AWS code-library high security documentation change
Summary
Added input validation, improved error handling, and security checks in Lambda example code
Security assessment
Added input validation functions (validate_input), numeric type checks, and IAM role ARN validation. These changes prevent potential injection attacks, invalid data processing, and ensure proper IAM role creation. Specific security evidence includes validation regex patterns and explicit error checking for negative values.
Diff
diff --git a/code-library/latest/ug/iam_example_lambda_GettingStarted_019_section.md b/code-library/latest/ug/iam_example_lambda_GettingStarted_019_section.md index c5bf71d31..2237ffe83 100644 --- a//code-library/latest/ug/iam_example_lambda_GettingStarted_019_section.md +++ b//code-library/latest/ug/iam_example_lambda_GettingStarted_019_section.md @@ -49 +49 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -eE + set -eE -o pipefail @@ -55 +55 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - UNIQUE_ID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1) + UNIQUE_ID=$(head -c 8 /dev/urandom | od -An -tx1 | tr -d ' ') @@ -60,0 +61 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + readonly TEMP_DIR @@ -169,0 +171,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + validate_input() { + local input="$1" + local pattern="$2" + if ! [[ "$input" =~ $pattern ]]; then + echo "ERROR: Invalid input: $input" + return 1 + fi + return 0 + } + @@ -194,2 +205,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Enter your choice (1 or 2): " - read -r RUNTIME_CHOICE + echo "Using default: Python 3.13" + RUNTIME_CHOICE="1" @@ -208,2 +219,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - length = event['length'] - width = event['width'] + if not isinstance(event, dict) or 'length' not in event or 'width' not in event: + raise ValueError('Event must contain length and width') + try: + length = float(event['length']) + width = float(event['width']) + if length < 0 or width < 0: + raise ValueError('Length and width must be non-negative') @@ -213,0 +230,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + except (TypeError, ValueError) as e: + logger.error(f'Error processing input: {str(e)}') + raise @@ -224,0 +244,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if (!event || typeof event.length !== 'number' || typeof event.width !== 'number') { + throw new Error('Event must contain numeric length and width'); + } + if (event.length < 0 || event.width < 0) { + throw new Error('Length and width must be non-negative'); + } @@ -267,0 +293,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + if ! validate_input "$ROLE_OUTPUT" "^arn:aws:iam::[0-9]+:role/"; then + echo "ERROR: Failed to create IAM role" + exit 1 + fi + @@ -297,3 +328,11 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - cd "$TEMP_DIR" - zip -j function.zip "$CODE_FILE" > /dev/null 2>&1 - cd "$ORIGINAL_DIR" + cd "$TEMP_DIR" || exit 1 + zip -j function.zip "$CODE_FILE" > /dev/null 2>&1 || { + echo "ERROR: Failed to create deployment package" + exit 1 + } + cd "$ORIGINAL_DIR" || exit 1 + + if [ ! -f "${TEMP_DIR}/function.zip" ]; then + echo "ERROR: Deployment package creation failed" + exit 1 + fi @@ -314,0 +354,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + if [ -z "$CREATE_OUTPUT" ]; then + echo "ERROR: Failed to create Lambda function" + exit 1 + fi + @@ -337,0 +383,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if ! validate_input "$TEST_EVENT" '"length": [0-9]+, "width": [0-9]+'; then + echo "ERROR: Invalid test event format" + exit 1 + fi + @@ -344,0 +395,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if [ ! -f "${TEMP_DIR}/response.json" ]; then + echo "ERROR: No response file generated" + exit 1 + fi + @@ -418 +473 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "CLEANUP CONFIRMATION" + echo "CLEANUP" @@ -421,4 +476 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Do you want to clean up all created resources? (y/n): " - read -r CLEANUP_CHOICE - - if [[ "$CLEANUP_CHOICE" =~ ^[Yy]$ ]]; then + echo "Cleaning up all created resources..." @@ -426,19 +477,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "" - echo "Resources were NOT deleted. To clean up manually, run:" - echo "" - echo " # Delete the Lambda function" - echo " aws lambda delete-function --function-name ${FUNCTION_NAME}" - echo "" - echo " # Delete the CloudWatch log group" - echo " aws logs delete-log-group --log-group-name ${LOG_GROUP_NAME}" - echo "" - echo " # Detach the policy and delete the IAM role" - echo " aws iam detach-role-policy --role-name ${ROLE_NAME} --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" - echo " aws iam delete-role --role-name ${ROLE_NAME}" - echo "" - - if [ -d "$TEMP_DIR" ]; then - rm -rf "$TEMP_DIR" - fi - fi