AWS m2 high security documentation change
Summary
Added authentication requirements, input validation constraints, and HTTP method changes across multiple endpoints. Enhanced security documentation by specifying role-based access controls, parameter validation rules (length, patterns, value ranges), and error handling details.
Security assessment
The changes introduce concrete security controls: 1) Role-based authentication requirements (e.g., ROLE_ADMIN) added to 15+ endpoints prevent unauthorized access. 2) Input validation rules mitigate injection attacks (e.g., script ID pattern `^[a-zA-Z0-9._-]+$`), DoS (parameter map size limits of 20-50 entries), and data tampering (value ranges like 1-1000). 3) Method changes from GET to POST for state-modifying endpoints reduce CSRF risks. 4) Explicit HTTP 400/500 error documentation improves attack surface visibility.
Diff
diff --git a/m2/latest/userguide/ba-endpoints-gapwalk.md b/m2/latest/userguide/ba-endpoints-gapwalk.md index 3131b89f5..5b6aef98c 100644 --- a//m2/latest/userguide/ba-endpoints-gapwalk.md +++ b//m2/latest/userguide/ba-endpoints-gapwalk.md @@ -62,0 +63,2 @@ Batch jobs can be run either synchronously or asynchronously (see details below) +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -81 +83,3 @@ The links represent the url to use to launch each listed script **synchronously* - * Supported method: GET + * Supported method: GET / POST + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER @@ -101,0 +106,2 @@ This endpoint has two variants with dedicated paths for GET and POST usage (see +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -105,0 +112,2 @@ This endpoint has two variants with dedicated paths for GET and POST usage (see +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -110 +118 @@ This endpoint has two variants with dedicated paths for GET and POST usage (see - * identifier of the script to launch + * identifier of the script to launch **Input validation** : Script ID must not be blank, cannot exceed 255 characters, and must match the pattern: `^[a-zA-Z0-9._-]+$` @@ -112 +120 @@ This endpoint has two variants with dedicated paths for GET and POST usage (see - * optionally: parameters to pass to the script, using request parameters (seen as a `Map<String,String>`). The given parameters will be automatically added to the [bindings](https://docs.groovy-lang.org/latest/html/api/groovy/lang/Binding.html) of the invoked groovy script. + * optionally: parameters to pass to the script, using request parameters (seen as a `Map<String,String>`). The given parameters will be automatically added to the [bindings](https://docs.groovy-lang.org/latest/html/api/groovy/lang/Binding.html) of the invoked groovy script. **Input validation** : Parameter map cannot exceed 50 entries. @@ -116 +124,7 @@ This endpoint has two variants with dedicated paths for GET and POST usage (see - * "HTTP 200: "Done." or JSON success message on successful execution + * HTTP 200: "Done." or JSON success message on successful execution + + * HTTP 200: A JSON error message with execution failure details. Additional information available in server logs. + +###### Note + +Runtime now supports returning HTTP 500 status code for failed job executions. See [Available properties for the main application](https://docs.aws.amazon.com/m2/latest/userguide/ba-runtime-key-value.html#ba-runtime-key-value-main) to configure this response code. @@ -118 +132 @@ This endpoint has two variants with dedicated paths for GET and POST usage (see - * HTTP 200: JSON error message with execution failure details. Additional information available in server logs. + * **Input Validation** : Invalid script ID or parameters will return HTTP 400 Bad Request with validation error details. @@ -141,0 +156,2 @@ The synchronous calls should be reserved for short time running jobs. Long times +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -146 +162 @@ The synchronous calls should be reserved for short time running jobs. Long times - * identifier of the script to launch + * identifier of the script to launch **Input validation** : Script ID must not be blank, cannot exceed 255 characters, and must match the pattern: `^[a-zA-Z0-9._-]+$` @@ -148 +164 @@ The synchronous calls should be reserved for short time running jobs. Long times - * optionally: parameters to pass to the script, using request parameters (seen as a `Map<String,String>`). The given parameters will be automatically added to the https://docs.groovy-lang.org/latest/html/api/groovy/lang/Binding.html[bindings] of the invoked groovy script. + * optionally: parameters to pass to the script, using request parameters (seen as a `Map<String,String>`). The given parameters will be automatically added to the [bindings](https://docs.groovy-lang.org/latest/html/api/groovy/lang/Binding.html) of the invoked groovy script. **Input validation** : Parameter map cannot exceed 50 entries. @@ -172 +188,3 @@ The unique job execution identifier permits to quickly retrieve related log entr - * Supported