AWS systems-manager-automation-runbooks medium security documentation change
Summary
Added input validation patterns and constraints for multiple parameters including IAM role ARNs, package names, instance profile names, security group IDs, AMI IDs, and URLs. Enforced regex patterns and format requirements for automation inputs.
Security assessment
Added strict input validation patterns to prevent malformed/invalid inputs. Security implications include preventing potential injection attacks via invalid package names/scripts, enforcing proper IAM role formats, and validating security group/AMI identifiers. The URL pattern restriction to HTTPS/none reduces risk of insecure script execution.
Diff
diff --git a/systems-manager-automation-runbooks/latest/userguide/automation-aws-updatelinuxami.md b/systems-manager-automation-runbooks/latest/userguide/automation-aws-updatelinuxami.md index 39b8f7de5..fb9b54d79 100644 --- a//systems-manager-automation-runbooks/latest/userguide/automation-aws-updatelinuxami.md +++ b//systems-manager-automation-runbooks/latest/userguide/automation-aws-updatelinuxami.md @@ -32,0 +33,4 @@ Description: (Optional) The Amazon Resource Name (ARN) of the AWS Identity and A +Allowed Pattern: `^$|^arn:aws[a-z0-9-]*:iam::(\d{12}|\{\{global:ACCOUNT_ID\}\}):role/[\w/.@+=,-]{1,1017}$` + + * Must be a valid IAM role ARN or an empty string. System variable `{{global:ACCOUNT_ID}}` can be used in place of the AWS Account ID in the arn. + @@ -40,0 +45,4 @@ Description: (Optional) Names of packages to hold back from updates, under all c +Allowed Pattern: `^(none|[a-zA-Z0-9\s,._+:=<>()\[\]/*-]+)$` + + * Must be "none" OR a comma-separated list of items consisting of letters, numbers, spaces, and the following characters: `, . _ + : = < > ( ) [ ] / * -` + @@ -48,0 +57,4 @@ Description: (Required) The instance profile that enables Systems Manager to man +Allowed Pattern: `^[\w+=,.@-]{1,128}$` + + * Must be between 1 and 128 characters and contain only letters, numbers, and these characters: `+ = , . @ - _` + @@ -56,0 +69,4 @@ Description: (Optional) Only update these named packages. By default ("all"), al +Allowed Pattern: `^(all|[a-zA-Z0-9\s,._+:=<>()\[\]/*-]+)$` + + * Must be "all" OR a comma-separated list of items consisting of letters, numbers, spaces, and the following characters: `, . _ + : = < > ( ) [ ] / * -` + @@ -64,0 +81,4 @@ Description: (Optional) Type of instance to launch as the workspace host. Instan +Allowed Pattern: `^[a-z0-9]+(-[a-z0-9]+)*\.[a-z0-9]+$` + + * Must be in the format prefix.suffix where both parts contain lowercase letters and numbers, and the prefix may include hyphens + @@ -72,0 +93,4 @@ Description: (Optional) The metadata options for the instance. For more informat +Allowed Pattern: `^\{[^<>\$;|&\\]*\}$` + + * Must be wrapped in curly braces { } and cannot contain these characters: `< > $ ; | & \` + @@ -80,0 +105,4 @@ Description: (Optional) URL of a script to run after package updates are applied +Allowed Pattern: `^(none|https?://[\w\-._~:/?#\[\]@!$&'()*+,;=%]+)$` + + * Must be "none" OR a valid HTTP/HTTPS URL + @@ -88,0 +117,4 @@ Description: (Optional) URL of a script to run before updates are applied. Defau +Allowed Pattern: `^(none|https?://[\w\-._~:/?#\[\]@!$&'()*+,;=%]+)$` + + * Must be "none" OR a valid HTTP/HTTPS URL + @@ -94,0 +127,4 @@ Description: (Required) A comma separated list of the IDs of the security groups +Allowed Pattern: `^sg-[a-z0-9]{8,17}$` + + * Must start with "sg-" followed by 8-17 lowercase letters or numbers + @@ -100,0 +137,4 @@ Description: (Required) The source Amazon Machine Image ID. +Allowed Pattern: `^ami-[a-z0-9]{8,17}$` + + * Must start with "ami-" followed by 8-17 lowercase letters or numbers + @@ -106,0 +147,4 @@ Description: (Optional) The ID of the subnet you want to launch the instance int +Allowed Pattern: `^$|^subnet-[a-z0-9]{8,17}$` + + * Must be empty OR start with "subnet-" followed by 8-17 lowercase letters or numbers + @@ -114,0 +159,4 @@ Description: (Optional) The name of the new AMI that will be created. Default is +Allowed Pattern: `^[a-zA-Z0-9()\[\]\{\} ./'@_:-]{3,128}$` + + * Must be between 3 and 128 characters and contain only letters, numbers, spaces, and these characters: `( ) [ ] { } . / ' @ _ : -` +