AWS systems-manager-automation-runbooks documentation change
Summary
Refactored the automation runbook to use AWS CloudFormation for resource provisioning instead of manual resource creation. Simplified steps by replacing individual resource creation/cleanup with stack operations, added IP validation, and restructured output handling.
Security assessment
The changes optimize resource management through CloudFormation but contain no evidence of addressing a specific security vulnerability. The IP validation improves input sanitization which is a general best practice, but not tied to a disclosed security issue. No security features are added or documented.
Diff
diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md b/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md index 557859c33..76e62385a 100644 --- a//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md +++ b//systems-manager-automation-runbooks/latest/userguide/automation-awssupport-setupipmonitoringfromvpc.md @@ -15,4 +14,0 @@ The CloudWatch Logs data can be used for network troubleshooting and analysis of -###### Note - -To clean up resources created by `AWSSupport-SetupIPMonitoringFromVPC`, you can use the runbook `AWSSupport-TerminateIPMonitoringFromVPC` . For more information, see [AWSSupport-TerminateIPMonitoringFromVPC](./automation-awssupport-terminateipmonitoringfromvpc.html) . - @@ -227,65 +223 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 1. **`aws:executeAwsApi` ** \- describe the provided subnet. - - 2. **`aws:branch` ** \- evaluate the TargetIPs input. - -(IPv6) If TargetIPs contains an IPv6: - -**`aws:assertAwsResourceProperty` ** \- check the provided subnet has an IPv6 pool associated - - 3. **`aws:executeScript` ** \- get the architecture of instance type and public parameter path for latest Amazon Linux 2 AMI. - - 4. **`aws:executeAwsApi` ** \- get the latest Amazon Linux 2 AMI from Parameter Store. - - 5. **`aws:executeAwsApi` ** \- create a security group for the test in the subnet's VPC. - -(Cleanup) If the security group creation fails: - -**`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 6. **`aws:executeAwsApi` ** \- allow all outbound traffic in the test security group. - -(Cleanup) If the security group egress rule creation fails: - -**`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 7. **`aws:executeAwsApi` ** \- create an IAM role for the test EC2 instance - -(Cleanup) If the role creation fails: - - 1. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation, if it exists. - - 2. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 8. **`aws:executeAwsApi` ** \- attach the AmazonSSMManagedInstanceCore managed policy - -(Cleanup) If the policy attachment fails: - - 1. **`aws:executeAwsApi` ** \- detach the AmazonSSMManagedInstanceCore managed policy from the role created by the automation, if attached. - - 2. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation. - - 3. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 9. **`aws:executeAwsApi` ** \- attach an inline policy to allow setting CloudWatch log group retentions and creating a CloudWatch dashboard - -(Cleanup) If the inline policy attachment fails: - - 1. **`aws:executeAwsApi` ** \- delete the CloudWatch inline policy from the role created by the automation, if created. - - 2. **`aws:executeAwsApi` ** \- detach the AmazonSSMManagedInstanceCore managed policy from the role created by the automation. - - 3. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation. - - 4. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 10. **`aws:executeAwsApi` ** \- create an IAM instance profile. - -(Cleanup) If the instance profile creation fails: - - 1. **`aws:executeAwsApi` ** \- delete the IAM instance profile created by the automation, if it exists. - - 2. **`aws:executeAwsApi` ** \- delete the CloudWatch inline policy from the role created by the automation. - - 3. **`aws:executeAwsApi` ** \- delete the AmazonSSMManagedInstanceCore managed policy from the role created by the automation. - - 4. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation. + 1. **`aws:executeAwsApi` ** \- describe the provided subnet to get the VPC ID and IPv6 CIDR block association state. @@ -293 +225 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 5. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. + 2. **`aws:executeScript` ** \- validate the provided target IPs are syntactically correct IPv4 and/or IPv6 addresses, get the architecture of the selected instance type, and verify the subnet has an IPv6 pool association if any target IP is IPv6. @@ -295,19 +227 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 11. **`aws:executeAwsApi` ** \- associate the IAM instance profile to the IAM role. - -(Cleanup) If the instance profile and role association fails: - - 1. **`aws:executeAwsApi` ** \- remove the IAM instance profile from the role, if associated. - - 2. **`aws:executeAwsApi` ** \- delete the IAM instance profile created by the automation. - - 3. **`aws:executeAwsApi` ** \- delete the CloudWatch inline policy from the role created by the automation. - - 4. **`aws:executeAwsApi` ** \- detach the AmazonSSMManagedInstanceCore managed policy from the role created by the automation. - - 5. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation. - - 6. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 12. **`aws:sleep` ** \- wait for the instance profile to become available. - - 13. **`aws:runInstances` ** \- create the test instance in the specified subnet, and with the instance profile created earlier attached. + 3. **`aws:createStack` ** \- create an AWS CloudFormation stack that provisions the test Amazon EC2 instance, IAM instance profile (if not provided), security group (if not provided), CloudWatch log groups, and CloudWatch dashboard. @@ -317,17 +231 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 1. **`aws:changeInstanceState` ** \- terminate the test instance. - - 2. **`aws:executeAwsApi` ** \- remove the IAM instance profile from the role. - - 3. **`aws:executeAwsApi` ** \- delete the IAM instance profile created by the automation. - - 4. **`aws:executeAwsApi` ** \- delete the CloudWatch inline policy from the role created by the automation. - - 5. **`aws:executeAwsApi` ** \- detach the AmazonSSMManagedInstanceCore managed policy from the role created by the automation. - - 6. