AWS code-library medium security documentation change
Summary
Enhanced example script with security best practices: added input validation, secure logging, AWS CLI/credentials checks, command output sanitization, and JSON parsing improvements.
Security assessment
The changes explicitly add security measures including: input parameter validation to prevent unintended execution, secure temporary directory usage, log file permission hardening (chmod 600), prevention of credential leakage by not logging raw commands, and safer JSON parsing. These directly address potential security weaknesses in script execution.
Diff
diff --git a/code-library/latest/ug/support_example_support_GettingStarted_062_section.md b/code-library/latest/ug/support_example_support_GettingStarted_062_section.md index 8cd655e16..19fc1a583 100644 --- a//code-library/latest/ug/support_example_support_GettingStarted_062_section.md +++ b//code-library/latest/ug/support_example_support_GettingStarted_062_section.md @@ -38,3 +38 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Set up logging - LOG_FILE="aws-support-tutorial.log" - echo "Starting AWS Support Tutorial at $(date)" > "$LOG_FILE" + set -euo pipefail @@ -42 +40,33 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to log commands and their outputs + # Security: Validate script location and permissions + SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + readonly SCRIPT_DIR + + # Security: Use secure temporary directory + readonly TEMP_DIR="$(mktemp -d)" || { echo "Failed to create temp directory"; exit 1; } + trap "rm -rf '$TEMP_DIR'" EXIT + + # Set up logging with secure permissions + LOG_FILE="${TEMP_DIR}/aws-support-tutorial.log" + touch "$LOG_FILE" + chmod 600 "$LOG_FILE" + + # Security: Validate AWS CLI is available + if ! command -v aws &> /dev/null; then + echo "ERROR: AWS CLI is not installed or not in PATH" >&2 + exit 1 + fi + + # Security: Check AWS credentials are configured + if ! aws sts get-caller-identity &> /dev/null; then + echo "ERROR: AWS credentials are not properly configured" >&2 + exit 1 + fi + + { + echo "Starting AWS Support Tutorial at $(date)" + echo "Script: $0" + echo "User: $(whoami)" + echo "---" + } >> "$LOG_FILE" + + # Function to log commands and their outputs securely @@ -44,2 +74,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$(date): Running command: $1" >> "$LOG_FILE" - eval "$1" 2>&1 | tee -a "$LOG_FILE" + local cmd="$1" + echo "$(date): Running command" >> "$LOG_FILE" + # Don't echo the actual command to prevent credential leakage + eval "$cmd" 2>&1 | tee -a "$LOG_FILE" @@ -58 +90 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Command output: $cmd_output" | tee -a "$LOG_FILE" + echo "Command returned status: $cmd_status" >> "$LOG_FILE" @@ -62,9 +94,11 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "" | tee -a "$LOG_FILE" - echo "====================================================" | tee -a "$LOG_FILE" - echo "IMPORTANT: This account does not have the required AWS Support plan." | tee -a "$LOG_FILE" - echo "You need a Business, Enterprise On-Ramp, or Enterprise Support plan" | tee -a "$LOG_FILE" - echo "to use the AWS Support API." | tee -a "$LOG_FILE" - echo "" | tee -a "$LOG_FILE" - echo "This script will now demonstrate the commands that would be run" | tee -a "$LOG_FILE" - echo "if you had the appropriate support plan, but will not execute them." | tee -a "$LOG_FILE" - echo "====================================================" | tee -a "$LOG_FILE" + { + echo "" + echo "====================================================" + echo "IMPORTANT: This account does not have the required AWS Support plan." + echo "You need a Business, Enterprise On-Ramp, or Enterprise Support plan" + echo "to use the AWS Support API." + echo "" + echo "This script will now demonstrate the commands that would be run" + echo "if you had the appropriate support plan, but will not execute them." + echo "====================================================" + } | tee -a "$LOG_FILE" @@ -72 +105,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Switch to demo mode @@ -85,0 +119 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + echo "Cleaning up resources..." | tee -a "$LOG_FILE" @@ -94,5 +128,15 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "" | tee -a "$LOG_FILE" - echo "DEMO: $description" | tee -a "$LOG_FILE" - echo "Command that would be executed:" | tee -a "$LOG_FILE" - echo "$cmd" | tee -a "$LOG_FILE" - echo "" | tee -a "$LOG_FILE" + { + echo "" + echo "DEMO: $description" + echo "Command that would be executed:" + echo " [Command hidden for security]" + echo "" + } | tee -a "$LOG_FILE" + } + + # Function to safely extract JSON values + extract_json_value() { + local