AWS code-library medium security documentation change
Summary
Added input validation functions for AWS resources, improved error handling, enhanced cleanup logic, and added security warnings about permissive rules
Security assessment
Added explicit validation for ARN/VPC/Security Group formats prevents misconfiguration attacks. The warning about 0.0.0.0/0 CIDR highlights a security risk. Error handling improvements reduce exposure time during cleanup failures.
Diff
diff --git a/code-library/latest/ug/ec2_example_elastic_load_balancing_v2_GettingStarted_058_section.md b/code-library/latest/ug/ec2_example_elastic_load_balancing_v2_GettingStarted_058_section.md index 775dd3183..d6468cf72 100644 --- a//code-library/latest/ug/ec2_example_elastic_load_balancing_v2_GettingStarted_058_section.md +++ b//code-library/latest/ug/ec2_example_elastic_load_balancing_v2_GettingStarted_058_section.md @@ -45,0 +46,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + set -euo pipefail + @@ -55 +57 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "ERROR: $1" + echo "ERROR: $1" >&2 @@ -61 +63 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to check command success + # Function to check AWS CLI command success @@ -63,2 +65,27 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$1" | grep -i "error" > /dev/null; then - handle_error "$1" + local output="$1" + if [[ -z "$output" ]] || [[ "$output" == "None" ]]; then + handle_error "AWS CLI command returned empty or invalid output" + fi + } + + # Function to validate ARN format + validate_arn() { + local arn="$1" + if [[ ! "$arn" =~ ^arn:aws:[a-z0-9-]+:[a-z0-9-]*:[0-9]{12}:.+$ ]]; then + handle_error "Invalid ARN format: $arn" + fi + } + + # Function to validate security group ID + validate_security_group_id() { + local sg_id="$1" + if [[ ! "$sg_id" =~ ^sg-[a-f0-9]{8,17}$ ]]; then + handle_error "Invalid security group ID format: $sg_id" + fi + } + + # Function to validate VPC ID + validate_vpc_id() { + local vpc_id="$1" + if [[ ! "$vpc_id" =~ ^vpc-[a-f0-9]{8,17}$ ]]; then + handle_error "Invalid VPC ID format: $vpc_id" @@ -72 +99 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$LISTENER_ARN" ]; then + if [ -n "${LISTENER_ARN:-}" ]; then @@ -74 +101 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 delete-listener --listener-arn "$LISTENER_ARN" + aws elbv2 delete-listener --listener-arn "$LISTENER_ARN" 2>/dev/null || true @@ -77 +104 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$LOAD_BALANCER_ARN" ]; then + if [ -n "${LOAD_BALANCER_ARN:-}" ]; then @@ -79 +106 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 delete-load-balancer --load-balancer-arn "$LOAD_BALANCER_ARN" + aws elbv2 delete-load-balancer --load-balancer-arn "$LOAD_BALANCER_ARN" 2>/dev/null || true @@ -83 +110 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 wait load-balancers-deleted --load-balancer-arns "$LOAD_BALANCER_ARN" + aws elbv2 wait load-balancers-deleted --load-balancer-arns "$LOAD_BALANCER_ARN" 2>/dev/null || true @@ -86 +113 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$TARGET_GROUP_ARN" ]; then + if [ -n "${TARGET_GROUP_ARN:-}" ]; then @@ -88 +115 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 delete-target-group --target-group-arn "$TARGET_GROUP_ARN" + aws elbv2 delete-target-group --target-group-arn "$TARGET_GROUP_ARN" 2>/dev/null || true @@ -91,3 +118 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Add a delay before attempting to delete the security group - # to ensure all ELB resources are fully deleted - if [ -n "$SECURITY_GROUP_ID" ]; then + if [ -n "${SECURITY_GROUP_ID:-}" ]; then @@ -98,8 +123,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SG_DELETE_OUTPUT=$(aws ec2 delete-security-group --group-id "$SECURITY_GROUP_ID" 2>&1) - - # If there's still a dependency issue, retry a few times - RETRY_COUNT=0 - MAX_RETRIES=5 - while echo "$SG_DELETE_OUTPUT" | grep -i "DependencyViolation" > /dev/null && [ $RETRY_COUNT -lt $MAX_RETRIES ]; do - RETRY_COUNT=$((RETRY_COUNT+1)) - echo "Security group still has dependencies. Retrying in 30 seconds... (Attempt $RETRY_COUNT of $MAX_RETRIES)" + local sg_delete_output + sg_delete_output=$(aws ec2 delete-security-group --group-id "$SECURITY_GROUP_ID" 2>&1 || true) + + local retry_count=0 + local max_retries=5 + while echo "$sg_delete_output" | grep -i "DependencyViolation" > /dev/null && [ $retry_count -lt $max_retries ]; do + retry_count=$((retry_count+1)) + echo "Security group still has dependencies. Retrying in 30 seconds... (Attempt $retry_count of $max_retries)" @@ -107 +132 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SG_DELETE_OUTPUT=$(aws ec2 delete-security-group --group-id "$SECURITY_GROUP_ID" 2>&1) + sg_delete_output=$(aws ec2 delete-security-group --group-id "$SECURITY_GROUP_ID" 2>&1 || true) @@ -110,2 +135,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$SG_DELETE_OUTPUT" | grep -i "error" > /dev/null; then - echo "WARNING: Could not delete security group: $SECURITY_GROUP_ID" + if echo "$sg_delete_output" | grep -i "error" > /dev/null; then + echo "WARNING: Could not delete security group: $SECURITY_GROUP_ID" >&2 @@ -122,0 +148,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Verify