AWS cli medium security documentation change
Summary
Updated AWS CLI version reference, restructured AppMonitor configuration documentation, added/modified constraints for multiple fields (including regex patterns for Name, Domain, IdentityPoolId, Tags), and clarified security-related configurations for IAM roles and data collection.
Security assessment
Multiple security-relevant changes: 1) Modified regex patterns for Name (removed anchors) and IdentityPoolId (more permissive pattern) could impact input validation security. 2) Added strict domain validation patterns prevent unauthorized domain data collection. 3) Explicit tag key pattern forbids 'aws:' prefixes to follow security best practices. 4) Clarified IAM role requirements for authorization. These changes directly affect configuration validation and access control mechanisms.
Diff
diff --git a/cli/latest/reference/rum/get-app-monitor.md b/cli/latest/reference/rum/get-app-monitor.md index 917149774..4adb50c95 100644 --- a//cli/latest/reference/rum/get-app-monitor.md +++ b//cli/latest/reference/rum/get-app-monitor.md @@ -15 +15 @@ - * [AWS CLI 2.31.39 Command Reference](../../index.html) » + * [AWS CLI 2.32.3 Command Reference](../../index.html) » @@ -100 +100 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rum-20 -> * pattern: `^(?!\.)[\.\-_#A-Za-z0-9]+$` +> * pattern: `(?!\.)[\.\-_#A-Za-z0-9]+` @@ -207 +207 @@ AppMonitor -> (structure) -> AppMonitorConfiguration -> (structure) +> Name -> (string) @@ -209 +209 @@ AppMonitor -> (structure) ->> A structure that contains much of the configuration data for the app monitor. +>> The name of the app monitor. @@ -211 +211 @@ AppMonitor -> (structure) ->> AllowCookies -> (boolean) +>> Constraints: @@ -213 +213,3 @@ AppMonitor -> (structure) ->>> If you set this to `true` , the RUM web client sets two cookies, a session cookie and a user cookie. The cookies allow the RUM web client to collect data relating to the number of users an application has and the behavior of the application across a sequence of events. Cookies are stored in the top-level domain of the current page. +>> * min: `1` +>> * max: `255` +>> * pattern: `(?!\.)[\.\-_#A-Za-z0-9]+` @@ -215 +217,5 @@ AppMonitor -> (structure) ->> EnableXRay -> (boolean) + +> +> Domain -> (string) +> +>> The top-level internet domain name for which your application has administrative authority. @@ -217 +223 @@ AppMonitor -> (structure) ->>> If you set this to `true` , RUM enables X-Ray tracing for the user sessions that RUM samples. RUM adds an X-Ray trace header to allowed HTTP requests. It also records an X-Ray segment for allowed HTTP requests. You can see traces and segments from these user sessions in the X-Ray console and the CloudWatch ServiceLens console. For more information, see [What is X-Ray?](https://docs.aws.amazon.com/xray/latest/devguide/aws-xray.html) +>> Constraints: @@ -219 +225,18 @@ AppMonitor -> (structure) ->> ExcludedPages -> (list) +>> * min: `1` +>> * max: `253` +>> * pattern: `(localhost)$|^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|(?=^[a-zA-Z0-9\.\*-]{4,253}$)(?!.*\.-)(?!.*-\.)(?!.*\.\.)(?!.*[^\.]{64,})^(\*\.)?(?![-\.\*])[^\*]{1,}\.(\*|(?!.*--)(?=.*[a-zA-Z])[^\*]{1,}[^\*-])` +>> + +> +> DomainList -> (list) +> +>> List the domain names for which your application has administrative authority. +>> +>> Constraints: +>> +>> * min: `1` +>> * max: `5` +>> + +>> +>> (string) @@ -221,4 +243,0 @@ AppMonitor -> (structure) ->>> A list of URLs in your website or application to exclude from RUM data collection. ->>> ->>> You can’t include both `ExcludedPages` and `IncludedPages` in the same operation. ->>> @@ -227,2 +246,3 @@ AppMonitor -> (structure) ->>> * min: `0` ->>> * max: `50` +>>> * min: `1` +>>> * max: `253` +>>> * pattern: `(localhost)$|^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$|(?=^[a-zA-Z0-9\.\*-]{4,253}$)(?!.*\.-)(?!.*-\.)(?!.*\.\.)(?!.*[^\.]{64,})^(\*\.)?(?![-\.\*])[^\*]{1,}\.(\*|(?!.*--)(?=.