AWS IAM documentation change
Summary
Major rewrite of IoT Device Defender setup script adding extensive error handling, JSON validation, retry logic, and improved resource management
Security assessment
The changes significantly improve the security posture of the example script by adding JSON validation for IAM policies, proper error handling, and safer resource management. It adds security documentation through enhanced validation of trust policies and mitigation policies, which prevents misconfigurations that could lead to security vulnerabilities. However, there's no evidence this addresses a specific security vulnerability or incident.
Diff
diff --git a/IAM/latest/UserGuide/iam_example_iot_GettingStarted_079_section.md b/IAM/latest/UserGuide/iam_example_iot_GettingStarted_079_section.md index e787a9b2a..9a77f8d1b 100644 --- a//IAM/latest/UserGuide/iam_example_iot_GettingStarted_079_section.md +++ b//IAM/latest/UserGuide/iam_example_iot_GettingStarted_079_section.md @@ -44,0 +45,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + set -euo pipefail + @@ -57 +59 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$1" | grep -i "An error occurred\|Exception\|Failed\|usage: aws" > /dev/null; then + if echo "$1" | grep -iE "An error occurred|Exception|Failed|usage: aws" > /dev/null; then @@ -65 +67,39 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to create IAM roles + # Function to safely extract JSON values using jq + extract_json_value() { + local json="$1" + local key="$2" + echo "$json" | jq -r ".${key} // empty" 2>/dev/null || echo "" + } + + # Function to validate JSON + validate_json() { + local json="$1" + echo "$json" | jq empty 2>/dev/null + } + + # Function to check AWS CLI availability + check_aws_cli() { + if ! command -v aws &> /dev/null; then + echo "ERROR: AWS CLI is not installed or not in PATH" + return 1 + fi + if ! command -v jq &> /dev/null; then + echo "ERROR: jq is not installed or not in PATH" + return 1 + fi + return 0 + } + + # Function to get AWS account ID + get_account_id() { + local account_id + account_id=$(aws sts get-caller-identity --query 'Account' --output text 2>/dev/null) || true + if [ -z "$account_id" ]; then + echo "ERROR: Could not retrieve AWS account ID" + return 1 + fi + echo "$account_id" + return 0 + } + + # Function to create IAM roles with retry logic @@ -69,0 +110,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local RETRY_COUNT=0 + local MAX_RETRIES=3 @@ -72,0 +115,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate trust policy JSON + if ! validate_json "$TRUST_POLICY"; then + echo "ERROR: Invalid trust policy JSON for role $ROLE_NAME" + return 1 + fi + @@ -74 +122,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - ROLE_EXISTS=$(aws iam get-role --role-name "$ROLE_NAME" 2>&1 || echo "NOT_EXISTS") + if aws iam get-role --role-name "$ROLE_NAME" >/dev/null 2>&1; then + echo "Role $ROLE_NAME already exists, skipping creation" + ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text 2>/dev/null) || true + if [ -z "$ROLE_ARN" ]; then + echo "ERROR: Could not retrieve ARN for existing role $ROLE_NAME" + return 1 + fi + echo "Role ARN: $ROLE_ARN" + return 0 + fi @@ -76,2 +133,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$ROLE_EXISTS" | grep -i "NoSuchEntity" > /dev/null; then - # Create the role with trust policy + # Create the role with trust policy and retry logic + while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do @@ -80 +137,12 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --assume-role-policy-document "$TRUST_POLICY" 2>&1) + --assume-role-policy-document "$TRUST_POLICY" 2>&1) || true + + if check_error "$ROLE_RESULT"; then + break + fi + + RETRY_COUNT=$((RETRY_COUNT + 1)) + if [ $RETRY_COUNT -lt $MAX_RETRIES ]; then + echo "Retrying role creation (attempt $((RETRY_COUNT + 1))/$MAX_RETRIES)..." + sleep $((RETRY_COUNT * 2)) + fi + done @@ -83 +151 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Failed to create role $ROLE_NAME" + echo "Failed to create role $ROLE_NAME after $MAX_RETRIES attempts" @@ -89 +157,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LOGGING_POLICY='{ + local LOGGING_POLICY + LOGGING_POLICY=$(cat <<'EOF' + { @@ -103,3 +173 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "Resource": [ - "arn:aws:logs:*:*:*" - ] + "Resource": "arn:aws:logs:*:*:*" @@ -108 +176,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) + + if ! validate_json "$LOGGING_POLICY"; then + echo "ERROR: Invalid logging policy JSON" + return 1 + fi @@ -113 +188 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --policy-document "$LOGGING_POLICY" 2>&1) + --policy-document "$LOGGING_POLICY" 2>&1) || true @@ -120 +195,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - MITIGATION_POLICY='{ + local MITIGATION_POLICY + MITIGATION_POLICY=$(cat <<'EOF' + { @@ -130,2 +207 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "iot:AddThingToThingGroup", - "iot:PublishToTopic" + "iot:AddThingToThingGroup" @@ -133 +209 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "Resource": "*" + "Resource": "arn:aws:iot:*:*:*" @@ -146 +222,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) + + if ! validate_json "$MITIGATION_POLICY"; then + echo "ERROR: Invalid mitigation policy JSON" + return 1 + fi @@ -151 +234 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --policy-document "$MITIGATION_POLICY" 2>&1) + --policy-document "$MITIGATION_POLICY" 2>&1) || true @@ -162 +245 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --policy-arn "$MANAGED_POLICY" 2>&1) + --policy-arn "$MANAGED_POLICY" 2>&1) || true @@ -172,3 +254,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "Role $ROLE_NAME already exists, skipping creation" - fi @@ -176,2 +256,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Get the role ARN - ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text) + # Get the role ARN with error handling + ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text 2>/dev/null) || true + if [ -z "$ROLE_ARN" ]; then + echo "ERROR: Could not retrieve ARN for newly created role $ROLE_NAME" + return 1 + fi @@ -184,0 +269,11 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate prerequisites + echo "Validating prerequisites..." + if ! check_aws_cli; then + echo "ERROR: Prerequisites not met" + exit 1 + fi + + ACCOUNT_ID=$(get_account_id) || exit 1 + echo "AWS Account ID: $ACCOUNT_ID" + echo "" + @@ -191 +286,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - IOT_DEFENDER_AUDIT_TRUST_POLICY='{ + IOT_DEFENDER_AUDIT_TRUST_POLICY=$(cat <<'EOF' + { @@ -202 +298,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) @@ -204 +302,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - create_iam_role "AWSIoTDeviceDefenderAuditRole" "$IOT_DEFENDER_AUDIT_TRUST_POLICY" "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderAudit" + if ! create_iam_role "AWSIoTDeviceDefenderAuditRole" "$IOT_DEFENDER_AUDIT_TRUST_POLICY" "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderAudit"; then + echo "ERROR: Failed to create audit role" + exit 1 + fi @@ -209 +310,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - IOT_LOGGING_TRUST_POLICY='{ + IOT_LOGGING_TRUST_POLICY=$(cat <<'EOF' + { @@ -220 +322,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) @@ -222 +326,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - create_iam_role "AWSIoTLoggingRole" "$IOT_LOGGING_TRUST_POLICY" "" + if ! create_iam_role "AWSIoTLoggingRole" "$IOT_LOGGING_TRUST_POLICY" ""; then + echo "ERROR: Failed to create logging role" + exit 1