AWS code-library high security documentation change
Summary
Updated AWS Lightsail Getting Started example script with improved error handling, input validation, and resource cleanup robustness. Changes include adding IP format validation, setting restrictive file permissions for keys, handling empty arrays, and making cleanup non-interactive.
Security assessment
The change adds security-critical improvements: 1) 'umask 077' ensures private keys are created with restrictive permissions (CWE-732), preventing unauthorized access. 2) IP address format validation mitigates potential command injection risks if the IP is used in unsafe contexts. 3) Redirecting errors to stderr improves secure logging practices. These directly address security weaknesses in credential storage and input handling.
Diff
diff --git a/code-library/latest/ug/lightsail_example_lightsail_GettingStarted_section.md b/code-library/latest/ug/lightsail_example_lightsail_GettingStarted_section.md index 030e03e64..926c53fe1 100644 --- a//code-library/latest/ug/lightsail_example_lightsail_GettingStarted_section.md +++ b//code-library/latest/ug/lightsail_example_lightsail_GettingStarted_section.md @@ -39,0 +40 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + set -euo pipefail @@ -42 +43 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - export AWS_REGION="us-west-2" + export AWS_REGION="${AWS_REGION:-us-west-2}" @@ -53 +54 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "ERROR: $1" + echo "ERROR: $1" >&2 @@ -55 +56 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - cleanup_resources + cleanup_resources || true @@ -84 +85 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - for resource in "${CREATED_RESOURCES[@]}"; do + for resource in "${CREATED_RESOURCES[@]+"${CREATED_RESOURCES[@]}"}"; do @@ -95 +96 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws lightsail delete-instance-snapshot --instance-snapshot-name "$name" --region $AWS_REGION + aws lightsail delete-instance-snapshot --instance-snapshot-name "$name" --region "$AWS_REGION" 2>/dev/null || true @@ -99 +100 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws lightsail delete-disk-snapshot --disk-snapshot-name "$name" --region $AWS_REGION + aws lightsail delete-disk-snapshot --disk-snapshot-name "$name" --region "$AWS_REGION" 2>/dev/null || true @@ -103,2 +104,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws lightsail detach-disk --disk-name "$name" --region $AWS_REGION - sleep 10 # Wait for detach to complete + aws lightsail detach-disk --disk-name "$name" --region "$AWS_REGION" 2>/dev/null || true + sleep 10 @@ -106 +107 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws lightsail delete-disk --disk-name "$name" --region $AWS_REGION + aws lightsail delete-disk --disk-name "$name" --region "$AWS_REGION" 2>/dev/null || true @@ -110,2 +111 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Check instance state before attempting to delete - INSTANCE_STATE=$(aws lightsail get-instance-state --instance-name "$name" --region $AWS_REGION --query 'state.name' --output text 2>/dev/null) + INSTANCE_STATE=$(aws lightsail get-instance-state --instance-name "$name" --region "$AWS_REGION" --query 'state.name' --output text 2>/dev/null || echo "unknown") @@ -119 +119 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - INSTANCE_STATE=$(aws lightsail get-instance-state --instance-name "$name" --region $AWS_REGION --query 'state.name' --output text 2>/dev/null) + INSTANCE_STATE=$(aws lightsail get-instance-state --instance-name "$name" --region "$AWS_REGION" --query 'state.name' --output text 2>/dev/null || echo "unknown") @@ -123 +123 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws lightsail delete-instance --instance-name "$name" --region $AWS_REGION + aws lightsail delete-instance --instance-name "$name" --region "$AWS_REGION" 2>/dev/null || true @@ -139 +139 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws lightsail get-blueprints --region $AWS_REGION --query 'blueprints[0:5].[blueprintId,name]' --output table + aws lightsail get-blueprints --region "$AWS_REGION" --query 'blueprints[0:5].[blueprintId,name]' --output table @@ -143 +143 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws lightsail get-bundles --region $AWS_REGION --query 'bundles[0:5].[bundleId,name,price]' --output table + aws lightsail get-bundles --region "$AWS_REGION" --query 'bundles[0:5].