ->> Constraints: ->> ->> * min: `5` ->> * max: `200` ->> * pattern: `^sg-(([0-9a-z]{8})|([0-9a-z]{17}))$` ->> @@ -309 +283 @@ securityGroupIds -> (list) -serviceNetworkArn -> (string) +createdBy -> (string) @@ -311 +285 @@ serviceNetworkArn -> (string) -> The Amazon Resource Name (ARN) of the service network. +> The account that created the association. @@ -315,3 +289,3 @@ serviceNetworkArn -> (string) -> * min: `32` -> * max: `2048` -> * pattern: `^arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:servicenetwork/sn-[0-9a-z]{17}$` +> * min: `1` +> * max: `12` +> * pattern: `[0-9]{12}` @@ -320,0 +295,4 @@ serviceNetworkArn -> (string) +createdAt -> (timestamp) + +> The date and time that the association was created, in ISO-8601 format. + @@ -329 +307 @@ serviceNetworkId -> (string) -> * pattern: `^sn-[0-9a-z]{17}$` +> * pattern: `sn-[0-9a-z]{17}` @@ -341 +319 @@ serviceNetworkName -> (string) -> * pattern: `^(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+$` +> * pattern: `(?![-])(?!.*[-]$)(?!.*[-]{2})[a-z0-9-]+` @@ -345 +323 @@ serviceNetworkName -> (string) -status -> (string) +serviceNetworkArn -> (string) @@ -347 +325 @@ status -> (string) -> The status of the association. +> The Amazon Resource Name (ARN) of the service network. @@ -349 +327 @@ status -> (string) -> Possible values: +> Constraints: @@ -351,7 +329,3 @@ status -> (string) -> * `CREATE_IN_PROGRESS` -> * `ACTIVE` -> * `UPDATE_IN_PROGRESS` -> * `DELETE_IN_PROGRESS` -> * `CREATE_FAILED` -> * `DELETE_FAILED` -> * `UPDATE_FAILED` +> * min: `32` +> * max: `2048` +> * pattern: `arn:[a-z0-9\-]+:vpc-lattice:[a-zA-Z0-9\-]+:\d{12}:servicenetwork/sn-[0-9a-z]{17}` @@ -369 +343,9 @@ vpcId -> (string) -> * pattern: `^vpc-(([0-9a-z]{8})|([0-9a-z]{17}))$` +> * pattern: `vpc-(([0-9a-z]{8})|([0-9a-z]{17}))` +> + + +securityGroupIds -> (list) + +> The IDs of the security groups. +> +> (string) @@ -370,0 +353,11 @@ vpcId -> (string) +>> Constraints: +>> +>> * min: `5` +>> * max: `200` +>> * pattern: `sg-(([0-9a-z]{8})|([0-9a-z]{17}))` +>> + + +failureMessage -> (string) + +> The failure message. @@ -371,0 +365,7 @@ vpcId -> (string) +failureCode -> (string) + +> The failure code. + +lastUpdatedAt -> (timestamp) + +> The date and time that the association was last updated, in ISO-8601 format. @@ -383 +383 @@ vpcId -> (string) - * [AWS CLI 2.31.3 Command Reference](../../index.html) » + * [AWS CLI 2.31.5 Command Reference](../../index.html) »