methods: GET + * Supported methods: GET / POST + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER @@ -178 +196 @@ The unique job execution identifier permits to quickly retrieve related log entr - * Status (mandatory): the status of the triggered scripts to retrieve. Possibles values are: + * Status (mandatory): the status of the triggered scripts to retrieve. **Input validation** : Status must not be blank and cannot exceed 50 characters. Possibles values are: @@ -192 +210 @@ The unique job execution identifier permits to quickly retrieve related log entr - * _namefilter (optional)_ : retrieve only executions for the given script identifier. + * _namefilter (optional)_ : retrieve only executions for the given script identifier. **Input validation** : Cannot exceed 255 characters @@ -218,0 +237,2 @@ Sample response: +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -223 +243 @@ Sample response: - * jobexecutionid (mandatory): the unique job execution identifier to retrieve the corresponding job execution details. + * jobexecutionid (mandatory): the unique job execution identifier to retrieve the corresponding job execution details. **Input validation** : Job execution ID must not be blank and cannot exceed 255 characters @@ -233,0 +254,2 @@ Sample response: +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -244,0 +267,2 @@ Sample response: +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -254 +278,3 @@ Sample response: - * Supported method: GET + * Supported method: POST + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN @@ -258 +284 @@ Sample response: - * Argument: job execution identifier (mandatory): the unique job execution identifier to point at the job execution to be forcefully killed. + * Argument: job execution identifier (mandatory): the unique job execution identifier to point at the job execution to be forcefully killed. **Input validation** : Identifier must not be blank and cannot exceed 255 characters @@ -282 +308,3 @@ Job restartability relies on the ability for the scripts to register checkpoints - * Supported method: GET + * Supported method: POST + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN @@ -299 +327,3 @@ Job restartability relies on the ability for the scripts to register checkpoints - * Supported method: GET + * Supported method: POST + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN @@ -319,0 +350,2 @@ Job restartability relies on the ability for the scripts to register checkpoints +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -339 +371,3 @@ The job asynchronous execution relies on a dedicated pool of threads in the JVM. - * Supported method: GET + * Supported method: POST + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN @@ -343 +377 @@ The job asynchronous execution relies on a dedicated pool of threads in the JVM. - * Argument (integer): the new thread limit to apply. Must be a strictly positive integer. + * Argument (integer): the new thread limit to apply. **Input validation** : Must be between 1 and 1000 inclusive. @@ -358,0 +393,2 @@ Sample response: +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -379 +415,3 @@ The job executions information remain in the server memory as long as the server - * Supported method: GET + * Supported method: POST + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN @@ -383 +421 @@ The job executions information remain in the server memory as long as the server - * Arguments: a strictly positive integer value representing the age in hours of informations to be purged. + * Arguments: a strictly positive integer value representing the age in hours of informations to be purged. **Input validation** : Must be between 0 and 365 inclusive. @@ -397,0 +436,2 @@ The job executions information remain in the server memory as long as the server +**Input validation** : All metrics endpoints validate request parameters and return HTTP 400 Bad Request for invalid values. + @@ -403,0 +444,2 @@ This endpoint returns available metrics related to the JVM. +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -426,0 +469,2 @@ This endpoint returns metrics related to currently opened HTTP sessions. +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -441,0 +486,2 @@ This endpoint returns metrics related to currently opened HTTP sessions. +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -446 +492,3 @@ This endpoint returns metrics related to currently opened HTTP sessions. - * startTimestamp (optional, number): Starting timestamp for data filtering. + * startTimestamp (optional, number): Starting timestamp for data filtering. **Input validation** : Must be a valid numeric value. + + * endTimestamp (optional, number): Ending timestamp for data filtering. **Input validation** : Must be a valid numeric value. @@ -448 +496 @@ This endpoint returns metrics related to currently opened HTTP sessions. - * endTimestamp (optional, number): Ending timestamp for data filtering. + * page (optional, number): Page number for pagination. **Input validation** : Must