AWS ec2 documentation change
Summary
Updated AWS MediaConnect example script with security hardening including umask restrictions, file permission controls, input validation, secure error handling, and improved resource cleanup
Security assessment
The changes add security best practices to an example script but don't fix a specific security vulnerability. Security improvements include: setting restrictive umask (0077) to prevent world-readable files, securing log files with chmod 600, validating AWS CLI version and credentials, implementing ARN format validation, adding input validation for AWS region and availability zone formats, using safer JSON parsing with jq, and improving error handling. These are proactive security enhancements rather than fixes for reported vulnerabilities.
Diff
diff --git a/ec2/latest/devguide/example_mediaconnect_GettingStarted_081_section.md b/ec2/latest/devguide/example_mediaconnect_GettingStarted_081_section.md index 9fc00c029..dda471d9f 100644 --- a//ec2/latest/devguide/example_mediaconnect_GettingStarted_081_section.md +++ b//ec2/latest/devguide/example_mediaconnect_GettingStarted_081_section.md @@ -39 +39,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Set up logging + set -euo pipefail + + # Security: Restrict umask to prevent world-readable files + umask 0077 + + # Set up logging with restricted permissions @@ -40,0 +46,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + touch "$LOG_FILE" + chmod 600 "$LOG_FILE" @@ -48 +55 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "ERROR: $1" + echo "ERROR: $1" >&2 @@ -53,0 +61,45 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Function to validate AWS CLI is available + validate_aws_cli() { + if ! command -v aws &> /dev/null; then + handle_error "AWS CLI is not installed or not in PATH" + fi + + # Security: Verify AWS CLI version is recent + local aws_version + aws_version=$(aws --version 2>&1 | head -1) + echo "AWS CLI version: $aws_version" + + if ! aws sts get-caller-identity &> /dev/null; then + handle_error "AWS credentials are not configured or invalid" + fi + + # Security: Validate caller identity + local account_id + account_id=$(aws sts get-caller-identity --query Account --output text 2>/dev/null) + if [ -z "$account_id" ]; then + handle_error "Failed to retrieve AWS account ID" + fi + echo "AWS Account ID: $account_id" + } + + # Function to safely extract JSON values using jq (preferred) or fallback + extract_json_value() { + local json_output="$1" + local key="$2" + + if [ -z "$json_output" ]; then + return 1 + fi + + # Security: Use jq if available for safer JSON parsing + if command -v jq &> /dev/null; then + echo "$json_output" | jq -r ".${key} // empty" 2>/dev/null || return 1 + else + # Fallback with additional validation + if ! echo "$json_output" | grep -q "\"$key\""; then + return 1 + fi + echo "$json_output" | grep -o "\"$key\": \"[^\"]*" | head -1 | cut -d'"' -f4 + fi + } + @@ -58 +110,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$FLOW_ARN" ]; then + if [ -n "${FLOW_ARN:-}" ]; then + # Security: Validate ARN format before using it + if [[ ! "$FLOW_ARN" =~ ^arn:aws:mediaconnect:[a-z0-9-]+:[0-9]+:flow:[a-zA-Z0-9:-]+$ ]]; then + echo "WARNING: Invalid Flow ARN format, skipping cleanup: $FLOW_ARN" + return 1 + fi + @@ -61,2 +119,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - FLOW_STATUS_OUTPUT=$(aws mediaconnect describe-flow --flow-arn "$FLOW_ARN" --query "Flow.Status" --output text 2>&1) - echo "Current flow status: $FLOW_STATUS_OUTPUT" + local flow_status_output + if flow_status_output=$(aws mediaconnect describe-flow --flow-arn "$FLOW_ARN" --query "Flow.Status" --output text 2>&1); then + echo "Current flow status: $flow_status_output" @@ -64 +123 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$FLOW_STATUS_OUTPUT" == "ACTIVE" ] || [ "$FLOW_STATUS_OUTPUT" == "UPDATING" ]; then + if [ "$flow_status_output" == "ACTIVE" ] || [ "$flow_status_output" == "UPDATING" ]; then @@ -66,7 +125 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - STOP_FLOW_OUTPUT=$(aws mediaconnect stop-flow --flow-arn "$FLOW_ARN" 2>&1) - if echo "$STOP_FLOW_OUTPUT" | grep -i "error" > /dev/null; then - echo "WARNING: Failed to stop flow. Output: $STOP_FLOW_OUTPUT" - echo "Attempting to delete anyway..." - else - echo "$STOP_FLOW_OUTPUT" - + if aws mediaconnect stop-flow --flow-arn "$FLOW_ARN" 2>&1; then @@ -75,0 +129,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + else + echo "WARNING: Failed to stop flow. Attempting to delete anyway..." @@ -83,4 +138,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - DELETE_FLOW_OUTPUT=$(aws mediaconnect delete-flow --flow-arn "$FLOW_ARN" 2>&1) - if echo "$DELETE_FLOW_OUTPUT" | grep -i "error" > /dev/null; then - echo "WARNING: Failed to delete flow. Output: $DELETE_FLOW_OUTPUT" - echo "You may need to