AWS code-library documentation change
Summary
Added resource tagging commands across multiple AWS services in code examples for project identification and tutorial tracking
Security assessment
The changes consistently add 'project=doc-smith' and tutorial-specific tags to AWS resources (IAM roles, security groups, log groups, clusters, etc.) for organizational purposes. No security vulnerabilities are addressed; this is purely for resource management and cost allocation. The removal of '-e' in one bash script might impact error handling but lacks security context.
Diff
diff --git a/code-library/latest/ug/bash_2_iam_code_examples.md b/code-library/latest/ug/bash_2_iam_code_examples.md index 1e4199492..d274d7570 100644 --- a//code-library/latest/ug/bash_2_iam_code_examples.md +++ b//code-library/latest/ug/bash_2_iam_code_examples.md @@ -2688 +2688,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --vpc-id "$VPC_ID" 2>&1) + --vpc-id "$VPC_ID" \ + --tag-specifications 'ResourceType=security-group,Tags=[{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-ecs-service-connect}]' 2>&1) @@ -2715 +2716 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws logs create-log-group --log-group-name "/ecs/service-connect-nginx" 2>&1 | grep -v "ResourceAlreadyExistsException" || { + aws logs create-log-group --log-group-name "/ecs/service-connect-nginx" --tags project=doc-smith,tutorial=amazon-ecs-service-connect 2>&1 | grep -v "ResourceAlreadyExistsException" || { @@ -2725 +2726 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws logs create-log-group --log-group-name "/ecs/service-connect-proxy" 2>&1 | grep -v "ResourceAlreadyExistsException" || { + aws logs create-log-group --log-group-name "/ecs/service-connect-proxy" --tags project=doc-smith,tutorial=amazon-ecs-service-connect 2>&1 | grep -v "ResourceAlreadyExistsException" || { @@ -2742 +2743 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --tags key=Environment,value=tutorial 2>&1) + --tags key=Environment,value=tutorial key=project,value=doc-smith key=tutorial,value=amazon-ecs-service-connect 2>&1) @@ -2785,0 +2787 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name ecsTaskExecutionRole --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-ecs-service-connect @@ -2816,0 +2819 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name ecsTaskRole --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-ecs-service-connect @@ -2920,0 +2924,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + }, + { + "key": "project", + "value": "doc-smith" + }, + { + "key": "tutorial", + "value": "amazon-ecs-service-connect" @@ -3363,0 +3375,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$ROLE_NAME" --tags Key=project,Value=doc-smith Key=tutorial,Value=apigateway-lambda-integration + @@ -3386 +3399,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --environment "Variables={LOG_LEVEL=INFO}" || { + --environment "Variables={LOG_LEVEL=INFO}" \ + --tags project=doc-smith,tutorial=apigateway-lambda-integration || { @@ -3397,0 +3412 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags project=doc-smith,tutorial=apigateway-lambda-integration \ @@ -3893,0 +3909,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name ecsTaskExecutionRole --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-ecs-fargate-linux + @@ -3908 +3925 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - CLUSTER_OUTPUT=$(execute_command "aws ecs create-cluster --cluster-name '$CLUSTER_NAME'" "Create ECS cluster") + CLUSTER_OUTPUT=$(execute_command "aws ecs create-cluster --cluster-name '$CLUSTER_NAME' --tags key=project,value=doc-smith key=tutorial,value=amazon-ecs-fargate-linux" "Create ECS cluster") @@ -3996 +4013 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SECURITY_GROUP_OUTPUT=$(execute_command "aws ec2 create-security-group --group-name '$SECURITY_GROUP_NAME' --description 'Security group for ECS Fargate tutorial - HTTP access' --vpc-id '$VPC_ID'" "Create security group") + SECURITY_GROUP_OUTPUT=$(execute_command "aws ec2 create-security-group --group-name '$SECURITY_GROUP_NAME' --description 'Security group for ECS Fargate tutorial - HTTP access' --vpc-id '$VPC_ID' --tag-specifications 'ResourceType=security-group,Tags=[{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-ecs-fargate-linux}]'" "Create security group") @@ -4044 +4061 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SERVICE_CMD="aws ecs create-service --cluster '$CLUSTER_NAME' --service-name '$SERVICE_NAME' --task-definition '$TASK_FAMILY' --desired-count 1 --launch-type FARGATE --network-configuration '{\"awsvpcConfiguration\":{\"subnets\":[\"$(echo "$SUBNET_IDS_COMMA" | sed 's/,/","/g')\"],\"securityGroups\":[\"$SECURITY_GROUP_ID\"],\"assignPublicIp\":\"ENABLED\"}}'" + SERVICE_CMD="aws ecs create-service --cluster '$CLUSTER_NAME' --service-name '$SERVICE_NAME' --task-definition '$TASK_FAMILY' --desired-count 1 --launch-type FARGATE --network-configuration '{\"awsvpcConfiguration\":{\"subnets\":[\"$(echo "$SUBNET_IDS_COMMA" | sed 's/,/","/g')\"],\"securityGroups\":[\"$SECURITY_GROUP_ID\"],\"assignPublicIp\":\"ENABLED\"}}' --tags key=project,value=doc-smith key=tutorial,value=amazon-ecs-fargate-linux" @@ -4217 +4234 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -euo pipefail + set -uo pipefail @@ -4307,0 +4325 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags Key=project,Value=doc-smith Key=tutorial,Value=cloudwatch-dynamicdash \ @@ -4331,0 +4350 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags project=doc-smith,tutorial=cloudwatch-dynamicdash \ @@ -4452,0 +4472 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + DASHBOARD_NAME="LambdaMetricsDashboard-$(date +%s)" @@ -4454 +4474 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --dashboard-name "LambdaMetricsDashboard-$(date +%s)" \ + --dashboard-name "$DASHBOARD_NAME" \ @@ -4477,3 +4496,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Extract dashboard name from result - DASHBOARD_NAME=$(echo "$DASHBOARD_RESULT" | grep -oP '"DashboardName"\s*:\s*"\K[^"]+' || echo "LambdaMetricsDashboard") - @@ -4657,0 +4675,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Tags + PROJECT_TAG="doc-smith" + TUTORIAL_TAG="ecs-ec2" + @@ -4847 +4868 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - CLUSTER_ARN=$(aws ecs create-cluster --cluster-name "$CLUSTER_NAME" --query 'cluster.clusterArn' --output text) + CLUSTER_ARN=$(aws ecs create-cluster --cluster-name "$CLUSTER_NAME" --tags key=project,value=$PROJECT_TAG key=tutorial,value=$TUTORIAL_TAG --query 'cluster.clusterArn' --output text) @@ -4869,0 +4891,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + aws ec2 create-tags --resources "$KEY_PAIR_NAME" --tags Key=project,Value=$PROJECT_TAG Key=tutorial,Value=$TUTORIAL_TAG 2>>"$LOG_FILE" || log "WARNING: Failed to tag key pair" @@ -4879,0 +4903 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tag-specifications "ResourceType=security-group,Tags=[{Key=project,Value=$PROJECT_TAG},{Key=tutorial,Value=$TUTORIAL_TAG}]" \ @@ -4951,0 +4976,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name ecsInstanceRole --tags Key=project,Value=$PROJECT_TAG Key=tutorial,Value=$TUTORIAL_TAG + @@ -5003 +5029 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=ecs-tutorial-instance}]" \ + --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=ecs-tutorial-instance},{Key=project,Value=$PROJECT_TAG},{Key=tutorial,Value=$TUTORIAL_TAG}]" \ @@ -5081 +5107,11 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "networkMode": "bridge" + "networkMode": "bridge", + "tags": [ + { + "key": "project", + "value": "PROJECT_TAG_PLACEHOLDER" + }, + { + "key": "tutorial", + "value": "TUTORIAL_TAG_PLACEHOLDER" + } + ] @@ -5087,0 +5124,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + sed -i "s|PROJECT_TAG_PLACEHOLDER|$PROJECT_TAG|g" task-definition.json + sed -i "s|TUTORIAL_TAG_PLACEHOLDER|$TUTORIAL_TAG|g" task-definition.json @@ -5121,0 +5160 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags key=project,value=$PROJECT_TAG key=tutorial,value=$TUTORIAL_TAG \ @@ -5440,0 +5480,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-managed-grafana-gs @@ -5497 +5538 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --tags Environment=Development) + --tags Environment=Development,project=doc-smith,tutorial=amazon-managed-grafana-gs) @@ -5950,0 +5992,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role \ + --role-name "$ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=lambda-gettingstarted + @@ -5998,0 +6044 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags project=doc-smith,tutorial=lambda-gettingstarted \ @@ -6104,0 +6151,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws logs tag-log-group \ + --log-group-name "$LOG_GROUP_NAME" \ + --tags project=doc-smith,tutorial=lambda-gettingstarted + @@ -6273 +6323,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --secret-string "{\"username\":\"$username\",\"password\":\"$password\"}" 2>&1) + --secret-string "{\"username\":\"$username\",\"password\":\"$password\"}" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=redshift-serverless 2>&1) @@ -6491,0 +6543,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=redshift-serverless @@ -6510 +6563,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --db-name "$DB_NAME" 2>&1) + --db-name "$DB_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=redshift-serverless 2>&1) @@ -6531 +6585,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --base-capacity 8 2>&1) + --base-capacity 8 \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=redshift-serverless 2>&1) @@ -7011,0 +7067,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$ROLE_NAME" --tags Key=project,Value=doc-smith Key=tutorial,Value=aws-iot-device-defender-gs 2>&1 || true + @@ -7274,0 +7332,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Tag the audit task via IoT service + aws iot tag-resource --resource-arn "arn:aws:iot:$(aws configure get region):${ACCOUNT_ID}:audittask/${TASK_ID}" --tags Key=project,Value=doc-smith Key=tutorial,Value=aws-iot-device-defender-gs 2>&1 || true + @@ -7383,0 +7444 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iot tag-resource --resource-arn "$MITIGATION_ACTION_ARN" --tags Key=project,Value=doc-smith Key=tutorial,Value=aws-iot-device-defender-gs 2>&1 || true @@ -7463 +7524 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SNS_RESULT=$(aws sns create-topic --name "IoTDDNotifications" --output json 2>&1) || true + SNS_RESULT=$(aws sns create-topic --name "IoTDDNotifications" --tags Key=project,Value=doc-smith Key=tutorial,Value=aws-iot-device-defender-gs --output json 2>&1) || true @@ -7909 +7970,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --template-url https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2020-10-29/amazon-eks-vpc-private-subnets.yaml) + --template-url https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2020-10-29/amazon-eks-vpc-private-subnets.yaml \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=eks-gs) @@ -7945,0 +8008,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$CLUSTER_ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=eks-gs @@ -7977,0 +8042,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$NODE_ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=eks-gs @@ -8039 +8105,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --resources-vpc-config subnetIds="$SUBNET_IDS",securityGroupIds="$SECURITY_GROUP_ID") + --resources-vpc-config subnetIds="$SUBNET_IDS",securityGroupIds="$SECURITY_GROUP_ID" \ + --tags Key=project,Value=doc-smith,Key=tutorial,Value=eks-gs) @@ -8091 +8158,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --subnets "${SUBNET_IDS_ARRAY[@]}") + --subnets "${SUBNET_IDS_ARRAY[@]}" \ + --tags Key=project,Value=doc-smith,Key=tutorial,Value=eks-gs) @@ -8584 +8652,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --encryption-info "{\"EncryptionInTransit\": {\"InCluster\": true, \"ClientBroker\": \"TLS\"}}" 2>&1) + --encryption-info "{\"EncryptionInTransit\": {\"InCluster\": true, \"ClientBroker\": \"TLS\"}}" \ + --tags project=doc-smith,tutorial=amazon-managed-streaming-for-apache-kafka-gs 2>&1) @@ -8697,0 +8767,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-policy --policy-arn "$POLICY_ARN" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs + @@ -8713,0 +8786,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs @@ -8799 +8873,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --vpc-id "$DEFAULT_VPC_ID" 2>&1) + --vpc-id "$DEFAULT_VPC_ID" \ + --tag-specifications 'ResourceType=security-group,Tags=[{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs}]' 2>&1) @@ -8860 +8935 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - KEY_RESPONSE=$(aws ec2 create-key-pair --key-name "$KEY_NAME" --query 'KeyMaterial' --output text 2>&1) + KEY_RESPONSE=$(aws ec2 create-key-pair --key-name "$KEY_NAME" --tag-specifications 'ResourceType=key-pair,Tags=[{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs}]' --query 'KeyMaterial' --output text 2>&1) @@ -8900 +8975 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=MSKTutorialClient-${RANDOM_SUFFIX}}]" 2>&1) + --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=MSKTutorialClient-${RANDOM_SUFFIX}},{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs}]" 2>&1) @@ -9489,0 +9565 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags Key=project,Value=doc-smith Key=tutorial,Value=redshift-provisioned \ @@ -9538,0 +9615,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Tag the IAM role + echo "Tagging IAM role: $ROLE_NAME" + aws iam tag-role --role-name "$ROLE_NAME" --tags Key=project,Value=doc-smith Key=tutorial,Value=redshift-provisioned + @@ -9885,0 +9966,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Tag the role + echo "Tagging IAM role..." >&2 + aws iam tag-role --role-name "$role_name" --tags Key=project,Value=doc-smith Key=tutorial,Value=sagemaker-featurestore 2>&1 +