be a positive integer. @@ -450 +498 @@ This endpoint returns metrics related to currently opened HTTP sessions. - * page (optional, number): Page number for pagination. + * pageSize (optional, number): Number of items per page in pagination. **Input validation** : Must be a strictly positive integer, maximum 500. @@ -452 +500 @@ This endpoint returns metrics related to currently opened HTTP sessions. - * pageSize (optional, number): Number of items per page in pagination. + * **Input validation** : Parameter map cannot exceed 20 entries @@ -476,0 +525,2 @@ This endpoint returns metrics related to currently opened HTTP sessions. +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -481 +531,3 @@ This endpoint returns metrics related to currently opened HTTP sessions. - * startTimestamp (optional, number): Starting timestamp for data filtering. + * startTimestamp (optional, number): Starting timestamp for data filtering. **Input validation** : Must be a valid numeric value. + + * endTimestamp (optional, number): Ending timestamp for data filtering. **Input validation** : Must be a valid numeric value. @@ -483 +535 @@ This endpoint returns metrics related to currently opened HTTP sessions. - * endTimestamp (optional, number): Ending timestamp for data filtering. + * page (optional, number): Page number for pagination. **Input validation** : Must be a positive integer. @@ -485 +537 @@ This endpoint returns metrics related to currently opened HTTP sessions. - * page (optional, number): Page number for pagination. + * pageSize (optional, number): Number of items per page in pagination. **Input validation** : Must be a strictly positive integer, maximum 500. @@ -487 +539 @@ This endpoint returns metrics related to currently opened HTTP sessions. - * pageSize (optional, number): Number of items per page in pagination. + * **Input validation** : Parameter map cannot exceed 20 entries @@ -534,0 +587,2 @@ Use these endpoints to list list registered programs or services, discover healt +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -545,0 +600,2 @@ Use these endpoints to list list registered programs or services, discover healt +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -561,0 +618,2 @@ Sample response: +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -572,0 +631,2 @@ Sample response: +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -587 +647,3 @@ Sample response: - * Supported methods: GET,POST + * Supported methods: POST + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER @@ -605 +667 @@ Sample response: - * `jicxa-xid` : The XID (X/Open transaction identifier XID structure) of a "global transaction" ([XA](https://en.wikipedia.org/wiki/X/Open_XA)), initiated by the caller, to which the current JICS transaction launch will participate. + * `jicxa-xid` : The XID (X/Open transaction identifier XID structure) of a "global transaction" ([XA](https://en.wikipedia.org/wiki/X/Open_XA)), initiated by the caller, to which the current JICS transaction launch will participate. **Input validation** : XID must not be blank and cannot exceed 255 characters. @@ -608,0 +671,2 @@ Sample response: + * **Input validation** : Invalid XID values (blank or exceeding 255 characters) will return HTTP 400 Bad Request with validation error details. + @@ -616 +680,3 @@ For more information about the details of the structure, see [Transaction launch - * supported methods: GET,POST + * supported methods: POST + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER @@ -643 +709 @@ The following header keys are being supported: - * `jicxa-xid` : The XID (X/Open transaction identifier XID structure) of a "global transaction" ([XA](https://en.wikipedia.org/wiki/X/Open_XA)), initiated by the caller, to which the current JICS transaction launch will participate. + * `jicxa-xid` : The XID (X/Open transaction identifier XID structure) of a "global transaction" ([XA](https://en.wikipedia.org/wiki/X/Open_XA)), initiated by the caller, to which the current JICS transaction launch will participate. **Input validation** : XID must not be blank and cannot exceed 255 characters. @@ -646,0 +713,2 @@ The following header keys are being supported: + * **Input validation** : Invalid XID values (blank or exceeding 255 characters) will return HTTP 400 Bad Request with validation error details. + @@ -652 +720,3 @@ The following header keys are being supported: - * supported methods: GET,POST + * supported methods: GET + +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN @@ -657,0 +728,2 @@ The following header keys are being supported: + * **Input validation** : Parameter map cannot exceed 20 entries + @@ -699,0 +772,2 @@ Operations on job queues are handled through the following dedicated endpoints. +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN, ROLE_USER + @@ -732,0 +807,2 @@ the job queue status cannot be determined. +Requires authentication and one of the following roles: ROLE_ADMIN, ROLE_SUPER_ADMIN + @@ -735 +811 @@ the job queue status cannot be determined.