AWS step-functions documentation change
Summary
Updated documentation to recommend using `InvocationConfig` over `Authentication` for HTTPS API calls, simplified `Authentication` section, and clarified connection handling.
Security assessment
The change promotes using `InvocationConfig` which helps avoid hard-coding secrets by leveraging EventBridge connections. While this improves security practices, there is no explicit mention of addressing a specific vulnerability.
Diff
diff --git a/step-functions/latest/dg/call-https-apis.md b/step-functions/latest/dg/call-https-apis.md index 836913ebc..f54de08f6 100644 --- a//step-functions/latest/dg/call-https-apis.md +++ b//step-functions/latest/dg/call-https-apis.md @@ -142 +142 @@ You can also use a [reference path](./amazon-states-language-paths.html#amazon-s -You must specify either `Authentication` _or_ `InvocationConfig`. +_We recommend using`InvocationConfig` over `Authentication` for both public and private HTTPS API calls._ @@ -144,17 +144 @@ You must specify either `Authentication` _or_ `InvocationConfig`. -Contains the `ConnectionArn` field that specifies how to authenticate a public HTTPS API call. Step Functions supports authentication for a specified `ApiEndpoint` using the connection resource of Amazon EventBridge. - -`ConnectionArn` **(Required)** - - -Specifies the EventBridge connection ARN. - -An HTTP Task requires an [EventBridge connection](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-target-connection.html), which securely manages the authorization credentials of an API provider. A _connection_ specifies the authorization type and credentials to use for authorizing an HTTPS API. Using a connection helps you avoid hard-coding secrets, such as API keys, into your state machine definition. In a connection, you can also specify `Headers`, `QueryParameters`, and `RequestBody` parameters. - -For more information, see Connectivity for an HTTP Task. - -The following example shows how you can specify the `Authentication` field in your HTTP Task definition. - - - "Authentication": { - "ConnectionArn": "arn:aws:events:us-east-2:account-id:connection/Stripe/81210c42-8af1-456b-9c4a-6ff02fc664ac" - } +Existing `Authentication` references are maintained for backwards compatibility. Within the field, you must specify a `ConnectionArn` field that specifies a connection resource of Amazon EventBridge to connect to the `ApiEndpoint`. @@ -165 +149 @@ The following example shows how you can specify the `Authentication` field in yo -You must specify either `Authentication` _or_ `InvocationConfig`. +Contains the authorization and network connectivity configuration for **both** public and private HTTPS API calls. @@ -167 +151 @@ You must specify either `Authentication` _or_ `InvocationConfig`. -Contains the authorization and network connectivity configuration for a private HTTPS API call. Step Functions supports connection for a specified `ApiEndpoint` using the connection resource of Amazon EventBridge. For more information, see [Connecting to private APIs](https://docs.aws.amazon.com/eventbridge/latest/userguide/connection-private.html) in the _Amazon EventBridge User Guide_. +Step Functions handles the connection for a specified `ApiEndpoint` using the connection resource of Amazon EventBridge. For more information, see [Connecting to private APIs](https://docs.aws.amazon.com/eventbridge/latest/userguide/connection-private.html) in the _Amazon EventBridge User Guide_. @@ -178 +162 @@ For more information, see Connectivity for an HTTP Task. -The following example shows how you can specify an `InvocationConfig` field in your HTTP Task definition. +The following example shows the format of `InvocationConfig` in an HTTP Task: