AWS code-library medium security documentation change
Summary
Added security hardening measures in bash script examples: secure log file permissions, error handling improvements, AWS CLI validation, sensitive data handling, and automated resource cleanup
Security assessment
Added 'chmod 600' for log files to restrict access (security control), removed sensitive CVV2 value from logs (data protection), added AWS CLI credential validation (access control), and implemented strict error handling. These changes directly address security concerns like credential exposure, unauthorized log access, and incomplete error handling.
Diff
diff --git a/code-library/latest/ug/bash_2_payment-cryptography_code_examples.md b/code-library/latest/ug/bash_2_payment-cryptography_code_examples.md index adc944b1a..f5deaac0b 100644 --- a//code-library/latest/ug/bash_2_payment-cryptography_code_examples.md +++ b//code-library/latest/ug/bash_2_payment-cryptography_code_examples.md @@ -53 +53,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Initialize log file + set -euo pipefail + + # Initialize log file with secure permissions @@ -55 +57,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "AWS Payment Cryptography Tutorial - $(date)" > $LOG_FILE + touch "$LOG_FILE" + chmod 600 "$LOG_FILE" + echo "AWS Payment Cryptography Tutorial - $(date)" > "$LOG_FILE" @@ -60 +64 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$(date +"%Y-%m-%d %H:%M:%S") - $message" | tee -a $LOG_FILE + echo "$(date +"%Y-%m-%d %H:%M:%S") - $message" | tee -a "$LOG_FILE" @@ -77 +81 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$KEY_ARN" ]; then + if [ -n "${KEY_ARN:-}" ]; then @@ -89,2 +93,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$output" | grep -i "error\|exception\|fail" > /dev/null; then - handle_error "Command failed: $command. Output: $output" + if echo "$output" | grep -iq "error\|exception\|fail"; then + handle_error "Command failed: $command" @@ -93,0 +98,9 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate AWS CLI is available and credentials are configured + if ! command -v aws &> /dev/null; then + handle_error "AWS CLI is not installed or not in PATH" + fi + + if ! aws sts get-caller-identity &> /dev/null; then + handle_error "AWS credentials are not properly configured" + fi + @@ -98 +111 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - KEY_OUTPUT=$(aws payment-cryptography create-key \ + if ! KEY_OUTPUT=$(aws payment-cryptography create-key \ @@ -100 +113,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --key-attributes KeyAlgorithm=TDES_2KEY,KeyUsage=TR31_C0_CARD_VERIFICATION_KEY,KeyClass=SYMMETRIC_KEY,KeyModesOfUse='{Generate=true,Verify=true}' 2>&1) + --key-attributes KeyAlgorithm=TDES_2KEY,KeyUsage=TR31_C0_CARD_VERIFICATION_KEY,KeyClass=SYMMETRIC_KEY,KeyModesOfUse='{Generate=true,Verify=true}' 2>&1); then + handle_error "Failed to create key" + fi @@ -116 +131 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - CVV2_OUTPUT=$(aws payment-cryptography-data generate-card-validation-data \ + if ! CVV2_OUTPUT=$(aws payment-cryptography-data generate-card-validation-data \ @@ -119 +134,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --generation-attributes CardVerificationValue2={CardExpiryDate=0123} 2>&1) + --generation-attributes CardVerificationValue2={CardExpiryDate=0123} 2>&1); then + handle_error "Failed to generate CVV2 value" + fi @@ -131 +148 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log "Successfully generated CVV2 value: $CVV2_VALUE" + log "Successfully generated CVV2 value" @@ -135 +152 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VERIFY_OUTPUT=$(aws payment-cryptography-data verify-card-validation-data \ + if ! VERIFY_OUTPUT=$(aws payment-cryptography-data verify-card-validation-data \ @@ -139 +156,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --validation-data "$CVV2_VALUE" 2>&1) + --validation-data "$CVV2_VALUE" 2>&1); then + handle_error "Failed to verify CVV2 value" + fi @@ -148 +167 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - NEGATIVE_OUTPUT=$(aws payment-cryptography-data verify-card-validation-data \ + if aws payment-cryptography-data verify-card-validation-data \ @@ -152,5 +171 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --validation-data 999 2>&1 || echo "Expected error: Verification failed") - - echo "$NEGATIVE_OUTPUT" - - if ! echo "$NEGATIVE_OUTPUT" | grep -i "fail\|error" > /dev/null; then + --validation-data 999 2>&1; then @@ -170 +185 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Prompt for cleanup + # Auto-confirm cleanup @@ -174,2 +189 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Do you want to clean up all created resources? (y/n): " - read -r CLEANUP_CHOICE + echo "Proceeding with cleanup of all created resources..." @@ -177 +190,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [[ "$CLEANUP_CHOICE" =~ ^[Yy]$ ]]; then @@ -182,2 +195,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - DELETE_OUTPUT=$(aws payment-cryptography delete-key \ - --key-identifier "$KEY_ARN" 2>&1) + if ! DELETE_OUTPUT=$(aws payment-cryptography delete-key \ + --key-identifier "$KEY_ARN" 2>&1); then + handle_error "Failed to delete key" + fi @@ -199,8 +213,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - log "Cleanup skipped. Resources were not deleted." - echo "" - echo "===========================================" - echo "CLEANUP SKIPPED" - echo "===========================================" - echo "Resources were not deleted. You can manually delete them later." - fi