AWS code-library documentation change
Summary
Updated S3 getting started tutorial with improved error handling, resource cleanup, and added security features including server-side encryption, bucket encryption, and public access blocking
Security assessment
The changes add documentation for security features including server-side encryption (AES256) on object uploads/copies, SSE-S3 bucket encryption configuration, and public access blocking. However, there is no evidence this addresses a specific security vulnerability - it proactively adds security best practices to the tutorial.
Diff
diff --git a/code-library/latest/ug/s3_example_s3_GettingStarted_section.md b/code-library/latest/ug/s3_example_s3_GettingStarted_section.md index 5447681a2..43bae8bdb 100644 --- a//code-library/latest/ug/s3_example_s3_GettingStarted_section.md +++ b//code-library/latest/ug/s3_example_s3_GettingStarted_section.md @@ -46,0 +47 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + set -o pipefail @@ -57,0 +59,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Verify AWS credentials are configured + if ! aws sts get-caller-identity &>/dev/null; then + echo "ERROR: AWS credentials not configured or invalid. Run 'aws configure'." + exit 1 + fi + @@ -62 +69 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - UNIQUE_ID=$(cat /dev/urandom | tr -dc 'a-f0-9' | fold -w 12 | head -n 1) + UNIQUE_ID=$(head -c 6 /dev/urandom | od -An -tx1 | tr -d ' ') @@ -75,0 +83 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + trap 'rm -rf "$TEMP_DIR"' EXIT @@ -88,0 +97,31 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # ============================================================================ + # Helper functions + # ============================================================================ + + get_region() { + echo "${AWS_REGION:-${AWS_DEFAULT_REGION:-${CONFIGURED_REGION}}}" + } + + delete_object_versions() { + local bucket=$1 + local query=$2 + + local versions + versions=$(aws s3api list-object-versions \ + --bucket "$bucket" \ + --query "$query" \ + --output json 2>&1) || return 0 + + if [ -z "$versions" ] || [ "$versions" = "null" ] || [ "$versions" = "[]" ]; then + return 0 + fi + + echo "$versions" | jq -r '.[] | "\(.Key)\t\(.VersionId)"' 2>/dev/null | while IFS=$'\t' read -r key version_id; do + if [ -n "$key" ] && [ "$key" != "null" ]; then + aws s3api delete-object --bucket "$bucket" --key "$key" --version-id "$version_id" >/dev/null 2>&1 || true + fi + done + + return 0 + } + @@ -99,17 +138,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Delete all object versions and delete markers - echo "Listing all object versions in bucket..." - VERSIONS_OUTPUT=$(aws s3api list-object-versions \ - --bucket "$BUCKET_NAME" \ - --query "Versions[].{Key:Key,VersionId:VersionId}" \ - --output text 2>&1) || true - - if [ -n "$VERSIONS_OUTPUT" ] && [ "$VERSIONS_OUTPUT" != "None" ]; then - while IFS=$'\t' read -r KEY VERSION_ID; do - if [ -n "$KEY" ] && [ "$KEY" != "None" ]; then - echo "Deleting version: ${KEY} (${VERSION_ID})" - aws s3api delete-object \ - --bucket "$BUCKET_NAME" \ - --key "$KEY" \ - --version-id "$VERSION_ID" 2>&1 || echo "WARNING: Failed to delete version ${KEY} (${VERSION_ID})" - fi - done <<< "$VERSIONS_OUTPUT" + if [ "$BUCKET_IS_SHARED" = "false" ]; then + echo "Deleting all object versions in bucket..." + + delete_object_versions "$BUCKET_NAME" "Versions[].{Key:Key,VersionId:VersionId}" || true + + delete_object_versions "$BUCKET_NAME" "DeleteMarkers[].{Key:Key,VersionId:VersionId}" || true + + echo "Deleting bucket: ${BUCKET_NAME}" + if ! aws s3api delete-bucket --bucket "$BUCKET_NAME" 2>/dev/null; then + echo "WARNING: Failed to delete bucket ${BUCKET_NAME}" @@ -118,13 +150,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - DELETE_MARKERS_OUTPUT=$(aws s3api list-object-versions \ - --bucket "$BUCKET_NAME" \ - --query "DeleteMarkers[].