AWS lambda documentation change
Summary
Updated AWS Lambda getting started example with improved error handling, input validation, and security best practices including secure random ID generation, input sanitization, and better script robustness
Security assessment
The changes add security-focused improvements to the example script including: 1) Input validation functions to prevent malformed inputs, 2) Secure random ID generation using /dev/urandom with proper byte handling instead of less secure character filtering, 3) Input validation for Lambda function parameters (checking numeric types and non-negative values), 4) IAM role ARN validation, 5) Better error handling with pipefail and exit codes. While these are security improvements, there's no evidence they address a specific security vulnerability or incident - they appear to be general security hardening and best practice updates.
Diff
diff --git a/lambda/latest/dg/example_lambda_GettingStarted_019_section.md b/lambda/latest/dg/example_lambda_GettingStarted_019_section.md index 69cece552..84bc29580 100644 --- a//lambda/latest/dg/example_lambda_GettingStarted_019_section.md +++ b//lambda/latest/dg/example_lambda_GettingStarted_019_section.md @@ -47 +47 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -eE + set -eE -o pipefail @@ -53 +53 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - UNIQUE_ID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1) + UNIQUE_ID=$(head -c 8 /dev/urandom | od -An -tx1 | tr -d ' ') @@ -58,0 +59 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + readonly TEMP_DIR @@ -167,0 +169,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + validate_input() { + local input="$1" + local pattern="$2" + if ! [[ "$input" =~ $pattern ]]; then + echo "ERROR: Invalid input: $input" + return 1 + fi + return 0 + } + @@ -192,2 +203,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Enter your choice (1 or 2): " - read -r RUNTIME_CHOICE + echo "Using default: Python 3.13" + RUNTIME_CHOICE="1" @@ -206,2 +217,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - length = event['length'] - width = event['width'] + if not isinstance(event, dict) or 'length' not in event or 'width' not in event: + raise ValueError('Event must contain length and width') + try: + length = float(event['length']) + width = float(event['width']) + if length < 0 or width < 0: + raise ValueError('Length and width must be non-negative') @@ -211,0 +228,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + except (TypeError, ValueError) as e: + logger.error(f'Error processing input: {str(e)}') + raise @@ -222,0 +242,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if (!event || typeof event.length !== 'number' || typeof event.width !== 'number') { + throw new Error('Event must contain numeric length and width'); + } + if (event.length < 0 || event.width < 0) { + throw new Error('Length and width must be non-negative'); + } @@ -265,0 +291,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + if ! validate_input "$ROLE_OUTPUT" "^arn:aws:iam::[0-9]+:role/"; then + echo "ERROR: Failed to create IAM role" + exit 1 + fi + @@ -295,3 +326,11 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - cd "$TEMP_DIR" - zip -j function.zip "$CODE_FILE" > /dev/null 2>&1 - cd "$ORIGINAL_DIR" + cd "$TEMP_DIR" || exit 1 + zip -j function.zip "$CODE_FILE" > /dev/null 2>&1 || { + echo "ERROR: Failed to create deployment package" + exit 1 + } + cd "$ORIGINAL_DIR" || exit 1 + + if [ ! -f "${TEMP_DIR}/function.zip" ]; then + echo "ERROR: Deployment package creation failed" + exit 1 + fi @@ -312,0 +352,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + if [ -z "$CREATE_OUTPUT" ]; then + echo "ERROR: Failed to create Lambda function" + exit 1 + fi + @@ -335,0 +381,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if ! validate_input "$TEST_EVENT" '"length": [0-9]+, "width": [0-9]+'; then + echo "ERROR: Invalid test event format" + exit 1 + fi + @@ -342,0 +393,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if [ ! -f "${TEMP_DIR}/response.json" ]; then + echo "ERROR: No response file generated" + exit 1 + fi + @@ -416 +471 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "CLEANUP CONFIRMATION" + echo "CLEANUP" @@ -419,4 +474 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Do you want to clean up all created resources? (y/n): " - read -r CLEANUP_CHOICE - - if [[ "$CLEANUP_CHOICE" =~ ^[Yy]$ ]]; then + echo "Cleaning up all created resources..." @@ -424,19 +475,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "" - echo "Resources were NOT deleted. To clean up manually, run:" - echo "" - echo " # Delete the Lambda function" - echo " aws lambda delete-function --function-name ${FUNCTION_NAME}" - echo "" - echo " # Delete the CloudWatch log group" - echo " aws logs delete-log-group --log-group-name ${LOG_GROUP_NAME}" - echo "" - echo " # Detach the policy and delete the IAM role" - echo " aws iam detach-role-policy --role-name ${ROLE_NAME} --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" - echo " aws iam delete-role --role-name ${ROLE_NAME}" - echo "" - - if [ -d "$TEMP_DIR" ]; then - rm -rf "$TEMP_DIR" - fi - fi