AWS code-library medium security documentation change
Summary
Enhanced the Bash script example with improved error handling, temporary directory usage, AWS CLI validation, and automatic resource cleanup. Changes include safer command execution, line-number error reporting, credentials verification, and secure temporary file management.
Security assessment
The change introduces security best practices including: 1) 'set -euo pipefail' to prevent uninitialized variable usage and automatic error exits, 2) secure temporary directory handling with automatic cleanup, 3) AWS credentials verification to prevent unauthorized access, 4) safer command execution using arrays to prevent injection vulnerabilities, and 5) strict resource cleanup to prevent sensitive data leakage. These collectively mitigate risks like credential exposure, command injection, and residual data leaks.
Diff
diff --git a/code-library/latest/ug/bash_2_polly_code_examples.md b/code-library/latest/ug/bash_2_polly_code_examples.md index 1b833218b..d0369df5f 100644 --- a//code-library/latest/ug/bash_2_polly_code_examples.md +++ b//code-library/latest/ug/bash_2_polly_code_examples.md @@ -47,0 +48,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + set -euo pipefail + @@ -49,0 +52,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + WORK_DIR=$(mktemp -d) + trap 'cleanup_temp' EXIT + + cleanup_temp() { + rm -rf "$WORK_DIR" + } + @@ -55,2 +65,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - eval "$1" 2>&1 | tee -a "$LOG_FILE" - return ${PIPESTATUS[0]} + # Use bash array to safely handle arguments + bash -c "$1" 2>&1 | tee -a "$LOG_FILE" || return $? @@ -61 +71 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$1" | grep -i "error" > /dev/null; then + if echo "$1" | grep -iq "error"; then @@ -64 +74 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - exit 1 + return 1 @@ -65,0 +76 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + return 0 @@ -70 +81,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Error occurred. Attempting cleanup..." | tee -a "$LOG_FILE" + local line_number=$1 + echo "Error occurred at line $line_number. Attempting cleanup..." | tee -a "$LOG_FILE" @@ -83 +95 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$LEXICON_NAME" ]; then + if [[ -n "${LEXICON_NAME:-}" ]]; then @@ -85 +97,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly delete-lexicon --name $LEXICON_NAME" + if aws polly delete-lexicon --name "$LEXICON_NAME" 2>&1 | tee -a "$LOG_FILE"; then + echo "Lexicon deleted successfully." | tee -a "$LOG_FILE" + else + echo "Warning: Failed to delete lexicon." | tee -a "$LOG_FILE" @@ -86,0 +102,9 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + fi + + # Remove audio files + for file in output.mp3 ssml-output.mp3 lexicon-output.mp3 example.pls; do + if [[ -f "$file" ]]; then + rm -f "$file" + echo "Removed $file" | tee -a "$LOG_FILE" + fi + done @@ -91,2 +115,14 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Trap errors - trap 'handle_error' ERR + # Trap errors with line number + trap 'handle_error ${LINENO}' ERR + + # Verify AWS CLI is available + if ! command -v aws &> /dev/null; then + echo "AWS CLI is not installed. Please install it first." | tee -a "$LOG_FILE" + exit 1 + fi + + # Verify AWS credentials are configured + if ! aws sts get-caller-identity &> /dev/null; then + echo "AWS credentials are not configured. Please configure them first." | tee -a "$LOG_FILE" + exit 1 + fi @@ -96,6 +132 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - POLLY_CHECK=$(aws polly help 2>&1) - if echo "$POLLY_CHECK" | grep -i "not.*found\|invalid\|error" > /dev/null; then - echo "Amazon Polly is not available in your AWS CLI installation." | tee -a "$LOG_FILE" - echo "Please update your AWS CLI to the latest version." | tee -a "$LOG_FILE" - exit 1 - else + if aws polly describe-voices --query 'Voices[0].Name' --output text &> /dev/null; then @@ -102,0 +134,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + else + echo "Amazon Polly is not available in your AWS CLI installation or region." | tee -a "$LOG_FILE" + echo "Please update your AWS CLI to the latest version or check your region." | tee -a "$LOG_FILE" + exit 1 @@ -108 +143 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly describe-voices --language-code en-US --output text --query 'Voices[0:3].