AWS code-library documentation change
Summary
Extensive rewrite of AWS IoT Device Defender setup script adding robust error handling, input validation, retry logic, JSON validation, prerequisite checks, and automatic cleanup functionality
Security assessment
The changes improve security practices in the example script by adding JSON validation for IAM policies, input sanitization, error handling, and proper resource cleanup. However, there is no evidence of addressing a specific security vulnerability or incident. The changes add security-related documentation by demonstrating secure coding practices for AWS IoT Device Defender setup, including validation of trust policies and mitigation action parameters.
Diff
diff --git a/code-library/latest/ug/iot_example_iot_GettingStarted_079_section.md b/code-library/latest/ug/iot_example_iot_GettingStarted_079_section.md index 618f6636b..0641cb5ca 100644 --- a//code-library/latest/ug/iot_example_iot_GettingStarted_079_section.md +++ b//code-library/latest/ug/iot_example_iot_GettingStarted_079_section.md @@ -46,0 +47,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + set -euo pipefail + @@ -59 +61 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$1" | grep -i "An error occurred\|Exception\|Failed\|usage: aws" > /dev/null; then + if echo "$1" | grep -iE "An error occurred|Exception|Failed|usage: aws" > /dev/null; then @@ -67 +69,39 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to create IAM roles + # Function to safely extract JSON values using jq + extract_json_value() { + local json="$1" + local key="$2" + echo "$json" | jq -r ".${key} // empty" 2>/dev/null || echo "" + } + + # Function to validate JSON + validate_json() { + local json="$1" + echo "$json" | jq empty 2>/dev/null + } + + # Function to check AWS CLI availability + check_aws_cli() { + if ! command -v aws &> /dev/null; then + echo "ERROR: AWS CLI is not installed or not in PATH" + return 1 + fi + if ! command -v jq &> /dev/null; then + echo "ERROR: jq is not installed or not in PATH" + return 1 + fi + return 0 + } + + # Function to get AWS account ID + get_account_id() { + local account_id + account_id=$(aws sts get-caller-identity --query 'Account' --output text 2>/dev/null) || true + if [ -z "$account_id" ]; then + echo "ERROR: Could not retrieve AWS account ID" + return 1 + fi + echo "$account_id" + return 0 + } + + # Function to create IAM roles with retry logic @@ -71,0 +112,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local RETRY_COUNT=0 + local MAX_RETRIES=3 @@ -74,0 +117,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate trust policy JSON + if ! validate_json "$TRUST_POLICY"; then + echo "ERROR: Invalid trust policy JSON for role $ROLE_NAME" + return 1 + fi + @@ -76 +124,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - ROLE_EXISTS=$(aws iam get-role --role-name "$ROLE_NAME" 2>&1 || echo "NOT_EXISTS") + if aws iam get-role --role-name "$ROLE_NAME" >/dev/null 2>&1; then + echo "Role $ROLE_NAME already exists, skipping creation" + ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text 2>/dev/null) || true + if [ -z "$ROLE_ARN" ]; then + echo "ERROR: Could not retrieve ARN for existing role $ROLE_NAME" + return 1 + fi + echo "Role ARN: $ROLE_ARN" + return 0 + fi @@ -78,2 +135,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$ROLE_EXISTS" | grep -i "NoSuchEntity" > /dev/null; then - # Create the role with trust policy + # Create the role with trust policy and retry logic + while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do @@ -82 +139,12 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --assume-role-policy-document "$TRUST_POLICY" 2>&1) + --assume-role-policy-document "$TRUST_POLICY" 2>&1) || true + + if check_error "$ROLE_RESULT"; then + break + fi + + RETRY_COUNT=$((RETRY_COUNT + 1)) + if [ $RETRY_COUNT -lt $MAX_RETRIES ]; then + echo "Retrying role creation (attempt $((RETRY_COUNT + 1))/$MAX_RETRIES)..." + sleep $((RETRY_COUNT * 2)) + fi + done @@ -85 +153 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Failed to create role $ROLE_NAME" + echo "Failed to create role $ROLE_NAME after $MAX_RETRIES attempts" @@ -91 +159,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LOGGING_POLICY='{ + local LOGGING_POLICY + LOGGING_POLICY=$(cat <<'EOF' + { @@ -105,3 +175 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "Resource": [ - "arn:aws:logs:*:*:*" - ] + "Resource": "arn:aws:logs:*:*:*" @@ -110 +178,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) + + if ! validate_json "$LOGGING_POLICY"; then + echo "ERROR: Invalid logging policy JSON" + return 1 + fi @@ -115 +190 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --policy-document "$LOGGING_POLICY" 2>&1) + --policy-document "$LOGGING_POLICY" 2>&1) || true @@ -122 +197,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - MITIGATION_POLICY='{ + local MITIGATION_POLICY + MITIGATION_POLICY=$(cat <<'EOF' + { @@ -132,2 +209 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "iot:AddThingToThingGroup", - "iot:PublishToTopic" + "iot:AddThingToThingGroup" @@ -135 +211 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "Resource": "*" + "Resource": "arn:aws:iot:*:*:*" @@ -148 +224,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) + + if ! validate_json "$MITIGATION_POLICY"; then + echo "ERROR: Invalid mitigation policy JSON" + return 1 + fi @@ -153 +236 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --policy-document "$MITIGATION_POLICY" 2>&1) + --policy-document "$MITIGATION_POLICY" 2>&1) || true @@ -164 +247 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --policy-arn "$MANAGED_POLICY" 2>&1) + --policy-arn "$MANAGED_POLICY" 2>&1) || true @@ -174,3 +256,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "Role $ROLE_NAME already exists, skipping creation" - fi @@ -178,2 +258,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Get the role ARN - ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text) + # Get the role ARN with error handling + ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text 2>/dev/null) || true + if [ -z "$ROLE_ARN" ]; then + echo "ERROR: Could not retrieve ARN for newly created role $ROLE_NAME" + return 1 + fi @@ -186,0 +271,11 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate prerequisites + echo "Validating prerequisites..." + if ! check_aws_cli; then + echo "ERROR: Prerequisites not met" + exit 1 + fi + + ACCOUNT_ID=$(get_account_id) || exit 1 + echo "AWS Account ID: $ACCOUNT_ID" + echo "" + @@ -193 +288,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - IOT_DEFENDER_AUDIT_TRUST_POLICY='{ + IOT_DEFENDER_AUDIT_TRUST_POLICY=$(cat <<'EOF' + { @@ -204 +300,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) @@ -206 +304,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - create_iam_role "AWSIoTDeviceDefenderAuditRole" "$IOT_DEFENDER_AUDIT_TRUST_POLICY" "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderAudit" + if ! create_iam_role "AWSIoTDeviceDefenderAuditRole" "$IOT_DEFENDER_AUDIT_TRUST_POLICY" "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderAudit"; then + echo "ERROR: Failed to create audit role" + exit 1 + fi @@ -211 +312,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - IOT_LOGGING_TRUST_POLICY='{ + IOT_LOGGING_TRUST_POLICY=$(cat <<'EOF' + { @@ -222 +324,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) @@ -224 +328,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - create_iam_role "AWSIoTLoggingRole" "$IOT_LOGGING_TRUST_POLICY" "" + if ! create_iam_role "AWSIoTLoggingRole" "$IOT_LOGGING_TRUST_POLICY" ""; then + echo "ERROR: Failed to create logging role" + exit 1