AWS ec2 documentation change
Summary
Updated example script for Elastic Load Balancing v2 with improved error handling, input validation, and cleanup procedures. Added validation functions for ARN, security group ID, and VPC ID formats, enhanced error redirection to stderr, and added security warnings about open security group rules.
Security assessment
The changes add security-related documentation including a warning about allowing HTTP from 0.0.0.0/0 and recommending restriction to specific IP addresses in production. It also adds input validation functions that help prevent misconfigurations, but there is no evidence this addresses a specific security vulnerability or incident.
Diff
diff --git a/ec2/latest/devguide/example_elastic_load_balancing_v2_GettingStarted_058_section.md b/ec2/latest/devguide/example_elastic_load_balancing_v2_GettingStarted_058_section.md index 0272357ce..8510596dc 100644 --- a//ec2/latest/devguide/example_elastic_load_balancing_v2_GettingStarted_058_section.md +++ b//ec2/latest/devguide/example_elastic_load_balancing_v2_GettingStarted_058_section.md @@ -43,0 +44,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + set -euo pipefail + @@ -53 +55 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "ERROR: $1" + echo "ERROR: $1" >&2 @@ -59 +61 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to check command success + # Function to check AWS CLI command success @@ -61,2 +63,27 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$1" | grep -i "error" > /dev/null; then - handle_error "$1" + local output="$1" + if [[ -z "$output" ]] || [[ "$output" == "None" ]]; then + handle_error "AWS CLI command returned empty or invalid output" + fi + } + + # Function to validate ARN format + validate_arn() { + local arn="$1" + if [[ ! "$arn" =~ ^arn:aws:[a-z0-9-]+:[a-z0-9-]*:[0-9]{12}:.+$ ]]; then + handle_error "Invalid ARN format: $arn" + fi + } + + # Function to validate security group ID + validate_security_group_id() { + local sg_id="$1" + if [[ ! "$sg_id" =~ ^sg-[a-f0-9]{8,17}$ ]]; then + handle_error "Invalid security group ID format: $sg_id" + fi + } + + # Function to validate VPC ID + validate_vpc_id() { + local vpc_id="$1" + if [[ ! "$vpc_id" =~ ^vpc-[a-f0-9]{8,17}$ ]]; then + handle_error "Invalid VPC ID format: $vpc_id" @@ -70 +97 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$LISTENER_ARN" ]; then + if [ -n "${LISTENER_ARN:-}" ]; then @@ -72 +99 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 delete-listener --listener-arn "$LISTENER_ARN" + aws elbv2 delete-listener --listener-arn "$LISTENER_ARN" 2>/dev/null || true @@ -75 +102 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$LOAD_BALANCER_ARN" ]; then + if [ -n "${LOAD_BALANCER_ARN:-}" ]; then @@ -77 +104 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 delete-load-balancer --load-balancer-arn "$LOAD_BALANCER_ARN" + aws elbv2 delete-load-balancer --load-balancer-arn "$LOAD_BALANCER_ARN" 2>/dev/null || true @@ -81 +108 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 wait load-balancers-deleted --load-balancer-arns "$LOAD_BALANCER_ARN" + aws elbv2 wait load-balancers-deleted --load-balancer-arns "$LOAD_BALANCER_ARN" 2>/dev/null || true @@ -84 +111 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$TARGET_GROUP_ARN" ]; then + if [ -n "${TARGET_GROUP_ARN:-}" ]; then @@ -86 +113 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 delete-target-group --target-group-arn "$TARGET_GROUP_ARN" + aws elbv2 delete-target-group --target-group-arn "$TARGET_GROUP_ARN" 2>/dev/null || true @@ -89,3 +116 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Add a delay before attempting to delete the security group - # to ensure all ELB resources are fully deleted - if [ -n "$SECURITY_GROUP_ID" ]; then + if [ -n "${SECURITY_GROUP_ID:-}" ]; then @@ -96,8 +121,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SG_DELETE_OUTPUT=$(aws ec2 delete-security-group --group-id "$SECURITY_GROUP_ID" 2>&1) - - # If there's still a dependency issue, retry a few times - RETRY_COUNT=0 - MAX_RETRIES=5 - while echo "$SG_DELETE_OUTPUT" | grep -i "DependencyViolation" > /dev/null && [ $RETRY_COUNT -lt $MAX_RETRIES ]; do - RETRY_COUNT=$((RETRY_COUNT+1)) - echo "Security group still has dependencies. Retrying in 30 seconds... (Attempt $RETRY_COUNT of $MAX_RETRIES)" + local sg_delete_output + sg_delete_output=$(aws ec2 delete-security-group --group-id "$SECURITY_GROUP_ID" 2>&1 || true) + + local retry_count=0 + local max_retries=5 + while echo "$sg_delete_output" | grep -i "DependencyViolation" > /dev/null && [ $retry_count -lt $max_retries ]; do + retry_count=$((retry_count+1)) + echo "Security group still has dependencies. Retrying in 30 seconds... (Attempt $retry_count of $max_retries)" @@ -105 +130 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SG_DELETE_OUTPUT=$(aws ec2 delete-security-group --group-id "$SECURITY_GROUP_ID" 2>&1) + sg_delete_output=$(aws ec2 delete-security-group --group-id "$SECURITY_GROUP_ID" 2>&1 || true) @@ -108,2 +133,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$SG_DELETE_OUTPUT" | grep -i "error" > /dev/null; then - echo "WARNING: Could not delete security group: $SECURITY_GROUP_ID" + if echo "$sg_delete_output" | grep -i "error" > /dev/null; then + echo "WARNING: Could not delete