AWS code-library high security documentation change
Summary
Enhanced AWS Batch Fargate example script with security hardening measures including input validation, output sanitization, secure defaults, and improved error handling
Security assessment
The changes implement multiple security improvements: 1) Added input validation/sanitization for container images to prevent command injection, 2) Set restrictive umask (0077) to protect file permissions, 3) Disabled public IP assignment reducing attack surface, 4) Implemented credential validation before execution, 5) Added output sanitization in logging to prevent log injection attacks. These directly address security vulnerabilities like command injection and insecure defaults.
Diff
diff --git a/code-library/latest/ug/bash_2_batch_code_examples.md b/code-library/latest/ug/bash_2_batch_code_examples.md index 130d185cc..89d6ff9a2 100644 --- a//code-library/latest/ug/bash_2_batch_code_examples.md +++ b//code-library/latest/ug/bash_2_batch_code_examples.md @@ -53 +53 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # AWS Batch Fargate Getting Started Script - Fixed Version + # AWS Batch Fargate Getting Started Script - Security Hardened Version @@ -57 +57 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -e # Exit on any error + set -euo pipefail # Exit on any error, undefined variables, and pipe failures @@ -69,0 +70,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Security: Set restrictive umask + umask 0077 + @@ -73 +76 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Logging function + # Logging function with sanitization @@ -75 +78,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" + local message="${1//[$'\t\r\n']/}" + echo "[$(date '+%Y-%m-%d %H:%M:%S')] ${message}" | tee -a "${LOG_FILE}" @@ -87 +91,9 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - trap 'handle_error $LINENO' ERR + trap 'handle_error ${LINENO}' ERR + + # Validate AWS credentials + validate_aws_credentials() { + if ! aws sts get-caller-identity &>/dev/null; then + log "ERROR: AWS credentials are not configured or invalid" + exit 1 + fi + } @@ -91,2 +103,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - local env_name=$1 - log "Waiting for compute environment $env_name to be VALID..." + local env_name="${1}" + local max_attempts=60 + local attempt=0 + + log "Waiting for compute environment ${env_name} to be VALID..." @@ -94,3 +109,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - local status=$(aws batch describe-compute-environments \ - --compute-environments "$env_name" \ + while [ ${attempt} -lt ${max_attempts} ]; do + local status + status=$(aws batch describe-compute-environments \ + --compute-environments "${env_name}" \ @@ -100,5 +116,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$status" = "VALID" ]; then - log "Compute environment $env_name is ready" - break - elif [ "$status" = "INVALID" ] || [ "$status" = "NOT_FOUND" ]; then - log "ERROR: Compute environment $env_name failed to create properly" + if [ "${status}" = "VALID" ]; then + log "Compute environment ${env_name} is ready" + return 0 + elif [ "${status}" = "INVALID" ] || [ "${status}" = "NOT_FOUND" ]; then + log "ERROR: Compute environment ${env_name} failed to create properly" @@ -108 +124 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log "Compute environment status: $status. Waiting 10 seconds..." + log "Compute environment status: ${status}. Waiting 10 seconds..." @@ -109,0 +126 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + ((attempt++)) @@ -110,0 +128,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + log "ERROR: Timeout waiting for compute environment ${env_name}" + return 1 @@ -115,2 +135,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - local queue_name=$1 - log "Waiting for job queue $queue_name to be VALID..." + local queue_name="${1}" + local max_attempts=60 + local attempt=0 + + log "Waiting for job queue ${queue_name} to be VALID..." @@ -118,3 +141,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - local state=$(aws batch describe-job-queues \ - --job-queues "$queue_name" \ + while [ ${attempt} -lt ${max_attempts} ]; do + local state + state=$(aws batch describe-job-queues \ + --job-queues "${queue_name}" \ @@ -124,5 +148,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$state" = "ENABLED" ]; then - log "Job queue $queue_name is ready" - break - elif [ "$state" = "DISABLED" ] || [ "$state" = "NOT_FOUND" ]; then - log "ERROR: Job queue $queue_name failed to create properly" + if [ "${state}" = "ENABLED" ]; then + log "Job queue ${queue_name} is ready" + return 0 + elif [ "${state}" = "DISABLED" ] || [ "${state}" = "NOT_FOUND" ]; then + log "ERROR: Job queue ${queue_name} failed to create properly" @@ -132 +156 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log "Job queue state: $state. Waiting 10 seconds..." + log "Job queue state: ${state}. Waiting 10 seconds..." @@ -133,0 +158 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + ((attempt++)) @@ -134,0 +160,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + log "ERROR: Timeout waiting for job queue ${queue_name}" + return 1 @@ -139,2 +167,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - local job_id=$1 - log "Waiting for job $job_id to complete..." + local job_id="${1}" + local max_attempts=120 + local attempt=0 + + log "Waiting for job ${job_id} to complete..." @@ -142,3 +173,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - local status=$(aws batch describe-jobs \ - --jobs "$job_id" \ + while [ ${attempt} -lt ${max_attempts} ]; do + local status + status=$(aws batch describe-jobs \ + --jobs "${job_id}" \ @@ -148,5 +180,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$status" = "SUCCEEDED" ]; then - log "Job $job_id completed successfully" - break - elif [ "$status" = "FAILED" ]; then - log "ERROR: Job $job_id failed" + if [ "${status}" = "SUCCEEDED" ]; then + log "Job ${job_id} completed successfully" + return 0 + elif [ "${status}" = "FAILED" ]; then + log "ERROR: Job ${job_id} failed" @@ -156 +188 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log "Job status: $status. Waiting 30 seconds..." + log "Job status: ${status}. Waiting 30 seconds..." @@ -157,0 +190 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + ((attempt++)) @@ -158,0 +192,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + log "ERROR: Timeout waiting for job ${job_id}" + return 1 @@ -161 +197 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # FIXED: Added function to wait for resource state before deletion + # Function to wait for resource state before deletion @@ -163,3 +199,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - local resource_type=$1 - local resource_name=$2 - local expected_state=$3 + local resource_type="${1}" + local resource_name="${2}" + local expected_state="${3}" @@ -169 +205 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log "Waiting for $resource_type $resource_name to reach state: $expected_state" + log "Waiting for ${resource_type} ${resource_name} to reach state: ${expected_state}" @@ -171 +207 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while [ $attempt -lt $max_attempts ]; do + while [ ${attempt} -lt ${max_attempts} ]; do @@ -174 +210 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - case $resource_type in + case "${resource_type}" in @@ -177 +213 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --job-queues "$resource_name" \ + --job-queues "${resource_name}" \ @@ -183 +219 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --compute-environments "$resource_name" \ + --compute-environments "${resource_name}" \ @@ -186,0 +223,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + *) + log "WARNING: Unknown resource type: ${resource_type}" + return 1 + ;; @@ -189,2 +229,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$current_state" = "$expected_state" ]; then - log "$resource_type $resource_name is now in state: $expected_state" + if [ "${current_state}" = "${expected_state}" ]; then + log "${resource_type} ${resource_name} is now in state: ${expected_state}" @@ -194 +234 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log "$resource_type $resource_name state: $current_state (waiting for $expected_state)" + log "${resource_type} ${resource_name} state: ${current_state} (waiting for ${expected_state})" @@ -199 +239 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log "WARNING: $resource_type $resource_name did not reach expected state after $max_attempts attempts" + log "WARNING: ${resource_type} ${resource_name} did not reach expected state after ${max_attempts} attempts" @@ -210,2 +250,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - local resource_type=$(echo "$resource" | cut -d: -f1) - local resource_name=$(echo "$resource" | cut -d: -f2) + local resource_type + local resource_name @@ -213 +253,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log "Cleaning up $resource_type: $resource_name" + resource_type=$(echo "${resource}" | cut -d: -f1) + resource_name=$(echo "${resource}" | cut -d: -f2-) @@ -215 +256,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - case $resource_type in + log "Cleaning up ${resource_type}: ${resource_name}" + + case "${resource_type}" in @@ -217,4 +260,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # FIXED: Validate state before deletion - aws batch update-job-queue --job-queue "$resource_name" --state DISABLED 2>/dev/null || true - wait_for_resource_state "JOB_QUEUE" "$resource_name" "DISABLED" || true - aws batch delete-job-queue --job-queue "$resource_name" 2>/dev/null || true