AWS code-library documentation change
Summary
Enhanced bash script for AWS MediaConnect with security hardening: added input validation, permission restrictions, error handling improvements, and automatic cleanup.
Security assessment
The changes implement security best practices including strict file permissions (umask 0077, chmod 600), input validation for ARNs/regions/AZs, safer JSON parsing, and AWS credential checks. While these improve security posture, there's no evidence of addressing a specific vulnerability.
Diff
diff --git a/code-library/latest/ug/bash_2_mediaconnect_code_examples.md b/code-library/latest/ug/bash_2_mediaconnect_code_examples.md index baa026072..ae0be06ed 100644 --- a//code-library/latest/ug/bash_2_mediaconnect_code_examples.md +++ b//code-library/latest/ug/bash_2_mediaconnect_code_examples.md @@ -55 +55,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Set up logging + set -euo pipefail + + # Security: Restrict umask to prevent world-readable files + umask 0077 + + # Set up logging with restricted permissions @@ -56,0 +62,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + touch "$LOG_FILE" + chmod 600 "$LOG_FILE" @@ -64 +71 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "ERROR: $1" + echo "ERROR: $1" >&2 @@ -69,0 +77,45 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Function to validate AWS CLI is available + validate_aws_cli() { + if ! command -v aws &> /dev/null; then + handle_error "AWS CLI is not installed or not in PATH" + fi + + # Security: Verify AWS CLI version is recent + local aws_version + aws_version=$(aws --version 2>&1 | head -1) + echo "AWS CLI version: $aws_version" + + if ! aws sts get-caller-identity &> /dev/null; then + handle_error "AWS credentials are not configured or invalid" + fi + + # Security: Validate caller identity + local account_id + account_id=$(aws sts get-caller-identity --query Account --output text 2>/dev/null) + if [ -z "$account_id" ]; then + handle_error "Failed to retrieve AWS account ID" + fi + echo "AWS Account ID: $account_id" + } + + # Function to safely extract JSON values using jq (preferred) or fallback + extract_json_value() { + local json_output="$1" + local key="$2" + + if [ -z "$json_output" ]; then + return 1 + fi + + # Security: Use jq if available for safer JSON parsing + if command -v jq &> /dev/null; then + echo "$json_output" | jq -r ".${key} // empty" 2>/dev/null || return 1 + else + # Fallback with additional validation + if ! echo "$json_output" | grep -q "\"$key\""; then + return 1 + fi + echo "$json_output" | grep -o "\"$key\": \"[^\"]*" | head -1 | cut -d'"' -f4 + fi + } + @@ -74 +126,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$FLOW_ARN" ]; then + if [ -n "${FLOW_ARN:-}" ]; then + # Security: Validate ARN format before using it + if [[ ! "$FLOW_ARN" =~ ^arn:aws:mediaconnect:[a-z0-9-]+:[0-9]+:flow:[a-zA-Z0-9:-]+$ ]]; then + echo "WARNING: Invalid Flow ARN format, skipping cleanup: $FLOW_ARN" + return 1 + fi + @@ -77,2 +135,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - FLOW_STATUS_OUTPUT=$(aws mediaconnect describe-flow --flow-arn "$FLOW_ARN" --query "Flow.Status" --output text 2>&1) - echo "Current flow status: $FLOW_STATUS_OUTPUT" + local flow_status_output + if flow_status_output=$(aws mediaconnect describe-flow --flow-arn "$FLOW_ARN" --query "Flow.Status" --output text 2>&1); then + echo "Current flow status: $flow_status_output" @@ -80 +139 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$FLOW_STATUS_OUTPUT" == "ACTIVE" ] || [ "$FLOW_STATUS_OUTPUT" == "UPDATING" ]; then + if [ "$flow_status_output" == "ACTIVE" ] || [ "$flow_status_output" == "UPDATING" ]; then @@ -82,7 +141 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - STOP_FLOW_OUTPUT=$(aws mediaconnect stop-flow --flow-arn "$FLOW_ARN" 2>&1) - if echo "$STOP_FLOW_OUTPUT" | grep -i "error" > /dev/null; then - echo "WARNING: Failed to stop flow. Output: $STOP_FLOW_OUTPUT" - echo "Attempting to delete anyway..." - else - echo "$STOP_FLOW_OUTPUT" - + if aws mediaconnect stop-flow --flow-arn "$FLOW_ARN" 2>&1; then @@ -91,0 +145,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + else + echo "WARNING: Failed to stop flow. Attempting to delete anyway..." @@ -99,4 +154,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - DELETE_FLOW_OUTPUT=$(aws mediaconnect delete-flow --flow-arn "$FLOW_ARN" 2>&1) - if echo "$DELETE_FLOW_OUTPUT" | grep -i "error" > /dev/null; then - echo "WARNING: Failed to delete flow. Output: $DELETE_FLOW_OUTPUT" - echo "You may need to manually delete the flow from the AWS console." + if aws mediaconnect delete-flow --flow-arn "$FLOW_ARN" 2>&1; then + echo "Flow deleted successfully" @@ -104 +157,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$DELETE_FLOW_OUTPUT" + echo "WARNING: Failed to delete flow. You may need to manually delete it from the AWS console." + fi + else + echo "WARNING: Could not check flow status" @@ -108,0 +165,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Set trap to cleanup on script exit + trap cleanup_resources EXIT + + # Validate AWS CLI setup + validate_aws_cli + @@ -110,2 +172,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - AWS_REGION=$(aws configure get region) - if [ -z "$AWS_REGION" ]; then + aws_region="" + if aws_region=$(aws configure get region 2>/dev/null); then + if [ -z "$aws_region" ]; then @@ -113,0 +177,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + else + handle_error "Failed to retrieve AWS region configuration" + fi + + # Security: Validate region format + if [[ ! "$aws_region" =~ ^[a-z]{2}-[a-z]+-[0-9]$ ]]; then + handle_error "Invalid AWS region format: $aws_region" + fi + + AWS_REGION="$aws_region" @@ -118,3 +191,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - AZ_OUTPUT=$(aws ec2 describe-availability-zones --region "$AWS_REGION" --query "AvailabilityZones[0].ZoneName" --output text 2>&1) - if echo "$AZ_OUTPUT" | grep -i "error" > /dev/null; then - handle_error "Failed to get availability zones. Output: $AZ_OUTPUT" + az_output="" + if az_output=$(aws ec2 describe-availability-zones --region "$AWS_REGION" --query "AvailabilityZones[0].ZoneName" --output text 2>&1); then + AVAILABILITY_ZONE="$az_output" + if [ -z "$AVAILABILITY_ZONE" ]; then + handle_error "Failed to retrieve availability zones" + fi + + # Security: Validate AZ format + if [[ ! "$AVAILABILITY_ZONE" =~ ^[a-z]{2}-[a-z]+-[0-9][a-z]$ ]]; then + handle_error "Invalid availability zone format: $AVAILABILITY_ZONE" @@ -122 +202 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - AVAILABILITY_ZONE="$AZ_OUTPUT" + @@ -123,0 +204,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + else + handle_error "Failed to get availability zones" + fi @@ -140,3 +223,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LIST_FLOWS_OUTPUT=$(aws mediaconnect list-flows 2>&1) - if echo "$LIST_FLOWS_OUTPUT" | grep -i "error" > /dev/null; then - handle_error "Failed to list flows. Please check your AWS credentials and permissions. Output: $LIST_FLOWS_OUTPUT" + list_flows_output="" + if list_flows_output=$(aws mediaconnect list-flows 2>&1); then + echo "$list_flows_output" + else + handle_error "Failed to list flows. Please check your AWS credentials and permissions." @@ -144 +228,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$LIST_FLOWS_OUTPUT" @@ -148 +232,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - CREATE_FLOW_OUTPUT=$(aws mediaconnect create-flow \ + create_flow_output="" + if create_flow_output=$(aws mediaconnect create-flow \ @@ -151,4 +236,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --source "Name=$SOURCE_NAME,Protocol=zixi-push,WhitelistCidr=10.24.34.0/23,StreamId=ZixiAwardsNYCFeed" 2>&1) - - if echo "$CREATE_FLOW_OUTPUT" | grep -i "error" > /dev/null; then - handle_error "Failed to create flow. Output: $CREATE_FLOW_OUTPUT" + --source "Name=$SOURCE_NAME,Protocol=zixi-push,WhitelistCidr=10.24.34.0/23,StreamId=ZixiAwardsNYCFeed" 2>&1); then + echo "$create_flow_output" + else + handle_error "Failed to create flow" @@ -156 +240,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$CREATE_FLOW_OUTPUT" @@ -159 +243,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - FLOW_ARN=$(echo "$CREATE_FLOW_OUTPUT" | grep -o '"FlowArn": "[^"]*' | cut -d'"' -f4) + FLOW_ARN=$(echo "$create_flow_output" | jq -r '.Flow.FlowArn // empty' 2>/dev/null) + if [ -z "$FLOW_ARN" ]; then + FLOW_ARN=$(echo "$create_flow_output" | grep -o '"FlowArn": "[^"]*' | head -1 | cut -d'"' -f4) + fi @@ -164,0 +252,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate flow ARN format + if [[ ! "$FLOW_ARN" =~ ^arn:aws:mediaconnect:[a-z0-9-]+:[0-9]+:flow:[a-zA-Z0-9:-]+$ ]]; then + handle_error "Invalid Flow ARN format: $FLOW_ARN" + fi + @@ -167 +259,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - ADD_OUTPUT_OUTPUT=$(aws mediaconnect add-flow-outputs \ + add_output_output="" + if add_output_output=$(aws mediaconnect add-flow-outputs \ @@ -169,4 +262,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --outputs "Name=$OUTPUT_NAME,Protocol=zixi-push,Destination=198.51.100.11,Port=1024,StreamId=ZixiAwardsOutput" 2>&1) - - if echo "$ADD_OUTPUT_OUTPUT" | grep -i "error" > /dev/null; then - handle_error "Failed to add output to flow. Output: $ADD_OUTPUT_OUTPUT" + --outputs "Name=$OUTPUT_NAME,Protocol=zixi-push,Destination=198.51.100.11,Port=1024,StreamId=ZixiAwardsOutput" 2>&1); then