manually delete the flow from the AWS console." + if aws mediaconnect delete-flow --flow-arn "$FLOW_ARN" 2>&1; then + echo "Flow deleted successfully" @@ -88 +141,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$DELETE_FLOW_OUTPUT" + echo "WARNING: Failed to delete flow. You may need to manually delete it from the AWS console." + fi + else + echo "WARNING: Could not check flow status" @@ -92,0 +149,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Set trap to cleanup on script exit + trap cleanup_resources EXIT + + # Validate AWS CLI setup + validate_aws_cli + @@ -94,2 +156,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - AWS_REGION=$(aws configure get region) - if [ -z "$AWS_REGION" ]; then + aws_region="" + if aws_region=$(aws configure get region 2>/dev/null); then + if [ -z "$aws_region" ]; then @@ -97,0 +161,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + else + handle_error "Failed to retrieve AWS region configuration" + fi + + # Security: Validate region format + if [[ ! "$aws_region" =~ ^[a-z]{2}-[a-z]+-[0-9]$ ]]; then + handle_error "Invalid AWS region format: $aws_region" + fi + + AWS_REGION="$aws_region" @@ -102,3 +175,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - AZ_OUTPUT=$(aws ec2 describe-availability-zones --region "$AWS_REGION" --query "AvailabilityZones[0].ZoneName" --output text 2>&1) - if echo "$AZ_OUTPUT" | grep -i "error" > /dev/null; then - handle_error "Failed to get availability zones. Output: $AZ_OUTPUT" + az_output="" + if az_output=$(aws ec2 describe-availability-zones --region "$AWS_REGION" --query "AvailabilityZones[0].ZoneName" --output text 2>&1); then + AVAILABILITY_ZONE="$az_output" + if [ -z "$AVAILABILITY_ZONE" ]; then + handle_error "Failed to retrieve availability zones" + fi + + # Security: Validate AZ format + if [[ ! "$AVAILABILITY_ZONE" =~ ^[a-z]{2}-[a-z]+-[0-9][a-z]$ ]]; then + handle_error "Invalid availability zone format: $AVAILABILITY_ZONE" @@ -106 +186 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - AVAILABILITY_ZONE="$AZ_OUTPUT" + @@ -107,0 +188,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + else + handle_error "Failed to get availability zones" + fi @@ -124,3 +207,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LIST_FLOWS_OUTPUT=$(aws mediaconnect list-flows 2>&1) - if echo "$LIST_FLOWS_OUTPUT" | grep -i "error" > /dev/null; then - handle_error "Failed to list flows. Please check your AWS credentials and permissions. Output: $LIST_FLOWS_OUTPUT" + list_flows_output="" + if list_flows_output=$(aws mediaconnect list-flows 2>&1); then + echo "$list_flows_output" + else + handle_error "Failed to list flows. Please check your AWS credentials and permissions." @@ -128 +212,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$LIST_FLOWS_OUTPUT" @@ -132 +216,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - CREATE_FLOW_OUTPUT=$(aws mediaconnect create-flow \ + create_flow_output="" + if create_flow_output=$(aws mediaconnect create-flow \ @@ -135,4 +220,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --source "Name=$SOURCE_NAME,Protocol=zixi-push,WhitelistCidr=10.24.34.0/23,StreamId=ZixiAwardsNYCFeed" 2>&1) - - if echo "$CREATE_FLOW_OUTPUT" | grep -i "error" > /dev/null; then - handle_error "Failed to create flow. Output: $CREATE_FLOW_OUTPUT" + --source "Name=$SOURCE_NAME,Protocol=zixi-push,WhitelistCidr=10.24.34.0/23,StreamId=ZixiAwardsNYCFeed" 2>&1); then + echo "$create_flow_output" + else + handle_error "Failed to create flow" @@ -140 +224,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$CREATE_FLOW_OUTPUT" @@ -143 +227,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - FLOW_ARN=$(echo "$CREATE_FLOW_OUTPUT" | grep -o '"FlowArn": "[^"]*' | cut -d'"' -f4) + FLOW_ARN=$(echo "$create_flow_output" | jq -r '.Flow.FlowArn // empty' 2>/dev/null) + if [ -z "$FLOW_ARN" ]; then + FLOW_ARN=$(echo "$create_flow_output" | grep -o '"FlowArn": "[^"]*' | head -1 | cut -d'"' -f4) + fi @@ -148,0 +236,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate flow ARN format + if [[ ! "$FLOW_ARN" =~ ^arn:aws:mediaconnect:[a-z0-9-]+:[0-9]+:flow:[a-zA-Z0-9:-]+$ ]]; then + handle_error "Invalid Flow ARN format: $FLOW_ARN" + fi + @@ -151 +243,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - ADD_OUTPUT_OUTPUT=$(aws mediaconnect add-flow-outputs \ + add_output_output="" + if add_output_output=$(aws mediaconnect add-flow-outputs \ @@ -153,4 +246,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --outputs "Name=$OUTPUT_NAME,Protocol=zixi-push,Destination=198.51.100.11,Port=1024,StreamId=ZixiAwardsOutput" 2>&1) - - if echo "$ADD_OUTPUT_OUTPUT" | grep -i "error" > /dev/null; then - handle_error "Failed to add output to flow. Output: $ADD_OUTPUT_OUTPUT" + --outputs "Name=$OUTPUT_NAME,Protocol=zixi-push,Destination=198.51.100.11,Port=1024,StreamId=ZixiAwardsOutput" 2>&1); then