AWS AmazonCloudWatch medium security documentation change
Summary
Enhanced input validation, error handling, and security best practices in Lambda example
Security assessment
Added strict input validation patterns for IAM roles and event data, negative number checks, and secure temporary directory handling. These changes prevent potential injection attacks and invalid data processing in Lambda functions.
Diff
diff --git a/AmazonCloudWatch/latest/logs/example_lambda_GettingStarted_019_section.md b/AmazonCloudWatch/latest/logs/example_lambda_GettingStarted_019_section.md index 7ea0d77d6..20e8a167f 100644 --- a//AmazonCloudWatch/latest/logs/example_lambda_GettingStarted_019_section.md +++ b//AmazonCloudWatch/latest/logs/example_lambda_GettingStarted_019_section.md @@ -47 +47 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -eE + set -eE -o pipefail @@ -53 +53 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - UNIQUE_ID=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 8 | head -n 1) + UNIQUE_ID=$(head -c 8 /dev/urandom | od -An -tx1 | tr -d ' ') @@ -58,0 +59 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + readonly TEMP_DIR @@ -167,0 +169,10 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + validate_input() { + local input="$1" + local pattern="$2" + if ! [[ "$input" =~ $pattern ]]; then + echo "ERROR: Invalid input: $input" + return 1 + fi + return 0 + } + @@ -192 +203 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Enter your choice (1 or 2): " + echo "Using default: Python 3.13" @@ -206,2 +217,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - length = event['length'] - width = event['width'] + if not isinstance(event, dict) or 'length' not in event or 'width' not in event: + raise ValueError('Event must contain length and width') + try: + length = float(event['length']) + width = float(event['width']) + if length < 0 or width < 0: + raise ValueError('Length and width must be non-negative') @@ -211,0 +228,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + except (TypeError, ValueError) as e: + logger.error(f'Error processing input: {str(e)}') + raise @@ -222,0 +242,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if (!event || typeof event.length !== 'number' || typeof event.width !== 'number') { + throw new Error('Event must contain numeric length and width'); + } + if (event.length < 0 || event.width < 0) { + throw new Error('Length and width must be non-negative'); + } @@ -265,0 +291,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + if ! validate_input "$ROLE_OUTPUT" "^arn:aws:iam::[0-9]+:role/"; then + echo "ERROR: Failed to create IAM role" + exit 1 + fi + @@ -270,0 +302,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role \ + --role-name "$ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=lambda-gettingstarted + @@ -295,3 +330,11 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - cd "$TEMP_DIR" - zip -j function.zip "$CODE_FILE" > /dev/null 2>&1 - cd "$ORIGINAL_DIR" + cd "$TEMP_DIR" || exit 1 + zip -j function.zip "$CODE_FILE" > /dev/null 2>&1 || { + echo "ERROR: Failed to create deployment package" + exit 1 + } + cd "$ORIGINAL_DIR" || exit 1 + + if [ ! -f "${TEMP_DIR}/function.zip" ]; then + echo "ERROR: Deployment package creation failed" + exit 1 + fi @@ -310,0 +354 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags project=doc-smith,tutorial=lambda-gettingstarted \ @@ -312,0 +357,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + if [ -z "$CREATE_OUTPUT" ]; then + echo "ERROR: Failed to create Lambda function" + exit 1 + fi + @@ -335,0 +386,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if ! validate_input "$TEST_EVENT" '"length": [0-9]+, "width": [0-9]+'; then + echo "ERROR: Invalid test event format" + exit 1 + fi + @@ -342,0 +398,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + if [ ! -f "${TEMP_DIR}/response.json" ]; then + echo "ERROR: No response file generated" + exit 1 + fi + @@ -400,0 +461,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws logs tag-log-group \ + --log-group-name "$LOG_GROUP_NAME" \ + --tags project=doc-smith,tutorial=lambda-gettingstarted + @@ -416 +480 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "CLEANUP CONFIRMATION" + echo "CLEANUP" @@ -419,4 +483 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Do you want to clean up all created resources? (y/n): " - CLEANUP_CHOICE="y" - - if [[ "$CLEANUP_CHOICE" =~ ^[Yy]$ ]]; then + echo "Cleaning up all created resources..." @@ -424,19 +484,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - else - echo "" - echo "Resources were NOT deleted. To clean up manually, run:" - echo "" - echo " # Delete the Lambda function" - echo " aws lambda delete-function --function-name ${FUNCTION_NAME}" - echo "" - echo " # Delete the CloudWatch log group" - echo " aws logs delete-log-group --log-group-name ${LOG_GROUP_NAME}" - echo "" - echo " # Detach the policy and delete the IAM role" - echo " aws iam detach-role-policy --role-name ${ROLE_NAME} --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" - echo " aws iam delete-role --role-name ${ROLE_NAME}" - echo "" - - if [ -d "$TEMP_DIR" ]; then - rm -rf "$TEMP_DIR" - fi - fi