json_output="$1" + local key="$2" + + echo "$json_output" | grep -o "\"$key\": \"[^\"]*\"" | head -1 | cut -d'"' -f4 || echo "" @@ -106,0 +151,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Security: Validate input parameters + if [[ $# -gt 0 ]]; then + echo "ERROR: This script does not accept parameters" >&2 + exit 1 + fi + + { @@ -114,0 +166 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + } | tee -a "$LOG_FILE" @@ -117,2 +169,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Step 1: Checking available AWS Support services..." - SERVICES_OUTPUT=$(log_cmd "aws support describe-services --language en") + echo "Step 1: Checking available AWS Support services..." | tee -a "$LOG_FILE" + SERVICES_OUTPUT=$(log_cmd "aws support describe-services --language en" 2>&1) || SERVICES_OUTPUT="" @@ -126,2 +178,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Extract a service code for demonstration - SERVICE_CODE=$(echo "$SERVICES_OUTPUT" | grep -o '"code": "[^"]*"' | head -1 | cut -d'"' -f4) + # Extract a service code for demonstration using safer method + SERVICE_CODE=$(extract_json_value "$SERVICES_OUTPUT" "code") || SERVICE_CODE="" @@ -137 +189 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Step 2: Checking available severity levels..." + echo "Step 2: Checking available severity levels..." | tee -a "$LOG_FILE" @@ -143 +195 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SEVERITY_OUTPUT=$(log_cmd "aws support describe-severity-levels --language en") + SEVERITY_OUTPUT=$(log_cmd "aws support describe-severity-levels --language en" 2>&1) || SEVERITY_OUTPUT="" @@ -146,2 +198 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Extract a severity code for demonstration - SEVERITY_CODE=$(echo "$SEVERITY_OUTPUT" | grep -o '"code": "[^"]*"' | head -1 | cut -d'"' -f4) + SEVERITY_CODE=$(extract_json_value "$SEVERITY_OUTPUT" "code") || SEVERITY_CODE="" @@ -156,0 +208 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + { @@ -160,0 +213,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + } | tee -a "$LOG_FILE" + @@ -161,0 +216 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + { @@ -164,0 +220 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + } | tee -a "$LOG_FILE" @@ -166,5 +221,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Get user email for demo - echo "Enter your email address for the demo (leave blank to use [email protected]): " - read -r USER_EMAIL - - if [[ -z "$USER_EMAIL" ]]; then @@ -172 +222,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - fi @@ -174,11 +224,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Demo create case command - demo_cmd "aws support create-case \ - --subject \"AWS CLI Tutorial Test Case\" \ - --service-code \"$SERVICE_CODE\" \ - --category-code \"using-aws\" \ - --communication-body \"This is a test case created as part of an AWS CLI tutorial.\" \ - --severity-code \"$SEVERITY_CODE\" \ - --language \"en\" \ - --cc-email-addresses \"$USER_EMAIL\"" "Create a support case" - - # Use a fake case ID for demo + demo_cmd "aws support create-case" "Create a support case" + @@ -188,20 +229,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Demo list cases command - demo_cmd "aws support describe-cases \ - --case-id-list \"$CASE_ID\" \ - --include-resolved-cases false \ - --language \"en\"" "List support cases" - - # Demo add communication command - demo_cmd "aws support add-communication-to-case \ - --case-id \"$CASE_ID\" \ - --communication-body \"This is an additional communication for the test case.\" \ - --cc-email-addresses \"$USER_EMAIL\"" "Add communication to case" - - # Demo view communications command - demo_cmd "aws support describe-communications \ - --case-id \"$CASE_ID\" \ - --language \"en\"" "View case communications" - - # Demo resolve case command - demo_cmd "aws support resolve-case \ - --case-id \"$CASE_ID\"" "Resolve the support case" + demo_cmd "aws support describe-cases" "List support cases" + demo_cmd "aws support add-communication-to-case" "Add communication to case" + demo_cmd "aws support describe-communications" "View case communications" + demo_cmd "aws support resolve-case" "Resolve the support case" @@ -210,3 +235 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "This will create a test support case in your account." - echo "Do you want to continue? (y/n): " - read -r CREATE_CASE_CHOICE + echo "Creating a test support case..." | tee -a "$LOG_FILE" @@ -214,9 +237 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [[ "$CREATE_CASE_CHOICE" =~ ^[Yy]$ ]]; then - echo "Creating a test support case..." - - # Get user email for CC - echo "Enter your email address for case notifications (leave blank to skip): " - read -r USER_EMAIL - - CC_EMAIL_PARAM=""