[bundleId,name,price]' --output table @@ -159 +159 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --region $AWS_REGION + --region "$AWS_REGION" @@ -165 +164,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Wait for the instance to be ready (polling approach) @@ -169 +168 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - STATUS=$(aws lightsail get-instance-state --instance-name "$INSTANCE_NAME" --region $AWS_REGION --query 'state.name' --output text) + STATUS=$(aws lightsail get-instance-state --instance-name "$INSTANCE_NAME" --region "$AWS_REGION" --query 'state.name' --output text 2>/dev/null || echo "unknown") @@ -185 +184 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - INSTANCE_IP=$(aws lightsail get-instance --instance-name "$INSTANCE_NAME" --region $AWS_REGION --query 'instance.publicIpAddress' --output text) + INSTANCE_IP=$(aws lightsail get-instance --instance-name "$INSTANCE_NAME" --region "$AWS_REGION" --query 'instance.publicIpAddress' --output text) @@ -188,0 +188,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate IP address format + if ! [[ "$INSTANCE_IP" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then + handle_error "Invalid IP address format: $INSTANCE_IP" + fi + @@ -192 +196,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws lightsail download-default-key-pair --region $AWS_REGION --output text > "$KEY_FILE" + umask 077 + aws lightsail download-default-key-pair --region "$AWS_REGION" --output text > "$KEY_FILE" @@ -193,0 +199,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + if [ ! -f "$KEY_FILE" ] || [ ! -s "$KEY_FILE" ]; then + handle_error "Key pair file was not created or is empty" + fi + @@ -207 +217 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --region $AWS_REGION + --region "$AWS_REGION" @@ -211 +221 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # FIX: Wait for the disk to be available using polling instead of fixed sleep + # Wait for the disk to be available using polling @@ -216 +226 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - DISK_STATE=$(aws lightsail get-disk --disk-name "$DISK_NAME" --region $AWS_REGION --query 'disk.state' --output text 2>/dev/null) + DISK_STATE=$(aws lightsail get-disk --disk-name "$DISK_NAME" --region "$AWS_REGION" --query 'disk.state' --output text 2>/dev/null || echo "unknown") @@ -236 +246 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --region $AWS_REGION + --region "$AWS_REGION" @@ -250 +260 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --region $AWS_REGION + --region "$AWS_REGION" @@ -254 +264 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # FIX: Wait for the snapshot to complete using polling instead of fixed sleep + # Wait for the snapshot to complete using polling @@ -256 +266 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - MAX_ATTEMPTS=60 # Increased timeout for snapshot creation + MAX_ATTEMPTS=60 @@ -259,2 +269,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SNAPSHOT_STATE=$(aws lightsail get-instance-snapshot --instance-snapshot-name "$SNAPSHOT_NAME" --region $AWS_REGION --query 'instanceSnapshot.state' --output text 2>/dev/null) - if [ "$SNAPSHOT_STATE" == "completed" ]; then + SNAPSHOT_STATE=$(aws lightsail get-instance-snapshot --instance-snapshot-name "$SNAPSHOT_NAME" --region "$AWS_REGION" --query 'instanceSnapshot.state' --output text 2>/dev/null || echo "unknown") + if [ "$SNAPSHOT_STATE" == "available" ]; then @@ -277 +287 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - for resource in "${CREATED_RESOURCES[@]}"; do + for resource in "${CREATED_RESOURCES[@]+"${CREATED_RESOURCES[@]}"}"; do @@ -281,2 +291 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - read -p "Do you want to clean up these resources? (y/n): " CLEANUP_CONFIRM - if [[ "$CLEANUP_CONFIRM" == "y" || "$CLEANUP_CONFIRM" == "Y" ]]; then + echo "Cleaning up these resources automatically..." @@ -284,8 +292,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "Resources will not be cleaned up. You can manually delete them later." - echo "To clean up manually, use the following commands:" - echo "aws lightsail delete-instance-snapshot --instance-snapshot-name $SNAPSHOT_NAME --region $AWS_REGION" - echo "aws lightsail detach-disk --disk-name $DISK_NAME --region $AWS_REGION" - echo "aws lightsail delete-disk --disk-name $DISK_NAME --region $AWS_REGION" - echo "aws lightsail delete-instance --instance-name $INSTANCE_NAME --region $AWS_REGION" - fi