AWS code-library medium security documentation change
Summary
Added input validation, error handling, credential checks, and improved resource cleanup in Transit Gateway setup example
Security assessment
Changes include AWS credential validation, CIDR format validation, AWS API output validation, improved error handling, and robust resource cleanup. These prevent misconfigurations that could lead to unauthorized access, resource leaks, or network exposure.
Diff
diff --git a/code-library/latest/ug/ec2_example_vpc_TransitGatewayGettingStarted_section.md b/code-library/latest/ug/ec2_example_vpc_TransitGatewayGettingStarted_section.md index c6932cdb9..521f432d6 100644 --- a//code-library/latest/ug/ec2_example_vpc_TransitGatewayGettingStarted_section.md +++ b//code-library/latest/ug/ec2_example_vpc_TransitGatewayGettingStarted_section.md @@ -41,0 +42 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Security improved: Added input validation, error handling, and credential checks @@ -44 +45 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -e + set -euo pipefail @@ -47,0 +49,26 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Security: Check for required AWS credentials + if ! aws sts get-caller-identity &>/dev/null; then + echo "ERROR: AWS credentials not configured or invalid. Please configure AWS credentials." + exit 1 + fi + + # Function to validate AWS CLI output + validate_aws_output() { + local output=$1 + local context=$2 + + if [ -z "$output" ] || [ "$output" = "None" ]; then + echo "ERROR: Failed to retrieve $context from AWS API" + return 1 + fi + } + + # Function to validate CIDR blocks + validate_cidr() { + local cidr=$1 + if ! [[ "$cidr" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$ ]]; then + echo "ERROR: Invalid CIDR block format: $cidr" + return 1 + fi + } + @@ -50,0 +78,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local max_attempts=60 + local attempt=0 + @@ -53,2 +83,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - status=$(aws ec2 describe-transit-gateways --transit-gateway-ids "$tgw_id" --query "TransitGateways[0].State" --output text) + while [ $attempt -lt $max_attempts ]; do + status=$(aws ec2 describe-transit-gateways \ + --transit-gateway-ids "$tgw_id" \ + --query "TransitGateways[0].State" \ + --output text 2>/dev/null || echo "failed") + @@ -59 +93,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - break + return 0 + fi + + if [ "$status" = "failed" ]; then + echo "ERROR: Transit Gateway creation failed" + return 1 @@ -63,0 +103 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + ((attempt++)) @@ -64,0 +105,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + echo "ERROR: Timeout waiting for transit gateway to become available" + return 1 @@ -69,0 +113,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local max_attempts=60 + local attempt=0 + @@ -72,2 +118,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - status=$(aws ec2 describe-transit-gateway-vpc-attachments --transit-gateway-attachment-ids "$attachment_id" --query "TransitGatewayVpcAttachments[0].State" --output text) + while [ $attempt -lt $max_attempts ]; do + status=$(aws ec2 describe-transit-gateway-vpc-attachments \ + --transit-gateway-attachment-ids "$attachment_id" \ + --query "TransitGatewayVpcAttachments[0].State" \ + --output text 2>/dev/null || echo "failed") + @@ -78 +128,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - break + return 0 + fi + + if [ "$status" = "failed" ]; then + echo "ERROR: Transit Gateway Attachment creation failed" + return 1 @@ -82,0 +138 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + ((attempt++)) @@ -83,0 +140,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + echo "ERROR: Timeout waiting for transit gateway attachment to become available" + return 1 @@ -88,0 +148,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local max_attempts=60 + local attempt=0 + @@ -91,3 +153,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - # Check if the attachment still exists - count=$(aws ec2 describe-transit-gateway-vpc-attachments --filters "Name=transit-gateway-attachment-id,Values=$attachment_id" --query "length(TransitGatewayVpcAttachments)" --output text) + while [ $attempt -lt $max_attempts ]; do + count=$(aws ec2 describe-transit-gateway-vpc-attachments \ + --filters "Name=transit-gateway-attachment-id,Values=$attachment_id" \ + --query "length(TransitGatewayVpcAttachments)" \ + --output text 2>/dev/null || echo "0") @@ -97 +161 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - break + return 0 @@ -100 +164,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - status=$(aws ec2 describe-transit-gateway-vpc-attachments --transit-gateway-attachment-ids "$attachment_id" --query "TransitGatewayVpcAttachments[0].State" --output text 2>/dev/null || echo "deleted") + status=$(aws ec2 