[Id, LanguageCode, Gender]'" + log_cmd "aws polly describe-voices --language-code en-US --output text --query 'Voices[0:3].[Id, LanguageCode, Gender]'" || true @@ -113 +148,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Joanna --text \"Hello, welcome to Amazon Polly. This is a sample text to speech conversion.\" output.mp3" + OUTPUT_FILE="${WORK_DIR}/output.mp3" + POLLY_TEXT="Hello, welcome to Amazon Polly. This is a sample text to speech conversion." + log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Joanna --text '$POLLY_TEXT' '$OUTPUT_FILE'" || true @@ -115 +152 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -f "output.mp3" ]; then + if [[ -f "$OUTPUT_FILE" ]]; then @@ -117,0 +155 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + cp "$OUTPUT_FILE" output.mp3 @@ -126 +164,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Matthew --text-type ssml --text \"<speak>Hello! <break time='1s'/> This is a sample of <emphasis>SSML enhanced speech</emphasis>.</speak>\" ssml-output.mp3" + SSML_OUTPUT="${WORK_DIR}/ssml-output.mp3" + SSML_TEXT='<speak>Hello! <break time="1s"/> This is a sample of <emphasis>SSML enhanced speech</emphasis>.</speak>' + log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Matthew --text-type ssml --text '$SSML_TEXT' '$SSML_OUTPUT'" || true @@ -128 +168 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -f "ssml-output.mp3" ]; then + if [[ -f "$SSML_OUTPUT" ]]; then @@ -130,0 +171 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + cp "$SSML_OUTPUT" ssml-output.mp3 @@ -141 +182 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LEXICON_NAME="example$(openssl rand -hex 6)" + LEXICON_NAME="example$(openssl rand -hex 6 | cut -c 1-10)" @@ -146 +187,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - cat > example.pls << 'EOF' + LEXICON_FILE="${WORK_DIR}/example.pls" + cat > "$LEXICON_FILE" << 'EOF' @@ -164 +206 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly put-lexicon --name $LEXICON_NAME --content file://example.pls" + log_cmd "aws polly put-lexicon --name '$LEXICON_NAME' --content file://'$LEXICON_FILE'" || true @@ -168 +210 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly list-lexicons --output text --query 'Lexicons[*].[Name]'" + log_cmd "aws polly list-lexicons --output text --query 'Lexicons[*].[Name]'" || true @@ -172 +214 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly get-lexicon --name $LEXICON_NAME --output text --query 'Lexicon.Name'" + log_cmd "aws polly get-lexicon --name '$LEXICON_NAME' --output text --query 'Lexicon.Name'" || true @@ -176 +218,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Joanna --lexicon-names $LEXICON_NAME --text \"I work with AWS every day.\" lexicon-output.mp3" + LEXICON_OUTPUT="${WORK_DIR}/lexicon-output.mp3" + LEXICON_TEXT="I work with AWS every day." + log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Joanna --lexicon-names '$LEXICON_NAME' --text '$LEXICON_TEXT' '$LEXICON_OUTPUT'" || true @@ -178 +222 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -f "lexicon-output.mp3" ]; then + if [[ -f "$LEXICON_OUTPUT" ]]; then @@ -180,0 +225 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + cp "$LEXICON_OUTPUT" lexicon-output.mp3 @@ -199 +244 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Prompt for cleanup + # Cleanup with auto-confirmation @@ -204,4 +249 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Do you want to clean up all created resources? (y/n): " | tee -a "$LOG_FILE" - read -r CLEANUP_CHOICE - - if [[ "$CLEANUP_CHOICE" =~ ^[Yy] ]]; then + echo "Cleaning up all created resources..." | tee -a "$LOG_FILE" @@ -209,5 +250,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "Skipping cleanup. Resources will remain in your account." | tee -a "$LOG_FILE" - echo "To manually delete the lexicon later, run:" | tee -a "$LOG_FILE" - echo "aws polly delete-lexicon --name $LEXICON_NAME" | tee -a "$LOG_FILE" - fi