AWS cli medium security documentation change
Summary
Updated CLI version, swapped --crl-data and --name parameters, modified parameter constraints (max length, patterns), and reordered fields in CRL structure documentation.
Security assessment
The change modifies validation patterns (e.g., removing ^/$ anchors in ARN/uuid patterns) and parameter ordering for CRL operations. These patterns enforce resource identifiers' validity, and relaxing them could impact security validation. For example, the trustAnchorArn pattern change from '^arn:aws...$' to 'arn:aws...' removes strict boundaries, potentially allowing invalid ARNs if not properly validated elsewhere.
Diff
diff --git a/cli/latest/reference/rolesanywhere/import-crl.md b/cli/latest/reference/rolesanywhere/import-crl.md index ff084b9ae..d71554795 100644 --- a//cli/latest/reference/rolesanywhere/import-crl.md +++ b//cli/latest/reference/rolesanywhere/import-crl.md @@ -15 +15 @@ - * [AWS CLI 2.32.11 Command Reference](../../index.html) » + * [AWS CLI 2.32.13 Command Reference](../../index.html) » @@ -68,0 +69 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa + --name <value> @@ -71 +71,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa - --name <value> @@ -98 +98 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -`--crl-data` (blob) [required] +`--name` (string) [required] @@ -100 +100 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> The x509 v3 specified certificate revocation list (CRL). +> The name of the certificate revocation list (CRL). @@ -105 +105,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> * max: `300000` +> * max: `255` +> * pattern: `[ a-zA-Z0-9-_]*` @@ -109,5 +110 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -`--enabled` | `--no-enabled` (boolean) - -> Specifies whether the certificate revocation list (CRL) is enabled. - -`--name` (string) [required] +`--crl-data` (blob) [required] @@ -115 +112 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> The name of the certificate revocation list (CRL). +> The x509 v3 specified certificate revocation list (CRL). @@ -120,2 +117 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa -> * max: `255` -> * pattern: `^[ a-zA-Z0-9-_]*$` +> * max: `300000` @@ -124,0 +121,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa +`--enabled` | `--no-enabled` (boolean) + +> Specifies whether the certificate revocation list (CRL) is enabled. + @@ -148 +148 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa ->>> * pattern: `^[ a-zA-Z0-9_.:/=+@-]*$` +>>> * pattern: `[ a-zA-Z0-9_.:/=+@-]*` @@ -160 +160 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/rolesa ->>> * pattern: `^[ a-zA-Z0-9_.:/=+@-]*$` +>>> * pattern: `[ a-zA-Z0-9_.:/=+@-]*` @@ -190 +190 @@ JSON Syntax: -> * pattern: `^arn:aws(-[^:]+)?:rolesanywhere(:.*){2}(:trust-anchor.*)$` +> * pattern: `arn:aws(-[^:]+)?:rolesanywhere(:.*){2}(:trust-anchor.*)` @@ -297,12 +296,0 @@ crl -> (structure) -> createdAt -> (timestamp) -> ->> The ISO-8601 timestamp when the certificate revocation list (CRL) was created. -> -> crlArn -> (string) -> ->> The ARN of the certificate revocation list (CRL). -> -> crlData -> (blob) -> ->> The state of the certificate revocation list (CRL) after a read or write operation. -> @@ -317 +305 @@ crl -> (structure) ->> * pattern: `[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}` +>> * pattern: `.*[a-f0-9]{8}-([a-z0-9]{4}-){3}[a-z0-9]{12}.*` @@ -321 +309 @@ crl -> (structure) -> enabled -> (boolean) +> crlArn -> (string) @@ -323 +311 @@ crl -> (structure) ->> Indicates whether the certificate revocation list (CRL) is enabled. +>> The ARN of the certificate revocation list (CRL). @@ -328,0 +317,8 @@ crl -> (structure) +> enabled -> (boolean) +> +>> Indicates whether the certificate revocation list (CRL) is enabled. +> +> crlData -> (blob) +> +>> The state of the certificate revocation list (CRL) after a read or write operation. +> @@ -332,0 +329,4 @@ crl -> (structure) +> createdAt -> (timestamp) +> +>> The ISO-8601 timestamp when the certificate revocation list (CRL) was created. +> @@ -347 +347 @@ crl -> (structure) - * [AWS CLI 2.32.11 Command Reference](../../index.html) » + * [AWS CLI 2.32.13 Command Reference](../../index.html) »