AWS code-library documentation change
Summary
Added resource tagging commands throughout AWS CLI examples and modified OpenSearch domain creation to use CloudFormation
Security assessment
The changes primarily add tags (project=doc-smith, tutorial=*) to resources across various services for organizational purposes. The OpenSearch section was refactored to use CloudFormation instead of direct API calls, which is an architectural change but doesn't address security vulnerabilities. No security weaknesses or vulnerabilities are being patched, and no new security features are documented.
Diff
diff --git a/code-library/latest/ug/bash_2_sts_code_examples.md b/code-library/latest/ug/bash_2_sts_code_examples.md index d49d315ad..d3762c86d 100644 --- a//code-library/latest/ug/bash_2_sts_code_examples.md +++ b//code-library/latest/ug/bash_2_sts_code_examples.md @@ -295 +295,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --vpc-id "$VPC_ID" 2>&1) + --vpc-id "$VPC_ID" \ + --tag-specifications 'ResourceType=security-group,Tags=[{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-ecs-service-connect}]' 2>&1) @@ -322 +323 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws logs create-log-group --log-group-name "/ecs/service-connect-nginx" 2>&1 | grep -v "ResourceAlreadyExistsException" || { + aws logs create-log-group --log-group-name "/ecs/service-connect-nginx" --tags project=doc-smith,tutorial=amazon-ecs-service-connect 2>&1 | grep -v "ResourceAlreadyExistsException" || { @@ -332 +333 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws logs create-log-group --log-group-name "/ecs/service-connect-proxy" 2>&1 | grep -v "ResourceAlreadyExistsException" || { + aws logs create-log-group --log-group-name "/ecs/service-connect-proxy" --tags project=doc-smith,tutorial=amazon-ecs-service-connect 2>&1 | grep -v "ResourceAlreadyExistsException" || { @@ -349 +350 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --tags key=Environment,value=tutorial 2>&1) + --tags key=Environment,value=tutorial key=project,value=doc-smith key=tutorial,value=amazon-ecs-service-connect 2>&1) @@ -392,0 +394 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name ecsTaskExecutionRole --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-ecs-service-connect @@ -423,0 +426 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name ecsTaskRole --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-ecs-service-connect @@ -527,0 +531,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + }, + { + "key": "project", + "value": "doc-smith" + }, + { + "key": "tutorial", + "value": "amazon-ecs-service-connect" @@ -970,0 +982,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$ROLE_NAME" --tags Key=project,Value=doc-smith Key=tutorial,Value=apigateway-lambda-integration + @@ -993 +1006,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --environment "Variables={LOG_LEVEL=INFO}" || { + --environment "Variables={LOG_LEVEL=INFO}" \ + --tags project=doc-smith,tutorial=apigateway-lambda-integration || { @@ -1004,0 +1019 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags project=doc-smith,tutorial=apigateway-lambda-integration \ @@ -1500,0 +1516,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name ecsTaskExecutionRole --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-ecs-fargate-linux + @@ -1515 +1532 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - CLUSTER_OUTPUT=$(execute_command "aws ecs create-cluster --cluster-name '$CLUSTER_NAME'" "Create ECS cluster") + CLUSTER_OUTPUT=$(execute_command "aws ecs create-cluster --cluster-name '$CLUSTER_NAME' --tags key=project,value=doc-smith key=tutorial,value=amazon-ecs-fargate-linux" "Create ECS cluster") @@ -1603 +1620 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SECURITY_GROUP_OUTPUT=$(execute_command "aws ec2 create-security-group --group-name '$SECURITY_GROUP_NAME' --description 'Security group for ECS Fargate tutorial - HTTP access' --vpc-id '$VPC_ID'" "Create security group") + SECURITY_GROUP_OUTPUT=$(execute_command "aws ec2 create-security-group --group-name '$SECURITY_GROUP_NAME' --description 'Security group for ECS Fargate tutorial - HTTP access' --vpc-id '$VPC_ID' --tag-specifications 'ResourceType=security-group,Tags=[{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-ecs-fargate-linux}]'" "Create security group") @@ -1651 +1668 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - SERVICE_CMD="aws ecs create-service --cluster '$CLUSTER_NAME' --service-name '$SERVICE_NAME' --task-definition '$TASK_FAMILY' --desired-count 1 --launch-type FARGATE --network-configuration '{\"awsvpcConfiguration\":{\"subnets\":[\"$(echo "$SUBNET_IDS_COMMA" | sed 's/,/","/g')\"],\"securityGroups\":[\"$SECURITY_GROUP_ID\"],\"assignPublicIp\":\"ENABLED\"}}'" + SERVICE_CMD="aws ecs create-service --cluster '$CLUSTER_NAME' --service-name '$SERVICE_NAME' --task-definition '$TASK_FAMILY' --desired-count 1 --launch-type FARGATE --network-configuration '{\"awsvpcConfiguration\":{\"subnets\":[\"$(echo "$SUBNET_IDS_COMMA" | sed 's/,/","/g')\"],\"securityGroups\":[\"$SECURITY_GROUP_ID\"],\"assignPublicIp\":\"ENABLED\"}}' --tags key=project,value=doc-smith key=tutorial,value=amazon-ecs-fargate-linux" @@ -1824 +1841 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -euo pipefail + set -uo pipefail @@ -1914,0 +1932 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags Key=project,Value=doc-smith Key=tutorial,Value=cloudwatch-dynamicdash \ @@ -1938,0 +1957 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags project=doc-smith,tutorial=cloudwatch-dynamicdash \ @@ -2059,0 +2079 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + DASHBOARD_NAME="LambdaMetricsDashboard-$(date +%s)" @@ -2061 +2081 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --dashboard-name "LambdaMetricsDashboard-$(date +%s)" \ + --dashboard-name "$DASHBOARD_NAME" \ @@ -2084,3 +2103,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Extract dashboard name from result - DASHBOARD_NAME=$(echo "$DASHBOARD_RESULT" | grep -oP '"DashboardName"\s*:\s*"\K[^"]+' || echo "LambdaMetricsDashboard") - @@ -2264,0 +2282,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + # Tags + PROJECT_TAG="doc-smith" + TUTORIAL_TAG="ecs-ec2" + @@ -2454 +2475 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - CLUSTER_ARN=$(aws ecs create-cluster --cluster-name "$CLUSTER_NAME" --query 'cluster.clusterArn' --output text) + CLUSTER_ARN=$(aws ecs create-cluster --cluster-name "$CLUSTER_NAME" --tags key=project,value=$PROJECT_TAG key=tutorial,value=$TUTORIAL_TAG --query 'cluster.clusterArn' --output text) @@ -2476,0 +2498,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + + aws ec2 create-tags --resources "$KEY_PAIR_NAME" --tags Key=project,Value=$PROJECT_TAG Key=tutorial,Value=$TUTORIAL_TAG 2>>"$LOG_FILE" || log "WARNING: Failed to tag key pair" @@ -2486,0 +2510 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tag-specifications "ResourceType=security-group,Tags=[{Key=project,Value=$PROJECT_TAG},{Key=tutorial,Value=$TUTORIAL_TAG}]" \ @@ -2558,0 +2583,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name ecsInstanceRole --tags Key=project,Value=$PROJECT_TAG Key=tutorial,Value=$TUTORIAL_TAG + @@ -2610 +2636 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=ecs-tutorial-instance}]" \ + --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=ecs-tutorial-instance},{Key=project,Value=$PROJECT_TAG},{Key=tutorial,Value=$TUTORIAL_TAG}]" \ @@ -2688 +2714,11 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - "networkMode": "bridge" + "networkMode": "bridge", + "tags": [ + { + "key": "project", + "value": "PROJECT_TAG_PLACEHOLDER" + }, + { + "key": "tutorial", + "value": "TUTORIAL_TAG_PLACEHOLDER" + } + ] @@ -2694,0 +2731,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + sed -i "s|PROJECT_TAG_PLACEHOLDER|$PROJECT_TAG|g" task-definition.json + sed -i "s|TUTORIAL_TAG_PLACEHOLDER|$TUTORIAL_TAG|g" task-definition.json @@ -2728,0 +2767 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + --tags key=project,value=$PROJECT_TAG key=tutorial,value=$TUTORIAL_TAG \ @@ -3047,0 +3087,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-managed-grafana-gs @@ -3104 +3145 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --tags Environment=Development) + --tags Environment=Development,project=doc-smith,tutorial=amazon-managed-grafana-gs) @@ -3448 +3489 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - REPO_RESULT=$(aws ecr create-repository --repository-name hello-repository) + REPO_RESULT=$(aws ecr create-repository --repository-name hello-repository --tags key=project,value=doc-smith key=tutorial,value=amazon-elastic-container-registry-gs) @@ -3743 +3784,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --template-url https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2020-10-29/amazon-eks-vpc-private-subnets.yaml) + --template-url https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2020-10-29/amazon-eks-vpc-private-subnets.yaml \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=eks-gs) @@ -3779,0 +3822,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$CLUSTER_ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=eks-gs @@ -3811,0 +3856,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$NODE_ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=eks-gs @@ -3873 +3919,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --resources-vpc-config subnetIds="$SUBNET_IDS",securityGroupIds="$SECURITY_GROUP_ID") + --resources-vpc-config subnetIds="$SUBNET_IDS",securityGroupIds="$SECURITY_GROUP_ID" \ + --tags Key=project,Value=doc-smith,Key=tutorial,Value=eks-gs) @@ -3925 +3972,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --subnets "${SUBNET_IDS_ARRAY[@]}") + --subnets "${SUBNET_IDS_ARRAY[@]}" \ + --tags Key=project,Value=doc-smith,Key=tutorial,Value=eks-gs) @@ -4418 +4466,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --encryption-info "{\"EncryptionInTransit\": {\"InCluster\": true, \"ClientBroker\": \"TLS\"}}" 2>&1) + --encryption-info "{\"EncryptionInTransit\": {\"InCluster\": true, \"ClientBroker\": \"TLS\"}}" \ + --tags project=doc-smith,tutorial=amazon-managed-streaming-for-apache-kafka-gs 2>&1) @@ -4531,0 +4581,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-policy --policy-arn "$POLICY_ARN" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs + @@ -4547,0 +4600,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + aws iam tag-role --role-name "$ROLE_NAME" \ + --tags Key=project,Value=doc-smith Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs @@ -4633 +4687,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --vpc-id "$DEFAULT_VPC_ID" 2>&1) + --vpc-id "$DEFAULT_VPC_ID" \ + --tag-specifications 'ResourceType=security-group,Tags=[{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs}]' 2>&1) @@ -4694 +4749 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - KEY_RESPONSE=$(aws ec2 create-key-pair --key-name "$KEY_NAME" --query 'KeyMaterial' --output text 2>&1) + KEY_RESPONSE=$(aws ec2 create-key-pair --key-name "$KEY_NAME" --tag-specifications 'ResourceType=key-pair,Tags=[{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs}]' --query 'KeyMaterial' --output text 2>&1) @@ -4734 +4789 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=MSKTutorialClient-${RANDOM_SUFFIX}}]" 2>&1) + --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=MSKTutorialClient-${RANDOM_SUFFIX}},{Key=project,Value=doc-smith},{Key=tutorial,Value=amazon-managed-streaming-for-apache-kafka-gs}]" 2>&1) @@ -5269,71 +5324,15 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - ACCESS_POLICY="{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::${ACCOUNT_ID}:root\"},\"Action\":[\"es:ESHttpGet\",\"es:ESHttpPut\",\"es:ESHttpPost\",\"es:ESHttpDelete\",\"es:ESHttpHead\"],\"Resource\":\"arn:aws:es:${AWS_REGION}:${ACCOUNT_ID}:domain/${DOMAIN_NAME}/*\"}]}" - - echo "Access policy created for region: $AWS_REGION" - echo "Access policy: [REDACTED]" - - # Create the domain (matches tutorial command exactly) - echo "Creating domain $DOMAIN_NAME..." - CREATE_OUTPUT=$(aws opensearch create-domain \ - --domain-name "$DOMAIN_NAME" \ - --engine-version "OpenSearch_2.11" \ - --cluster-config "InstanceType=t3.small.search,InstanceCount=1,ZoneAwarenessEnabled=false" \ - --ebs-options "EBSEnabled=true,VolumeType=gp3,VolumeSize=10" \ - --node-to-node-encryption-options "Enabled=true" \ - --encryption-at-rest-options "Enabled=true" \ - --domain-endpoint-options "EnforceHTTPS=true,TLSSecurityPolicy=Policy-Min-TLS-1-2-2019-07" \ - --advanced-security-options "Enabled=true,InternalUserDatabaseEnabled=true,MasterUserOptions={MasterUserName=$MASTER_USER,MasterUserPassword=$MASTER_PASSWORD}" \ - --access-policies "$ACCESS_POLICY" \ - --tags "Key=Environment,Value=Tutorial" "Key=Purpose,Value=OpenSearchGettingStarted" 2>&1) - - # Check if domain creation was successful - if [[ $? -ne 0 ]]; then - echo "Failed to create OpenSearch domain:" - echo "$CREATE_OUTPUT" - handle_error "Domain creation failed" - fi - - # Verify the domain was actually created by checking the output - if echo "$CREATE_OUTPUT" | grep -q "DomainStatus"; then - echo "Domain creation initiated successfully." - DOMAIN_CREATED=true - else - echo "Domain creation output:" - echo "$CREATE_OUTPUT" - handle_error "Domain creation may have failed - no DomainStatus in response" - fi - - # Wait for domain to become active (improved logic) - echo "Waiting for domain to become active..." - RETRY_COUNT=0 - MAX_RETRIES=45 # 45 minutes with 60 second intervals - - while [[ $RETRY_COUNT -lt $MAX_RETRIES ]]; do - echo "Checking domain status... (attempt $((RETRY_COUNT+1))/$MAX_RETRIES)" - - # Get domain status - DOMAIN_STATUS=$(aws opensearch describe-domain --domain-name "$DOMAIN_NAME" 2>&1) -