AWS autoscaling documentation change
Summary
Updated Auto Scaling example to use CloudFormation for resource creation, added VPC/subnet handling, and corrected launch template usage
Security assessment
Changes focus on improving infrastructure-as-code practices and example correctness. While the update fixes a misconfiguration (using subnet ID instead of VPC ID for vpcZoneIdentifier), there's no evidence this addressed an active security vulnerability. The CloudFormation integration demonstrates better resource management but doesn't explicitly add security controls.
Diff
diff --git a/autoscaling/ec2/userguide/example_auto-scaling_Scenario_GroupsAndInstances_section.md b/autoscaling/ec2/userguide/example_auto-scaling_Scenario_GroupsAndInstances_section.md index c74aea556..f319faa16 100644 --- a//autoscaling/ec2/userguide/example_auto-scaling_Scenario_GroupsAndInstances_section.md +++ b//autoscaling/ec2/userguide/example_auto-scaling_Scenario_GroupsAndInstances_section.md @@ -1682 +1682 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - + private static final String ROLES_STACK = "MyCdkAutoScaleStack"; @@ -1687 +1687 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - <groupName> <launchTemplateName> <vpcZoneId> + <groupName> @@ -1691,2 +1690,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - launchTemplateName - The name of the launch template.\s - vpcZoneId - A subnet Id for a virtual private cloud (VPC) where instances in the Auto Scaling group can be created. @@ -1695,9 +1693 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - //if (args.length != 3) { - // System.out.println(usage); - // System.exit(1); - // } - - String groupName = "Scott250" ; //rgs[0]; - String launchTemplateName = "MyTemplate5" ;//args[1]; - String vpcZoneId = "subnet-0ddc451b8a8a1aa44" ; //args[2]; - + String groupName = "MyAutoScalingGroup2"; @@ -1705 +1695 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - .region(Region.US_EAST_1) + .region(Region.US_WEST_2) @@ -1708 +1698,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - Ec2Client ec2 = Ec2Client.create(); + Ec2Client ec2 = Ec2Client.builder() + .region(Region.US_WEST_2) + .build(); @@ -1714,0 +1707,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + System.out.println("First, we will create a launch template using a CloudFormation script"); + CloudFormationHelper.deployCloudFormationStack(ROLES_STACK); + Map<String, String> stackOutputs = CloudFormationHelper.getStackOutputsAsync(ROLES_STACK).join(); + String launchTemplateName = stackOutputs.get("LaunchTemplateNameOutput"); + String vpcZoneId = getVPC(ec2); + updateTemlate(ec2, launchTemplateName ); + System.out.println("The VPC zone id created by the CloudFormation stack is"+vpcZoneId); + @@ -1716 +1716,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - createAutoScalingGroup(autoScalingClient, groupName, launchTemplateName, vpcZoneId); + createAutoScalingGroup(autoScalingClient, ec2, groupName, launchTemplateName, vpcZoneId); + @@ -1787 +1788,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - System.out.println("13. Delete the Auto Scaling group"); + System.out.println("13. Delete the Auto Scaling group and cloud formation resources"); + CloudFormationHelper.destroyCloudFormationStack(ROLES_STACK); @@ -1797,0 +1800,50 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + public static String getVPC(Ec2Client ec2) { + try { + DescribeVpcsRequest request = DescribeVpcsRequest.builder() + .filters(f -> f.name("isDefault").values("true")) + .build(); + + DescribeVpcsResponse response = ec2.describeVpcs(request); + + if (!response.vpcs().isEmpty()) { + Vpc defaultVpc = response.vpcs().get(0); + System.out.println("Default VPC ID: " + defaultVpc.vpcId()); + return defaultVpc.vpcId(); + } else { + System.out.println("No default VPC found."); + return null; // Return null if no default VPC is found + } + + } catch (Ec2Exception e) { + System.err.println("EC2 error: " + e.awsErrorDetails().errorMessage()); + return null; // Return null in case of an error + } + } + + + public static void updateTemlate(Ec2Client ec2, String launchTemplateName ) { + // Step 1: Create new launch template version + String newAmiId = "ami-0025f0db847eb6254"; + RequestLaunchTemplateData launchTemplateData = RequestLaunchTemplateData.builder() + .imageId(newAmiId) + .build(); + + CreateLaunchTemplateVersionRequest createVersionRequest = CreateLaunchTemplateVersionRequest.builder() + .launchTemplateName(launchTemplateName) + .versionDescription("Updated with valid AMI") + .sourceVersion("1") + .launchTemplateData(launchTemplateData) + .build(); + + CreateLaunchTemplateVersionResponse createResponse = ec2.createLaunchTemplateVersion(createVersionRequest); + int newVersionNumber = createResponse.launchTemplateVersion().versionNumber().intValue(); + + // Step 2: Modify default version + ModifyLaunchTemplateRequest modifyRequest = ModifyLaunchTemplateRequest.builder() + .launchTemplateName(launchTemplateName) + .defaultVersion(String.valueOf(newVersionNumber)) + .build(); + + ec2.modifyLaunchTemplate(modifyRequest); + System.out.println("Updated launch template to version " + newVersionNumber + " with AMI " + newAmiId); + } @@ -1837,0 +1890 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + Ec2Client ec2Client, @@ -1840 +1893 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - String vpcZoneId) { + String vpcId) { @@ -1842 +1895,15 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - AutoScalingWaiter waiter = autoScalingClient.waiter(); + // Step 1: Get one subnet ID in the given VPC + DescribeSubnetsRequest subnetRequest = DescribeSubnetsRequest.builder() + .filters(Filter.builder().name("vpc-id").values(vpcId).build()) + .build(); + + DescribeSubnetsResponse subnetResponse = ec2Client.describeSubnets(subnetRequest); + + if (subnetResponse.subnets().isEmpty()) { + throw new RuntimeException("No subnets found in VPC: " + vpcId); + } + + String subnetId = subnetResponse.subnets().get(0).subnetId(); // Use first subnet + System.out.println("Using subnet: " + subnetId); + + // Step 2: Create launch template reference @@ -1846,0 +1914 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + // Step 3: Create Auto Scaling group @@ -1849 +1916,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - .availabilityZones("us-east-1a") @@ -1851 +1917,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - .maxSize(1) @@ -1853 +1919,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - .vpcZoneIdentifier(vpcZoneId) + .maxSize(1) + .vpcZoneIdentifier(subnetId) // Correct: subnet ID, not VPC ID @@ -1856,0 +1924,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + // Step 4: Wait until group is created + AutoScalingWaiter waiter = autoScalingClient.waiter(); @@ -1861,2 +1931,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - WaiterResponse<DescribeAutoScalingGroupsResponse> waiterResponse = waiter - .waitUntilGroupExists(groupsRequest); + WaiterResponse<DescribeAutoScalingGroupsResponse> waiterResponse = + waiter.waitUntilGroupExists(groupsRequest); + @@ -1866,2 +1937,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - } catch (AutoScalingException e) { - System.err.println(e.awsErrorDetails().errorMessage()); + } catch (Ec2Exception | AutoScalingException e) { + System.err.println("Error: " + e.awsErrorDetails().errorMessage());