AWS polly medium security documentation change
Summary
Enhanced the AWS Polly getting started script with improved error handling, temporary file management, and security best practices. Changes include adding 'set -euo pipefail', using temporary directories, validating AWS CLI/credentials, truncating lexicon names, and automatic cleanup.
Security assessment
The change introduces security improvements: 1) 'set -euo pipefail' prevents undefined variable use and pipeline failures 2) Temporary directory usage with cleanup reduces sensitive data leakage 3) AWS credential validation prevents misconfiguration risks 4) Lexicon name truncation avoids potential overflows 5) Safer command execution with 'bash -c' mitigates injection risks. These collectively address security weaknesses in resource handling and execution safety.
Diff
diff --git a/polly/latest/dg/example_polly_GettingStarted_082_section.md b/polly/latest/dg/example_polly_GettingStarted_082_section.md index e10334a41..d6713f079 100644 --- a//polly/latest/dg/example_polly_GettingStarted_082_section.md +++ b//polly/latest/dg/example_polly_GettingStarted_082_section.md @@ -31,0 +32,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + set -euo pipefail + @@ -33,0 +36,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + WORK_DIR=$(mktemp -d) + trap 'cleanup_temp' EXIT + + cleanup_temp() { + rm -rf "$WORK_DIR" + } + @@ -39,2 +49,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - eval "$1" 2>&1 | tee -a "$LOG_FILE" - return ${PIPESTATUS[0]} + # Use bash array to safely handle arguments + bash -c "$1" 2>&1 | tee -a "$LOG_FILE" || return $? @@ -45 +55 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if echo "$1" | grep -i "error" > /dev/null; then + if echo "$1" | grep -iq "error"; then @@ -48 +58 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - exit 1 + return 1 @@ -49,0 +60 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + return 0 @@ -54 +65,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Error occurred. Attempting cleanup..." | tee -a "$LOG_FILE" + local line_number=$1 + echo "Error occurred at line $line_number. Attempting cleanup..." | tee -a "$LOG_FILE" @@ -67 +79 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -n "$LEXICON_NAME" ]; then + if [[ -n "${LEXICON_NAME:-}" ]]; then @@ -69 +81,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly delete-lexicon --name $LEXICON_NAME" + if aws polly delete-lexicon --name "$LEXICON_NAME" 2>&1 | tee -a "$LOG_FILE"; then + echo "Lexicon deleted successfully." | tee -a "$LOG_FILE" + else + echo "Warning: Failed to delete lexicon." | tee -a "$LOG_FILE" @@ -70,0 +86,9 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + fi + + # Remove audio files + for file in output.mp3 ssml-output.mp3 lexicon-output.mp3 example.pls; do + if [[ -f "$file" ]]; then + rm -f "$file" + echo "Removed $file" | tee -a "$LOG_FILE" + fi + done @@ -75,2 +99,14 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Trap errors - trap 'handle_error' ERR + # Trap errors with line number + trap 'handle_error ${LINENO}' ERR + + # Verify AWS CLI is available + if ! command -v aws &> /dev/null; then + echo "AWS CLI is not installed. Please install it first." | tee -a "$LOG_FILE" + exit 1 + fi + + # Verify AWS credentials are configured + if ! aws sts get-caller-identity &> /dev/null; then + echo "AWS credentials are not configured. Please configure them first." | tee -a "$LOG_FILE" + exit 1 + fi @@ -80,6 +116 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - POLLY_CHECK=$(aws polly help 2>&1) - if echo "$POLLY_CHECK" | grep -i "not.*found\|invalid\|error" > /dev/null; then - echo "Amazon Polly is not available in your AWS CLI installation." | tee -a "$LOG_FILE" - echo "Please update your AWS CLI to the latest version." | tee -a "$LOG_FILE" - exit 1 - else + if aws polly describe-voices --query 'Voices[0].Name' --output text &> /dev/null; then @@ -86,0 +118,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + else + echo "Amazon Polly is not available in your AWS CLI installation or region." | tee -a "$LOG_FILE" + echo "Please update your AWS CLI to the latest version or check your region." | tee -a "$LOG_FILE" + exit 1 @@ -92 +127 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly describe-voices --language-code en-US --output text --query 'Voices[0:3].