*[a-zA-Z])[^\*]{1,}[^\*-])` @@ -230,0 +251,42 @@ AppMonitor -> (structure) +> +> Id -> (string) +> +>> The unique ID of this app monitor. +>> +>> Constraints: +>> +>> * min: `36` +>> * max: `36` +>> * pattern: `[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}` +>> + +> +> Created -> (string) +> +>> The date and time that this app monitor was created. +>> +>> Constraints: +>> +>> * min: `19` +>> * max: `19` +>> + +> +> LastModified -> (string) +> +>> The date and time of the most recent changes to this app monitor’s configuration. +>> +>> Constraints: +>> +>> * min: `19` +>> * max: `19` +>> + +> +> Tags -> (map) +> +>> The list of tag keys and values associated with this app monitor. +>> +>> key -> (string) +>> +>>> Constraints: @@ -232 +294,3 @@ AppMonitor -> (structure) ->>> (string) +>>> * min: `1` +>>> * max: `128` +>>> * pattern: `(?!aws:)[a-zA-Z+-=._:/]+` @@ -234,6 +297,0 @@ AppMonitor -> (structure) ->>>> Constraints: ->>>> ->>>> * min: `1` ->>>> * max: `1260` ->>>> * pattern: `https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&*//=]*)` ->>>> @@ -242 +300 @@ AppMonitor -> (structure) ->> FavoritePages -> (list) +>> value -> (string) @@ -244,2 +301,0 @@ AppMonitor -> (structure) ->>> A list of pages in your application that are to be displayed with a “favorite” icon in the CloudWatch RUM console. ->>> @@ -249 +305 @@ AppMonitor -> (structure) ->>> * max: `50` +>>> * max: `256` @@ -252,2 +308,4 @@ AppMonitor -> (structure) ->>> ->>> (string) +> +> State -> (string) +> +>> The current state of the app monitor. @@ -255 +313,5 @@ AppMonitor -> (structure) ->> GuestRoleArn -> (string) +>> Possible values: +>> +>> * `CREATED` +>> * `DELETING` +>> * `ACTIVE` @@ -257,11 +318,0 @@ AppMonitor -> (structure) ->>> The ARN of the guest IAM role that is attached to the Amazon Cognito identity pool that is used to authorize the sending of data to RUM. ->>> ->>> ### Note ->>> ->>> It is possible that an app monitor does not have a value for `GuestRoleArn` . For example, this can happen when you use the console to create an app monitor and you allow CloudWatch RUM to create a new identity pool for Authorization. In this case, `GuestRoleArn` is not present in the [GetAppMonitor](https://docs.aws.amazon.com/cloudwatchrum/latest/APIReference/API_GetAppMonitor.html) response because it is not stored by the service. ->>> ->>> If this issue affects you, you can take one of the following steps: ->>> ->>> * Use the Cloud Development Kit (CDK) to create an identity pool and the associated IAM role, and use that for your app monitor. ->>> * Make a separate [GetIdentityPoolRoles](https://docs.aws.amazon.com/cognitoidentity/latest/APIReference/API_GetIdentityPoolRoles.html) call to Amazon Cognito to retrieve the `GuestRoleArn` . ->>> @@ -268,0 +320,8 @@ AppMonitor -> (structure) +> +> AppMonitorConfiguration -> (structure) +> +>> A structure that contains much of the configuration data for the app monitor. +>> +>> IdentityPoolId -> (string) +>> +>>> The ID of the Amazon Cognito identity pool that is used to authorize the sending of data to RUM. @@ -272 +331,3 @@ AppMonitor -> (structure) ->>> * pattern: `arn:[^:]*:[^:]*:[^:]*:[^:]*:.*` +>>> * min: `1` +>>> * max: `55` +>>> * pattern: `.*[\w-]+:[0-9a-f-]+.*` @@ -276 +337 @@ AppMonitor -> (structure) ->> IdentityPoolId -> (string) +>> ExcludedPages -> (list) @@ -278 +339,3 @@ AppMonitor -> (structure) ->>> The ID of the Amazon Cognito identity pool that is used to authorize the sending of data to RUM. +>>> A list of URLs in your website or application to exclude from RUM data collection. +>>> +>>> You can’t include both `ExcludedPages` and `IncludedPages` in the same operation. @@ -282,3 +345,2 @@ AppMonitor -> (structure) ->>> * min: `1` ->>> * max: `55` ->>> * pattern: `[\w-]+:[0-9a-f-]+` +>>> * min: `0` +>>> * max: `50` @@ -286,0 +349,10 @@ AppMonitor -> (structure) +>>> +>>> (string) +>>> +>>>> Constraints: +>>>> +>>>> * min: `1` +>>>> * max: `1260` +>>>> * pattern: `.*https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&*//=]*).*` +>>>> + @@ -307 +379 @@ AppMonitor -> (structure) ->>>> * pattern: `https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&*//=]*)` +>>>> * pattern: `.*https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&*//=]*).*` @@ -309,0 +382,13 @@ AppMonitor -> (structure) +>> +>> FavoritePages -> (list)