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation. - - 7. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 14. **`aws:branch` ** \- evaluate the TargetIPs input. - -(IPv6) If TargetIPs contains an IPv6: +**`aws:executeScript` ** \- describe the CloudFormation stack events to identify the failure reason. @@ -335 +233 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis -**`aws:executeAwsApi` ** \- assign an IPv6 to the test instance. +**`aws:deleteStack` ** \- delete the CloudFormation stack and all associated resources. @@ -337 +235 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 15. **`aws:waitForAwsResourceProperty` ** \- wait for the test instance to become a managed instance. + 4. **`aws:waitForAwsResourceProperty` ** \- wait for the CloudFormation stack to complete creation. @@ -341 +239 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 1. **`aws:changeInstanceState` ** \- terminate the test instance. +**`aws:executeScript` ** \- describe the CloudFormation stack events to identify the failure reason. @@ -343 +241 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 2. **`aws:executeAwsApi` ** \- remove the IAM instance profile from the role. +**`aws:deleteStack` ** \- delete the CloudFormation stack and all associated resources. @@ -345,11 +243 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 3. **`aws:executeAwsApi` ** \- delete the IAM instance profile created by the automation. - - 4. **`aws:executeAwsApi` ** \- delete the CloudWatch inline policy from the role created by the automation. - - 5. **`aws:executeAwsApi` ** \- detach the AmazonSSMManagedInstanceCore managed policy from the role created by the automation. - - 6. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation. - - 7. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 16. **`aws:runCommand` ** \- install test pre-requisites: + 5. **`aws:executeScript` ** \- describe the CloudFormation stack resources to get the test instance ID, security group ID, IAM role, instance profile, and dashboard name. @@ -359,9 +247 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 1. **`aws:changeInstanceState` ** \- terminate the test instance. - - 2. **`aws:executeAwsApi` ** \- remove the IAM instance profile from the role. - - 3. **`aws:executeAwsApi` ** \- delete the IAM instance profile created by the automation. - - 4. **`aws:executeAwsApi` ** \- delete the CloudWatch inline policy from the role created by the automation. - - 5. **`aws:executeAwsApi` ** \- detach the AmazonSSMManagedInstanceCore managed policy from the role created by the automation. +**`aws:executeScript` ** \- describe the CloudFormation stack events to identify the failure reason. @@ -369 +249 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 6. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation. +**`aws:deleteStack` ** \- delete the CloudFormation stack and all associated resources. @@ -371,3 +251 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 7. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 17. **`aws:runCommand` ** \- validate the provided IPs are syntactically correct IPv4 and/or IPv6 addresses: + 6. **`aws:waitForAwsResourceProperty` ** \- wait for the test instance to become a managed instance. @@ -377,7 +255 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 1. **`aws:changeInstanceState` ** \- terminate the test instance. - - 2. **`aws:executeAwsApi` ** \- remove the IAM instance profile from the role. - - 3. **`aws:executeAwsApi` ** \- delete the IAM instance profile created by the automation. - - 4. **`aws:executeAwsApi` ** \- delete the CloudWatch inline policy from the role created by the automation. +**`aws:deleteStack` ** \- delete the CloudFormation stack and all associated resources. @@ -385,7 +257 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 5. **`aws:executeAwsApi` ** \- detach the AmazonSSMManagedInstanceCore managed policy from the role created by the automation. - - 6. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation. - - 7. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 18. **`aws:runCommand` ** \- define the MTR test for each of the provided IPs. + 7. **`aws:runCommand` ** \- install the CloudWatch agent on the test instance. @@ -395,3 +261 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 1. **`aws:changeInstanceState` ** \- terminate the test instance. - - 2. **`aws:executeAwsApi` ** \- remove the IAM instance profile from the role. +**`aws:deleteStack` ** \- delete the CloudFormation stack and all associated resources. @@ -399,11 +263 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis - 3. **`aws:executeAwsApi` ** \- delete the IAM instance profile created by the automation. - - 4. **`aws:executeAwsApi` ** \- delete the CloudWatch inline policy from the role created by the automation. - - 5. **`aws:executeAwsApi` ** \- detach the AmazonSSMManagedInstanceCore managed policy from the role created by the automation. - - 6. **`aws:executeAwsApi` ** \- delete the IAM role created by the automation. - - 7. **`aws:executeAwsApi` ** \- delete the security group created by the automation, if it exists. - - 19. **`aws:runCommand` ** \- define the first ping test for each of the provided IPs. + 8. **`aws:runCommand` ** \- define the network test scripts (MTR, ping, tracepath, and traceroute) for each of the provided IPs. @@ -413,9 +267 @@ If the `TestInstanceProfileName` parameter is provided, the following IAM permis