AWS CLI is available + if ! command -v aws &> /dev/null; then + handle_error "AWS CLI is not installed or not in PATH" + fi + @@ -125,2 +155 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 help > /dev/null 2>&1 - if [ $? -ne 0 ]; then + if ! aws elbv2 help > /dev/null 2>&1; then @@ -132 +161 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VPC_INFO=$(aws ec2 describe-vpcs --filters "Name=isDefault,Values=true" --query "Vpcs[0].VpcId" --output text) + VPC_INFO=$(aws ec2 describe-vpcs --filters "Name=isDefault,Values=true" --query "Vpcs[0].VpcId" --output text 2>/dev/null || echo "") @@ -134 +163,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VPC_ID=$VPC_INFO + VPC_ID="$VPC_INFO" + validate_vpc_id "$VPC_ID" @@ -139 +169 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SUBNET_INFO=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC_ID" --query "Subnets[0:2].SubnetId" --output text) + SUBNET_INFO=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC_ID" --query "Subnets[0:2].SubnetId" --output text 2>/dev/null || echo "") @@ -156 +186 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "GroupId" --output text) + --query "GroupId" --output text 2>/dev/null || echo "") @@ -158 +188,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SECURITY_GROUP_ID=$SG_INFO + SECURITY_GROUP_ID="$SG_INFO" + validate_security_group_id "$SECURITY_GROUP_ID" @@ -167,2 +198,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --cidr "0.0.0.0/0" > /dev/null - # Note: In production, you should restrict the CIDR range to specific IP addresses + --cidr "0.0.0.0/0" > /dev/null 2>&1 || handle_error "Failed to authorize security group ingress" + + echo "WARNING: Security group allows HTTP from 0.0.0.0/0. In production, restrict to specific IP addresses." >&2 @@ -176 +208 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "LoadBalancers[0].LoadBalancerArn" --output text) + --query "LoadBalancers[0].LoadBalancerArn" --output text 2>/dev/null || echo "") @@ -178 +210,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LOAD_BALANCER_ARN=$LB_INFO + LOAD_BALANCER_ARN="$LB_INFO" + validate_arn "$LOAD_BALANCER_ARN" @@ -183 +216,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 wait load-balancer-available --load-balancer-arns "$LOAD_BALANCER_ARN" + if ! aws elbv2 wait load-balancer-available --load-balancer-arns "$LOAD_BALANCER_ARN" 2>/dev/null; then + handle_error "Load balancer did not reach active state within timeout period" + fi @@ -193 +228 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "TargetGroups[0].TargetGroupArn" --output text) + --query "TargetGroups[0].TargetGroupArn" --output text 2>/dev/null || echo "") @@ -195 +230,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - TARGET_GROUP_ARN=$TG_INFO + TARGET_GROUP_ARN="$TG_INFO" + validate_arn "$TARGET_GROUP_ARN" @@ -202,2 +238 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "Reservations[*].Instances[*].InstanceId" --output text) - check_command "$INSTANCES" + --query "Reservations[*].Instances[*].InstanceId" --output text 2>/dev/null || echo "") @@ -214 +249 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - TARGET_ARGS="" + target_args=() @@ -216,2 +251,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$i" -lt 2 ]; then # Register up to 2 instances - TARGET_ARGS="$TARGET_ARGS Id=${INSTANCE_IDS[$i]} " + if [ "$i" -lt 2 ]; then + target_args+=("Id=${INSTANCE_IDS[$i]}") @@ -221,2 +256,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$TARGET_ARGS" ]; then - aws elbv2 register-targets \ + if [ ${#target_args[@]} -gt 0 ]; then + if aws elbv2 register-targets \ @@ -224,2 +259,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --targets $TARGET_ARGS - echo "Registered instances: $TARGET_ARGS" + --targets "${target_args[@]}" 2>/dev/null; then + echo "Registered instances: ${target_args[*]}" + else + handle_error "Failed to register targets" + fi @@ -236 +274 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "Listeners[0].ListenerArn" --output text) + --query "Listeners[0].ListenerArn" --output text 2>/dev/null || echo "") @@ -238 +276,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LISTENER_ARN=$LISTENER_INFO + LISTENER_ARN="$LISTENER_INFO" + validate_arn "$LISTENER_ARN" @@ -243 +282 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 describe-target-health --target-group-arn "$TARGET_GROUP_ARN" + aws elbv2 describe-target-health --target-group-arn "$TARGET_GROUP_ARN" 2>/dev/null || true @@ -248 +287 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "LoadBalancers[0].DNSName" --output text) + --query "LoadBalancers[0].DNSName" --output text 2>/dev/null || echo "") @@ -264 +303 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Ask user if they want to clean up resources + # Prompt for cleanup confirmation @@ -268,2 +307 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Do you want to clean up all created resources? (y/n): " - read -r CLEANUP_CHOICE + read -p "Do you want to clean up all created resources? (y/n): " -r CLEANUP_CHOICE @@ -271 +309 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [[ "$CLEANUP_CHOICE" =~ ^[Yy] ]]; then + if [[ "$CLEANUP_CHOICE" =~ ^[Yy]$ ]]; then