[Id, LanguageCode, Gender]'" + log_cmd "aws polly describe-voices --language-code en-US --output text --query 'Voices[0:3].[Id, LanguageCode, Gender]'" || true @@ -97 +132,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Joanna --text \"Hello, welcome to Amazon Polly. This is a sample text to speech conversion.\" output.mp3" + OUTPUT_FILE="${WORK_DIR}/output.mp3" + POLLY_TEXT="Hello, welcome to Amazon Polly. This is a sample text to speech conversion." + log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Joanna --text '$POLLY_TEXT' '$OUTPUT_FILE'" || true @@ -99 +136 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -f "output.mp3" ]; then + if [[ -f "$OUTPUT_FILE" ]]; then @@ -101,0 +139 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + cp "$OUTPUT_FILE" output.mp3 @@ -110 +148,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Matthew --text-type ssml --text \"<speak>Hello! <break time='1s'/> This is a sample of <emphasis>SSML enhanced speech</emphasis>.</speak>\" ssml-output.mp3" + SSML_OUTPUT="${WORK_DIR}/ssml-output.mp3" + SSML_TEXT='<speak>Hello! <break time="1s"/> This is a sample of <emphasis>SSML enhanced speech</emphasis>.</speak>' + log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Matthew --text-type ssml --text '$SSML_TEXT' '$SSML_OUTPUT'" || true @@ -112 +152 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -f "ssml-output.mp3" ]; then + if [[ -f "$SSML_OUTPUT" ]]; then @@ -114,0 +155 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + cp "$SSML_OUTPUT" ssml-output.mp3 @@ -125 +166 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - LEXICON_NAME="example$(openssl rand -hex 6)" + LEXICON_NAME="example$(openssl rand -hex 6 | cut -c 1-10)" @@ -130 +171,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - cat > example.pls << 'EOF' + LEXICON_FILE="${WORK_DIR}/example.pls" + cat > "$LEXICON_FILE" << 'EOF' @@ -148 +190 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly put-lexicon --name $LEXICON_NAME --content file://example.pls" + log_cmd "aws polly put-lexicon --name '$LEXICON_NAME' --content file://'$LEXICON_FILE'" || true @@ -152 +194 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly list-lexicons --output text --query 'Lexicons[*].[Name]'" + log_cmd "aws polly list-lexicons --output text --query 'Lexicons[*].[Name]'" || true @@ -156 +198 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly get-lexicon --name $LEXICON_NAME --output text --query 'Lexicon.Name'" + log_cmd "aws polly get-lexicon --name '$LEXICON_NAME' --output text --query 'Lexicon.Name'" || true @@ -160 +202,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Joanna --lexicon-names $LEXICON_NAME --text \"I work with AWS every day.\" lexicon-output.mp3" + LEXICON_OUTPUT="${WORK_DIR}/lexicon-output.mp3" + LEXICON_TEXT="I work with AWS every day." + log_cmd "aws polly synthesize-speech --output-format mp3 --voice-id Joanna --lexicon-names '$LEXICON_NAME' --text '$LEXICON_TEXT' '$LEXICON_OUTPUT'" || true @@ -162 +206 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ -f "lexicon-output.mp3" ]; then + if [[ -f "$LEXICON_OUTPUT" ]]; then @@ -164,0 +209 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + cp "$LEXICON_OUTPUT" lexicon-output.mp3 @@ -183 +228 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Prompt for cleanup + # Cleanup with auto-confirmation @@ -188,4 +233 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Do you want to clean up all created resources? (y/n): " | tee -a "$LOG_FILE" - read -r CLEANUP_CHOICE - - if [[ "$CLEANUP_CHOICE" =~ ^[Yy] ]]; then + echo "Cleaning up all created resources..." | tee -a "$LOG_FILE" @@ -193,5 +234,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "Skipping cleanup. Resources will remain in your account." | tee -a "$LOG_FILE" - echo "To manually delete the lexicon later, run:" | tee -a "$LOG_FILE" - echo "aws polly delete-lexicon --name $LEXICON_NAME" | tee -a "$LOG_FILE" - fi