AWS cli medium security documentation change
Summary
Corrected parameter documentation for --certificate-field and --profile-id, updated field constraints, and reordered profile structure fields
Security assessment
The change fixes swapped parameter descriptions between --certificate-field (used for X.509 certificate mappings) and --profile-id (used for profile identification). Incorrect use of these parameters could lead to misconfigured attribute mappings, potentially allowing unauthorized certificate-based access if administrators followed previous documentation. The pattern changes for roleArns (removed regex anchors) and name fields (more permissive pattern) could also impact validation logic.
Diff
diff --git a/cli/latest/reference/rolesanywhere/delete-attribute-mapping.md b/cli/latest/reference/rolesanywhere/delete-attribute-mapping.md index 1808d705b..815e85a0f 100644 --- a//cli/latest/reference/rolesanywhere/delete-attribute-mapping.md +++ b//cli/latest/reference/rolesanywhere/delete-attribute-mapping.md @@ -15 +15 @@ - * [AWS CLI 2.32.11 Command Reference](../../index.html) » + * [AWS CLI 2.32.13 Command Reference](../../index.html) » @@ -67 +66,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa - --certificate-field <value> @@ -68,0 +68 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa + --certificate-field <value> @@ -94 +94 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -`--certificate-field` (string) [required] +`--profile-id` (string) [required] @@ -96 +96 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates. +> The unique identifier of the profile. @@ -98 +98 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> Possible values: +> Constraints: @@ -100,3 +100,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> * `x509Subject` -> * `x509Issuer` -> * `x509SAN` +> * min: `36` +> * max: `36` +> * pattern: `.*[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}.*` @@ -106 +106 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -`--profile-id` (string) [required] +`--certificate-field` (string) [required] @@ -108 +108 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> The unique identifier of the profile. +> Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates. @@ -110 +110 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> Constraints: +> Possible values: @@ -112,3 +112,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> * min: `36` -> * max: `36` -> * pattern: `[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}` +> * `x509Subject` +> * `x509Issuer` +> * `x509SAN` @@ -233,5 +233 @@ profile -> (structure) -> acceptRoleSessionName -> (boolean) -> ->> Used to determine if a custom role session name will be accepted in a temporary credential request. -> -> attributeMappings -> (list) +> profileId -> (string) @@ -239 +235 @@ profile -> (structure) ->> A mapping applied to the authenticating end-entity certificate. +>> The unique identifier of the profile. @@ -241 +237,5 @@ profile -> (structure) ->> (structure) +>> Constraints: +>> +>> * min: `36` +>> * max: `36` +>> * pattern: `.*[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}.*` @@ -243,31 +242,0 @@ profile -> (structure) ->>> A mapping applied to the authenticating end-entity certificate. ->>> ->>> certificateField -> (string) ->>> ->>>> Fields (x509Subject, x509Issuer and x509SAN) within X.509 certificates. ->>>> ->>>> Possible values: ->>>> ->>>> * `x509Subject` ->>>> * `x509Issuer` ->>>> * `x509SAN` ->>>> - ->>> ->>> mappingRules -> (list) ->>> ->>>> A list of mapping entries for every supported specifier or sub-field. ->>>> ->>>> (structure) ->>>> ->>>>> A single mapping entry for each supported specifier or sub-field. ->>>>> ->>>>> specifier -> (string) [required] ->>>>> ->>>>>> Specifier within a certificate field, such as CN, OU, or UID from the Subject field. ->>>>>> ->>>>>> Constraints: ->>>>>> ->>>>>> * min: `0` ->>>>>> * max: `60` ->>>>>> @@ -276,17 +245 @@ profile -> (structure) -> createdAt -> (timestamp) -> ->> The ISO-8601 timestamp when the profile was created. -> -> createdBy -> (string) -> ->> The Amazon Web Services account that created the profile. -> -> durationSeconds -> (integer) -> ->> Used to determine how long sessions vended using this profile are valid for. See the `Expiration` section of the [CreateSession API documentation](https://docs.aws.amazon.com/rolesanywhere/latest/userguide/authentication-create-session.html#credentials-object) page for more details. In requests, if this value is not provided, the default value will be 3600. -> -> enabled -> (boolean) -> ->> Indicates whether the profile is enabled. -> -> managedPolicyArns -> (list) +> profileArn -> (string) @@ -294 +247 @@ profile -> (structure) ->> A list of managed policy ARNs that apply to the vended session credentials. +>> The ARN of the profile. @@ -298,6 +251,3 @@ profile -> (structure) ->> * min: `0` ->> * max: `50` ->> - ->> ->> (string) +>> * min: `1` +>> * max: `1011` +>> * pattern: `arn:aws(-[^:]+)?:rolesanywhere(:.*){2}(:profile.*)` @@ -305,5 +254,0 @@ profile -> (structure) ->>> Constraints: ->>> ->>> * min: `1` ->>> * max: `200` ->>> @@ -320 +265 @@ profile -> (structure) ->> * pattern: `^[ a-zA-Z0-9-_]*$` +>> * pattern: `[ a-zA-Z0-9-_]*` @@ -324 +269 @@ profile -> (structure) -> profileArn -> (string) +> requireInstanceProperties -> (boolean) @@ -326,9 +271 @@ profile -> (structure) ->> The ARN of the profile. ->> ->> Constraints: ->> ->> * min: `1` ->> * max: `1011` ->> * pattern: `^arn:aws(-[^:]+)?:rolesanywhere(:.*){2}(:profile.*)$` ->> - +>> Unused, saved for future use. Will likely specify whether instance properties are required in temporary credential requests with this profile. @@ -336 +273 @@ profile -> (structure) -> profileId -> (string) +> enabled -> (boolean) @@ -338,9 +275 @@ profile -> (structure) ->> The unique identifier of the profile. ->> ->> Constraints: ->> ->> * min: `36` ->> * max: `36` ->> * pattern: `[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}` ->> - +>> Indicates whether the profile is enabled. @@ -348 +277,5 @@ profile -> (structure) -> requireInstanceProperties -> (boolean) +> createdBy -> (string) +> +>> The Amazon Web Services account that created the profile. +> +> sessionPolicy -> (string) @@ -350 +283 @@ profile -> (structure) ->> Specifies whether instance properties are required in temporary credential requests with this profile. +>> A session policy that applies to the trust boundary of the vended session credentials. @@ -369 +302 @@ profile -> (structure) ->>> * pattern: `^arn:aws(-[^:]+)?:iam(:.*){2}(:role.*)$` +>>> * pattern: `arn:aws(-[^:]+)?:iam(:.*){2}(:role.*)` @@ -373 +306 @@ profile -> (structure) -> sessionPolicy -> (string) +> managedPolicyArns -> (list) @@ -375 +308,21 @@ profile -> (structure) ->> A session policy that applies to the trust boundary of the vended session credentials. +>> A list of managed policy ARNs that apply to the vended session credentials. +>> +>> Constraints: +>> +>> * min: `0` +>> * max: `50` +>> + +>> +>> (string) +>> +>>> Constraints: +>>> +>>> * min: `1` +>>> * max: `200` +>>> + +> +> createdAt -> (timestamp) +> +>> The ISO-8601 timestamp when the profile was created.