AWS ec2 medium security documentation change
Summary
Enhanced example script with improved security practices including AWS credential validation, input sanitization, error handling, timeout mechanisms, and automated cleanup. Added CIDR validation, AWS output verification, and failure detection.
Security assessment
The changes explicitly add security measures like credential validation (preventing unauthorized operations), input sanitization (blocking malformed CIDR blocks), and improved error handling (preventing resource leaks). The commit message states '# Security improved' and implements concrete safeguards against common security risks in infrastructure scripts.
Diff
diff --git a/ec2/latest/devguide/example_vpc_TransitGatewayGettingStarted_section.md b/ec2/latest/devguide/example_vpc_TransitGatewayGettingStarted_section.md index 745e48bc7..1850cdbf5 100644 --- a//ec2/latest/devguide/example_vpc_TransitGatewayGettingStarted_section.md +++ b//ec2/latest/devguide/example_vpc_TransitGatewayGettingStarted_section.md @@ -39,0 +40 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Security improved: Added input validation, error handling, and credential checks @@ -42 +43 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -e + set -euo pipefail @@ -45,0 +47,26 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Security: Check for required AWS credentials + if ! aws sts get-caller-identity &>/dev/null; then + echo "ERROR: AWS credentials not configured or invalid. Please configure AWS credentials." + exit 1 + fi + + # Function to validate AWS CLI output + validate_aws_output() { + local output=$1 + local context=$2 + + if [ -z "$output" ] || [ "$output" = "None" ]; then + echo "ERROR: Failed to retrieve $context from AWS API" + return 1 + fi + } + + # Function to validate CIDR blocks + validate_cidr() { + local cidr=$1 + if ! [[ "$cidr" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$ ]]; then + echo "ERROR: Invalid CIDR block format: $cidr" + return 1 + fi + } + @@ -48,0 +76,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local max_attempts=60 + local attempt=0 + @@ -51,2 +81,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - status=$(aws ec2 describe-transit-gateways --transit-gateway-ids "$tgw_id" --query "TransitGateways[0].State" --output text) + while [ $attempt -lt $max_attempts ]; do + status=$(aws ec2 describe-transit-gateways \ + --transit-gateway-ids "$tgw_id" \ + --query "TransitGateways[0].State" \ + --output text 2>/dev/null || echo "failed") + @@ -57 +91,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - break + return 0 + fi + + if [ "$status" = "failed" ]; then + echo "ERROR: Transit Gateway creation failed" + return 1 @@ -61,0 +101 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + ((attempt++)) @@ -62,0 +103,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + echo "ERROR: Timeout waiting for transit gateway to become available" + return 1 @@ -67,0 +111,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local max_attempts=60 + local attempt=0 + @@ -70,2 +116,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - status=$(aws ec2 describe-transit-gateway-vpc-attachments --transit-gateway-attachment-ids "$attachment_id" --query "TransitGatewayVpcAttachments[0].State" --output text) + while [ $attempt -lt $max_attempts ]; do + status=$(aws ec2 describe-transit-gateway-vpc-attachments \ + --transit-gateway-attachment-ids "$attachment_id" \ + --query "TransitGatewayVpcAttachments[0].State" \ + --output text 2>/dev/null || echo "failed") + @@ -76 +126,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - break + return 0 + fi + + if [ "$status" = "failed" ]; then + echo "ERROR: Transit Gateway Attachment creation failed" + return 1 @@ -80,0 +136 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + ((attempt++)) @@ -81,0 +138,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + echo "ERROR: Timeout waiting for transit gateway attachment to become available" + return 1 @@ -86,0 +146,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local max_attempts=60 + local attempt=0 + @@ -89,3 +151,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - # Check if the attachment still exists - count=$(aws ec2 describe-transit-gateway-vpc-attachments --filters "Name=transit-gateway-attachment-id,Values=$attachment_id" --query "length(TransitGatewayVpcAttachments)" --output text) + while [ $attempt -lt $max_attempts ]; do + count=$(aws ec2 describe-transit-gateway-vpc-attachments \ + --filters "Name=transit-gateway-attachment-id,Values=$attachment_id" \ + --query "length(TransitGatewayVpcAttachments)" \ + --output text 2>/dev/null || echo "0") @@ -95 +159 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - break + return 0 @@ -98 +162,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - status=$(aws ec2 describe-transit-gateway-vpc-attachments --transit-gateway-attachment-ids "$attachment_id" --query "TransitGatewayVpcAttachments[0].State" --output text 2>/dev/null || echo "deleted") + status=$(aws ec2 describe-transit-gateway-vpc-attachments \ + --transit-gateway-attachment-ids "$attachment_id" \ + --query "TransitGatewayVpcAttachments[0].State" \ + --output text 2>/dev/null || echo "deleted") @@ -100,3 +167,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$status" = "deleted" ]; then - echo "Transit Gateway Attachment has been deleted" - break + if [ "$status" = "deleted" ] || [ "$status" = "deleting" ]; then + echo "Transit Gateway Attachment is being deleted. Current state: $status" @@ -106,0 +173 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + ((attempt++)) @@ -107,0 +175,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + echo "WARNING: Timeout waiting for transit gateway attachment to be deleted" + return 0 @@ -112 +182,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Error occurred. Cleaning up resources..." + local exit_code=$? + echo "Error occurred (exit code: $exit_code). Cleaning up resources..." @@ -115 +186 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ ! -z "$TGW_ATTACHMENT_1_ID" ]; then + if [ -n "${TGW_ATTACHMENT_1_ID:-}" ]; then @@ -117 +188,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws ec2 delete-transit-gateway-vpc-attachment --transit-gateway-attachment-id "$TGW_ATTACHMENT_1_ID" || true + aws ec2 delete-transit-gateway-vpc-attachment \ + --transit-gateway-attachment-id "$TGW_ATTACHMENT_1_ID" &>/dev/null || true @@ -121 +193 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ ! -z "$TGW_ATTACHMENT_2_ID" ]; then + if [ -n "${TGW_ATTACHMENT_2_ID:-}" ]; then @@ -123 +195,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws ec2 delete-transit-gateway-vpc-attachment --transit-gateway-attachment-id "$TGW_ATTACHMENT_2_ID" || true + aws ec2 delete-transit-gateway-vpc-attachment \ + --transit-gateway-attachment-id "$TGW_ATTACHMENT_2_ID" &>/dev/null || true @@ -127 +200 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ ! -z "$TGW_ID" ]; then + if [ -n "${TGW_ID:-}" ]; then @@ -129 +202 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws ec2 delete-transit-gateway --transit-gateway-id "$TGW_ID" || true + aws ec2 delete-transit-gateway --transit-gateway-id "$TGW_ID" &>/dev/null || true @@ -132 +205 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - exit 1 + exit "$exit_code" @@ -136 +209 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - trap cleanup ERR + trap cleanup EXIT @@ -144 +217,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - AZ=$(aws ec2 describe-availability-zones --query "AvailabilityZones[0].ZoneName" --output text) + AZ=$(aws ec2 describe-availability-zones \ + --query "AvailabilityZones[0].ZoneName" \ + --output text) + validate_aws_output "$AZ" "availability zone" || exit 1 @@ -149,2 +225,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VPC1_ID=$(aws ec2 describe-vpcs --filters "Name=tag:Name,Values=VPC1" --query "Vpcs[0].VpcId" --output text) - VPC2_ID=$(aws ec2 describe-vpcs --filters "Name=tag:Name,Values=VPC2" --query "Vpcs[0].VpcId" --output text) + VPC1_ID=$(aws ec2 describe-vpcs \ + --filters "Name=tag:Name,Values=VPC1" \ + --query "Vpcs[0].VpcId" \ + --output text) + VPC2_ID=$(aws ec2 describe-vpcs \ + --filters "Name=tag:Name,Values=VPC2" \ + --query "Vpcs[0].VpcId" \ + --output text) @@ -152 +234 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$VPC1_ID" == "None" ] || [ -z "$VPC1_ID" ]; then + if [ "$VPC1_ID" = "None" ] || [ -z "$VPC1_ID" ]; then @@ -154 +236,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - VPC1_ID=$(aws ec2 create-vpc --cidr-block 10.1.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC1}]' --query Vpc.VpcId --output text) + VPC1_ID=$(aws ec2 create-vpc \ + --cidr-block 10.1.0.0/16 \ + --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC1}]' \ + --query Vpc.VpcId \ + --output text) + validate_aws_output "$VPC1_ID" "VPC1" || exit 1 @@ -159 +246,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SUBNET1_ID=$(aws ec2 create-subnet --vpc-id "$VPC1_ID" --cidr-block 10.1.0.0/24 --availability-zone "$AZ" --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=VPC1-Subnet}]' --query Subnet.SubnetId --output text) + SUBNET1_ID=$(aws ec2 create-subnet \ + --vpc-id "$VPC1_ID" \ + --cidr-block 10.1.0.0/24 \ + --availability-zone "$AZ" \ + --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=VPC1-Subnet}]' \ + --query Subnet.SubnetId \ + --output text) + validate_aws_output "$SUBNET1_ID" "VPC1 subnet" || exit 1 @@ -163,2 +257,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SUBNET1_ID=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC1_ID" --query "Subnets[0].SubnetId" --output text) - if [ "$SUBNET1_ID" == "None" ] || [ -z "$SUBNET1_ID" ]; then + SUBNET1_ID=$(aws ec2 describe-subnets \ + --filters "Name=vpc-id,Values=$VPC1_ID" \ + --query "Subnets[0].SubnetId" \ + --output text) + if [ "$SUBNET1_ID" = "None" ] || [ -z "$SUBNET1_ID" ]; then