describe-transit-gateway-vpc-attachments \ + --transit-gateway-attachment-ids "$attachment_id" \ + --query "TransitGatewayVpcAttachments[0].State" \ + --output text 2>/dev/null || echo "deleted") @@ -102,3 +169,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$status" = "deleted" ]; then - echo "Transit Gateway Attachment has been deleted" - break + if [ "$status" = "deleted" ] || [ "$status" = "deleting" ]; then + echo "Transit Gateway Attachment is being deleted. Current state: $status" @@ -108,0 +175 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + ((attempt++)) @@ -109,0 +177,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + echo "WARNING: Timeout waiting for transit gateway attachment to be deleted" + return 0 @@ -114 +184,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Error occurred. Cleaning up resources..." + local exit_code=$? + echo "Error occurred (exit code: $exit_code). Cleaning up resources..." @@ -117 +188 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ ! -z "$TGW_ATTACHMENT_1_ID" ]; then + if [ -n "${TGW_ATTACHMENT_1_ID:-}" ]; then @@ -119 +190,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws ec2 delete-transit-gateway-vpc-attachment --transit-gateway-attachment-id "$TGW_ATTACHMENT_1_ID" || true + aws ec2 delete-transit-gateway-vpc-attachment \ + --transit-gateway-attachment-id "$TGW_ATTACHMENT_1_ID" &>/dev/null || true @@ -123 +195 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ ! -z "$TGW_ATTACHMENT_2_ID" ]; then + if [ -n "${TGW_ATTACHMENT_2_ID:-}" ]; then @@ -125 +197,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws ec2 delete-transit-gateway-vpc-attachment --transit-gateway-attachment-id "$TGW_ATTACHMENT_2_ID" || true + aws ec2 delete-transit-gateway-vpc-attachment \ + --transit-gateway-attachment-id "$TGW_ATTACHMENT_2_ID" &>/dev/null || true @@ -129 +202 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ ! -z "$TGW_ID" ]; then + if [ -n "${TGW_ID:-}" ]; then @@ -131 +204 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws ec2 delete-transit-gateway --transit-gateway-id "$TGW_ID" || true + aws ec2 delete-transit-gateway --transit-gateway-id "$TGW_ID" &>/dev/null || true @@ -134 +207 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - exit 1 + exit "$exit_code" @@ -138 +211 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - trap cleanup ERR + trap cleanup EXIT @@ -146 +219,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - AZ=$(aws ec2 describe-availability-zones --query "AvailabilityZones[0].ZoneName" --output text) + AZ=$(aws ec2 describe-availability-zones \ + --query "AvailabilityZones[0].ZoneName" \ + --output text) + validate_aws_output "$AZ" "availability zone" || exit 1 @@ -151,2 +227,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VPC1_ID=$(aws ec2 describe-vpcs --filters "Name=tag:Name,Values=VPC1" --query "Vpcs[0].VpcId" --output text) - VPC2_ID=$(aws ec2 describe-vpcs --filters "Name=tag:Name,Values=VPC2" --query "Vpcs[0].VpcId" --output text) + VPC1_ID=$(aws ec2 describe-vpcs \ + --filters "Name=tag:Name,Values=VPC1" \ + --query "Vpcs[0].VpcId" \ + --output text) + VPC2_ID=$(aws ec2 describe-vpcs \ + --filters "Name=tag:Name,Values=VPC2" \ + --query "Vpcs[0].VpcId" \ + --output text) @@ -154 +236 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$VPC1_ID" == "None" ] || [ -z "$VPC1_ID" ]; then + if [ "$VPC1_ID" = "None" ] || [ -z "$VPC1_ID" ]; then @@ -156 +238,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VPC1_ID=$(aws ec2 create-vpc --cidr-block 10.1.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC1}]' --query Vpc.VpcId --output text) + VPC1_ID=$(aws ec2 create-vpc \ + --cidr-block 10.1.0.0/16 \ + --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC1}]' \ + --query Vpc.VpcId \ + --output text) + validate_aws_output "$VPC1_ID" "VPC1" || exit 1 @@ -161 +248,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SUBNET1_ID=$(aws ec2 create-subnet --vpc-id "$VPC1_ID" --cidr-block 10.1.0.0/24 --availability-zone "$AZ" --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=VPC1-Subnet}]' --query Subnet.SubnetId --output text) + SUBNET1_ID=$(aws ec2 create-subnet \ + --vpc-id "$VPC1_ID" \ + --cidr-block 10.1.0.0/24 \ + --availability-zone "$AZ" \ + --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=VPC1-Subnet}]' \ + --query Subnet.SubnetId \ + --output text) + validate_aws_output "$SUBNET1_ID" "VPC1 subnet" || exit 1 @@ -165,2 +259,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SUBNET1_ID=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC1_ID" --query "Subnets[0].SubnetId" --output text) - if [ "$SUBNET1_ID" == "None" ] || [ -z "$SUBNET1_ID" ]; then + SUBNET1_ID=$(aws ec2 describe-subnets \ + --filters "Name=vpc-id,Values=$VPC1_ID" \ + --query "Subnets[0].SubnetId" \ + --output text) + if [ "$SUBNET1_ID" = "None" ] || [ -z "$SUBNET1_ID" ]; then