{Key:Key,VersionId:VersionId}" \ - --output text 2>&1) || true - - if [ -n "$DELETE_MARKERS_OUTPUT" ] && [ "$DELETE_MARKERS_OUTPUT" != "None" ]; then - while IFS=$'\t' read -r KEY VERSION_ID; do - if [ -n "$KEY" ] && [ "$KEY" != "None" ]; then - echo "Deleting delete marker: ${KEY} (${VERSION_ID})" - aws s3api delete-object \ - --bucket "$BUCKET_NAME" \ - --key "$KEY" \ - --version-id "$VERSION_ID" 2>&1 || echo "WARNING: Failed to delete marker ${KEY} (${VERSION_ID})" + # Clean up logs bucket + LOG_TARGET_BUCKET="${BUCKET_NAME}-logs" + if aws s3api head-bucket --bucket "$LOG_TARGET_BUCKET" 2>/dev/null; then + echo "Deleting log bucket: ${LOG_TARGET_BUCKET}" + if ! aws s3api delete-bucket --bucket "$LOG_TARGET_BUCKET" 2>/dev/null; then + echo "WARNING: Failed to delete bucket ${LOG_TARGET_BUCKET}" @@ -132 +156,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - done <<< "$DELETE_MARKERS_OUTPUT" @@ -134,4 +157,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - - if [ "$BUCKET_IS_SHARED" = "false" ]; then - echo "Deleting bucket: ${BUCKET_NAME}" - aws s3api delete-bucket --bucket "$BUCKET_NAME" 2>&1 || echo "WARNING: Failed to delete bucket ${BUCKET_NAME}" @@ -142,4 +161,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "" - echo "Cleaning up temp directory: ${TEMP_DIR}" - rm -rf "$TEMP_DIR" - @@ -150,0 +167 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local line_number=$1 @@ -153 +170 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "ERROR on $1" + echo "ERROR on line ${line_number}" @@ -156,0 +174 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if [ ${#CREATED_RESOURCES[@]} -gt 0 ]; then @@ -159,0 +178,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + else + echo " (none)" + fi @@ -166 +187 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - trap 'handle_error "line $LINENO"' ERR + trap 'handle_error "$LINENO"' ERR @@ -174,3 +195 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - - # CreateBucket requires LocationConstraint for all regions except us-east-1 - REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-${CONFIGURED_REGION}}}" + REGION=$(get_region) @@ -178,2 +197,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - CREATE_OUTPUT=$(aws s3api create-bucket \ - --bucket "$BUCKET_NAME" 2>&1) + if ! aws s3api create-bucket --bucket "$BUCKET_NAME" >/dev/null 2>&1; then + echo "ERROR: Failed to create bucket $BUCKET_NAME" + exit 1 + fi @@ -181 +202 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - CREATE_OUTPUT=$(aws s3api create-bucket \ + if ! aws s3api create-bucket \ @@ -183 +204,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --create-bucket-configuration LocationConstraint="$REGION" 2>&1) + --region "$REGION" \ + --create-bucket-configuration LocationConstraint="$REGION" >/dev/null 2>&1; then + echo "ERROR: Failed to create bucket $BUCKET_NAME in region $REGION" + exit 1 + fi @@ -185 +209,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$CREATE_OUTPUT" @@ -198 +222,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Hello, Amazon S3! This is a sample file for the getting started tutorial." > "$SAMPLE_FILE" + cat > "$SAMPLE_FILE" << 'EOF' + Hello, Amazon S3! This is a sample file for the getting started tutorial. + EOF @@ -200 +226 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - UPLOAD_OUTPUT=$(aws s3api put-object \ + if ! aws s3api put-object \ @@ -203,2 +229,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --body "$SAMPLE_FILE" 2>&1) - echo "$UPLOAD_OUTPUT" + --body "$SAMPLE_FILE" \ + --server-side-encryption AES256 \ + --metadata "tutorial=s3-gettingstarted" >/dev/null 2>&1; then + echo "ERROR: Failed to upload sample.txt" + exit 1 + fi @@ -215 +245 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws s3api get-object \ + if ! aws s3api get-object \ @@ -218 +248,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "$DOWNLOAD_FILE" 2>&1 + "$DOWNLOAD_FILE" >/dev/null 2>&1; then + echo "ERROR: Failed to download sample.txt" + exit 1 + fi @@ -230 +263 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - COPY_OUTPUT=$(aws s3api copy-object \ + if ! aws s3api copy-object \ @@ -233,2 +266,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --key "backup/sample.txt" 2>&1) - echo "$COPY_OUTPUT" + --key "backup/sample.txt" \ + --server-side-encryption AES256 \ + --metadata-directive COPY >/dev/null 2>&1; then + echo "ERROR: Failed to copy object to backup/sample.txt" + exit 1 + fi @@ -244 +281 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VERSIONING_OUTPUT=$(aws s3api put-bucket-versioning \ + if ! aws s3api put-bucket-versioning \ @@ -246,2 +283,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --versioning-configuration Status=Enabled 2>&1) - echo "$VERSIONING_OUTPUT" + --versioning-configuration Status=Enabled >/dev/null 2>&1; then + echo "ERROR: Failed to enable versioning" + exit 1 + fi @@ -251 +290,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Hello, Amazon S3! This is version 2 of the sample file." > "$SAMPLE_FILE" + cat > "$SAMPLE_FILE" << 'EOF' + Hello, Amazon S3! This is version 2 of the sample file.