AWS iot documentation change
Summary
Updated AWS IoT Device Defender example script with significant improvements to error handling, validation, and robustness. Added JSON validation, retry logic, prerequisite checks, enhanced cleanup process, and better resource management.
Security assessment
This change enhances an IoT Device Defender example script by adding security best practices like JSON validation, proper error handling, and secure resource management. It improves the security posture of the example by validating IAM policies before creation, adding retry logic for IAM operations, and implementing proper cleanup procedures. However, there is no evidence this addresses a specific security vulnerability or incident - it's a general improvement to documentation quality and security practices.
Diff
diff --git a/iot/latest/developerguide/example_iot_GettingStarted_079_section.md b/iot/latest/developerguide/example_iot_GettingStarted_079_section.md index ed122fbf8..127003b56 100644 --- a//iot/latest/developerguide/example_iot_GettingStarted_079_section.md +++ b//iot/latest/developerguide/example_iot_GettingStarted_079_section.md @@ -44,0 +45,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + set -euo pipefail + @@ -57 +59 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$1" | grep -i "An error occurred\|Exception\|Failed\|usage: aws" > /dev/null; then + if echo "$1" | grep -iE "An error occurred|Exception|Failed|usage: aws" > /dev/null; then @@ -65 +67,39 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to create IAM roles + # Function to safely extract JSON values using jq + extract_json_value() { + local json="$1" + local key="$2" + echo "$json" | jq -r ".${key} // empty" 2>/dev/null || echo "" + } + + # Function to validate JSON + validate_json() { + local json="$1" + echo "$json" | jq empty 2>/dev/null + } + + # Function to check AWS CLI availability + check_aws_cli() { + if ! command -v aws &> /dev/null; then + echo "ERROR: AWS CLI is not installed or not in PATH" + return 1 + fi + if ! command -v jq &> /dev/null; then + echo "ERROR: jq is not installed or not in PATH" + return 1 + fi + return 0 + } + + # Function to get AWS account ID + get_account_id() { + local account_id + account_id=$(aws sts get-caller-identity --query 'Account' --output text 2>/dev/null) || true + if [ -z "$account_id" ]; then + echo "ERROR: Could not retrieve AWS account ID" + return 1 + fi + echo "$account_id" + return 0 + } + + # Function to create IAM roles with retry logic @@ -69,0 +110,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + local RETRY_COUNT=0 + local MAX_RETRIES=3 @@ -72,0 +115,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate trust policy JSON + if ! validate_json "$TRUST_POLICY"; then + echo "ERROR: Invalid trust policy JSON for role $ROLE_NAME" + return 1 + fi + @@ -74 +122,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - ROLE_EXISTS=$(aws iam get-role --role-name "$ROLE_NAME" 2>&1 || echo "NOT_EXISTS") + if aws iam get-role --role-name "$ROLE_NAME" >/dev/null 2>&1; then + echo "Role $ROLE_NAME already exists, skipping creation" + ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text 2>/dev/null) || true + if [ -z "$ROLE_ARN" ]; then + echo "ERROR: Could not retrieve ARN for existing role $ROLE_NAME" + return 1 + fi + echo "Role ARN: $ROLE_ARN" + return 0 + fi @@ -76,2 +133,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$ROLE_EXISTS" | grep -i "NoSuchEntity" > /dev/null; then - # Create the role with trust policy + # Create the role with trust policy and retry logic + while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do @@ -80 +137,12 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --assume-role-policy-document "$TRUST_POLICY" 2>&1) + --assume-role-policy-document "$TRUST_POLICY" 2>&1) || true + + if check_error "$ROLE_RESULT"; then + break + fi + + RETRY_COUNT=$((RETRY_COUNT + 1)) + if [ $RETRY_COUNT -lt $MAX_RETRIES ]; then + echo "Retrying role creation (attempt $((RETRY_COUNT + 1))/$MAX_RETRIES)..." + sleep $((RETRY_COUNT * 2)) + fi + done @@ -83 +151 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Failed to create role $ROLE_NAME" + echo "Failed to create role $ROLE_NAME after $MAX_RETRIES attempts" @@ -89 +157,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LOGGING_POLICY='{ + local LOGGING_POLICY + LOGGING_POLICY=$(cat <<'EOF' + { @@ -103,3 +173 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "Resource": [ - "arn:aws:logs:*:*:*" - ] + "Resource": "arn:aws:logs:*:*:*" @@ -108 +176,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) + + if ! validate_json "$LOGGING_POLICY"; then + echo "ERROR: Invalid logging policy JSON" + return 1 + fi @@ -113 +188 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --policy-document "$LOGGING_POLICY" 2>&1) + --policy-document "$LOGGING_POLICY" 2>&1) || true @@ -120 +195,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - MITIGATION_POLICY='{ + local MITIGATION_POLICY + MITIGATION_POLICY=$(cat <<'EOF' + { @@ -130,2 +207 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "iot:AddThingToThingGroup", - "iot:PublishToTopic" + "iot:AddThingToThingGroup" @@ -133 +209 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "Resource": "*" + "Resource": "arn:aws:iot:*:*:*" @@ -146 +222,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) + + if ! validate_json "$MITIGATION_POLICY"; then + echo "ERROR: Invalid mitigation policy JSON" + return 1 + fi @@ -151 +234 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --policy-document "$MITIGATION_POLICY" 2>&1) + --policy-document "$MITIGATION_POLICY" 2>&1) || true @@ -162 +245 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --policy-arn "$MANAGED_POLICY" 2>&1) + --policy-arn "$MANAGED_POLICY" 2>&1) || true @@ -172,3 +254,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "Role $ROLE_NAME already exists, skipping creation" - fi @@ -176,2 +256,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Get the role ARN - ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text) + # Get the role ARN with error handling + ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text 2>/dev/null) || true + if [ -z "$ROLE_ARN" ]; then + echo "ERROR: Could not retrieve ARN for newly created role $ROLE_NAME" + return 1 + fi @@ -184,0 +269,11 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Validate prerequisites + echo "Validating prerequisites..." + if ! check_aws_cli; then + echo "ERROR: Prerequisites not met" + exit 1 + fi + + ACCOUNT_ID=$(get_account_id) || exit 1 + echo "AWS Account ID: $ACCOUNT_ID" + echo "" + @@ -191 +286,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - IOT_DEFENDER_AUDIT_TRUST_POLICY='{ + IOT_DEFENDER_AUDIT_TRUST_POLICY=$(cat <<'EOF' + { @@ -202 +298,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) @@ -204 +302,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - create_iam_role "AWSIoTDeviceDefenderAuditRole" "$IOT_DEFENDER_AUDIT_TRUST_POLICY" "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderAudit" + if ! create_iam_role "AWSIoTDeviceDefenderAuditRole" "$IOT_DEFENDER_AUDIT_TRUST_POLICY" "arn:aws:iam::aws:policy/service-role/AWSIoTDeviceDefenderAudit"; then + echo "ERROR: Failed to create audit role" + exit 1 + fi @@ -209 +310,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - IOT_LOGGING_TRUST_POLICY='{ + IOT_LOGGING_TRUST_POLICY=$(cat <<'EOF' + { @@ -220 +322,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - }' + } + EOF + ) @@ -222 +326,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - create_iam_role "AWSIoTLoggingRole" "$IOT_LOGGING_TRUST_POLICY" "" + if ! create_iam_role "AWSIoTLoggingRole" "$IOT_LOGGING_TRUST_POLICY" ""; then + echo "ERROR: Failed to create logging role" + exit 1