security group: $SECURITY_GROUP_ID" >&2 @@ -120,0 +146,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Verify AWS CLI is available + if ! command -v aws &> /dev/null; then + handle_error "AWS CLI is not installed or not in PATH" + fi + @@ -123,2 +153 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 help > /dev/null 2>&1 - if [ $? -ne 0 ]; then + if ! aws elbv2 help > /dev/null 2>&1; then @@ -130 +159 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VPC_INFO=$(aws ec2 describe-vpcs --filters "Name=isDefault,Values=true" --query "Vpcs[0].VpcId" --output text) + VPC_INFO=$(aws ec2 describe-vpcs --filters "Name=isDefault,Values=true" --query "Vpcs[0].VpcId" --output text 2>/dev/null || echo "") @@ -132 +161,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VPC_ID=$VPC_INFO + VPC_ID="$VPC_INFO" + validate_vpc_id "$VPC_ID" @@ -137 +167 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SUBNET_INFO=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC_ID" --query "Subnets[0:2].SubnetId" --output text) + SUBNET_INFO=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC_ID" --query "Subnets[0:2].SubnetId" --output text 2>/dev/null || echo "") @@ -154 +184 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "GroupId" --output text) + --query "GroupId" --output text 2>/dev/null || echo "") @@ -156 +186,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SECURITY_GROUP_ID=$SG_INFO + SECURITY_GROUP_ID="$SG_INFO" + validate_security_group_id "$SECURITY_GROUP_ID" @@ -165,2 +196,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --cidr "0.0.0.0/0" > /dev/null - # Note: In production, you should restrict the CIDR range to specific IP addresses + --cidr "0.0.0.0/0" > /dev/null 2>&1 || handle_error "Failed to authorize security group ingress" + + echo "WARNING: Security group allows HTTP from 0.0.0.0/0. In production, restrict to specific IP addresses." >&2 @@ -174 +206 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "LoadBalancers[0].LoadBalancerArn" --output text) + --query "LoadBalancers[0].LoadBalancerArn" --output text 2>/dev/null || echo "") @@ -176 +208,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LOAD_BALANCER_ARN=$LB_INFO + LOAD_BALANCER_ARN="$LB_INFO" + validate_arn "$LOAD_BALANCER_ARN" @@ -181 +214,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 wait load-balancer-available --load-balancer-arns "$LOAD_BALANCER_ARN" + if ! aws elbv2 wait load-balancer-available --load-balancer-arns "$LOAD_BALANCER_ARN" 2>/dev/null; then + handle_error "Load balancer did not reach active state within timeout period" + fi @@ -191 +226 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "TargetGroups[0].TargetGroupArn" --output text) + --query "TargetGroups[0].TargetGroupArn" --output text 2>/dev/null || echo "") @@ -193 +228,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - TARGET_GROUP_ARN=$TG_INFO + TARGET_GROUP_ARN="$TG_INFO" + validate_arn "$TARGET_GROUP_ARN" @@ -200,2 +236 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "Reservations[*].Instances[*].InstanceId" --output text) - check_command "$INSTANCES" + --query "Reservations[*].Instances[*].InstanceId" --output text 2>/dev/null || echo "") @@ -212 +247 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - TARGET_ARGS="" + target_args=() @@ -214,2 +249,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$i" -lt 2 ]; then # Register up to 2 instances - TARGET_ARGS="$TARGET_ARGS Id=${INSTANCE_IDS[$i]} " + if [ "$i" -lt 2 ]; then + target_args+=("Id=${INSTANCE_IDS[$i]}") @@ -219,2 +254,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$TARGET_ARGS" ]; then - aws elbv2 register-targets \ + if [ ${#target_args[@]} -gt 0 ]; then + if aws elbv2 register-targets \ @@ -222,2 +257,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --targets $TARGET_ARGS - echo "Registered instances: $TARGET_ARGS" + --targets "${target_args[@]}" 2>/dev/null; then + echo "Registered instances: ${target_args[*]}" + else + handle_error "Failed to register targets" + fi @@ -234 +272 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "Listeners[0].ListenerArn" --output text) + --query "Listeners[0].ListenerArn" --output text 2>/dev/null || echo "") @@ -236 +274,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LISTENER_ARN=$LISTENER_INFO + LISTENER_ARN="$LISTENER_INFO" + validate_arn "$LISTENER_ARN" @@ -241 +280 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws elbv2 describe-target-health --target-group-arn "$TARGET_GROUP_ARN" + aws elbv2 describe-target-health --target-group-arn "$TARGET_GROUP_ARN" 2>/dev/null || true @@ -246 +285 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query "LoadBalancers[0].DNSName" --output text) + --query "LoadBalancers[0].DNSName" --output text 2>/dev/null || echo "") @@ -262 +301 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Ask user if they want to clean up resources + # Prompt for cleanup confirmation @@ -266,2 +305 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Do you want to clean up all created resources? (y/n): " - read -r CLEANUP_CHOICE + read -p "Do you want to clean up all created resources? (y/n): " -r CLEANUP_CHOICE @@ -269 +307 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [[ "$CLEANUP_CHOICE" =~ ^[Yy] ]]; then + if [[ "$CLEANUP_CHOICE" =~ ^[Yy]$ ]]; then