AWS ec2 documentation change

Service: ec2 · 2026-05-04 · Documentation low

File: ec2/latest/devguide/example_ec2_GettingStarted_015_section.md

Summary

Updated VPC peering tutorial script to check for existing VPCs instead of quota limits, added resource tagging with project/tutorial metadata, modified subnet CIDR ranges, and improved resource cleanup logic.

Security assessment

The changes focus on operational improvements (existing resource reuse) and metadata tagging. No security vulnerabilities are addressed. The CIDR changes (100.0→1.0) modify example ranges but don't fix security flaws. Added input sanitization improves script safety but isn't response to a documented vulnerability.

Diff

diff --git a/ec2/latest/devguide/example_ec2_GettingStarted_015_section.md b/ec2/latest/devguide/example_ec2_GettingStarted_015_section.md
index 5ff307a36..acdd44b03 100644
--- a//ec2/latest/devguide/example_ec2_GettingStarted_015_section.md
+++ b//ec2/latest/devguide/example_ec2_GettingStarted_015_section.md
@@ -203,15 +203,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    # Check VPC quota — need room for up to 2 new VPCs
-    VPC_COUNT=$(aws ec2 describe-vpcs --region "$AWS_REGION" --query 'length(Vpcs)' --output text 2>/dev/null || echo 99)
-    VPC_LIMIT=5
-    VPCS_NEEDED=2
-    
-    # Check if prereq stack provides a VPC we can use as VPC1
-    PREREQ_VPC_ID=""
-    PREREQ_STACK=$(aws cloudformation describe-stacks --region "$AWS_REGION" --stack-name tutorial-prereqs-vpc-public --query 'Stacks[0].StackStatus' --output text 2>/dev/null || echo "")
-    if [[ "$PREREQ_STACK" == "CREATE_COMPLETE" || "$PREREQ_STACK" == "UPDATE_COMPLETE" ]]; then
-        PREREQ_VPC_ID=$(aws cloudformation describe-stacks --region "$AWS_REGION" --stack-name tutorial-prereqs-vpc-public --query 'Stacks[0].Outputs[?OutputKey==`VpcId`].OutputValue' --output text 2>/dev/null || echo "")
-        if [ -n "$PREREQ_VPC_ID" ]; then
-            echo "Found prereq stack VPC: $PREREQ_VPC_ID (10.0.0.0/16)"
-            VPCS_NEEDED=1
-        fi
-    fi
+    # Check for existing VPCs
+    echo "Checking for existing VPCs..."
+    EXISTING_VPCS=$(aws ec2 describe-vpcs --region "$AWS_REGION" --query 'Vpcs[?State==`available`].[VpcId,CidrBlock]' --output text 2>/dev/null || echo "")
@@ -219,5 +207,40 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    AVAILABLE=$((VPC_LIMIT - VPC_COUNT))
-    if [ "$AVAILABLE" -lt "$VPCS_NEEDED" ]; then
-        echo "ERROR: Need $VPCS_NEEDED VPC slots but only $AVAILABLE available ($VPC_COUNT/$VPC_LIMIT used in $AWS_REGION)."
-        echo "Free up VPCs or run in a different region: AWS_REGION=<region> bash $0"
-        exit 1
+    if [ -z "$EXISTING_VPCS" ]; then
+        echo "No existing VPCs found. Creating new VPCs..."
+        CREATE_VPCS=true
+    else
+        echo "Found existing VPCs:"
+        echo "$EXISTING_VPCS"
+        echo ""
+        echo "Using existing VPCs..."
+        CREATE_VPCS=false
+        # Get the first two available VPCs
+        VPC1_INFO=$(echo "$EXISTING_VPCS" | head -n 1)
+        VPC2_INFO=$(echo "$EXISTING_VPCS" | head -n 2 | tail -n 1)
+        
+        if [ -z "$VPC2_INFO" ]; then
+            echo "Only one VPC found. Creating a second VPC..."
+            VPC1_ID=$(echo "$VPC1_INFO" | awk '{print $1}')
+            VPC1_CIDR=$(echo "$VPC1_INFO" | awk '{print $2}')
+            
+            # Sanitize extracted values
+            VPC1_ID=$(sanitize_var "$VPC1_ID") || check_error 1 "Invalid VPC1_ID format"
+            VPC1_CIDR=$(sanitize_var "$VPC1_CIDR") || check_error 1 "Invalid VPC1_CIDR format"
+            
+            validate_cidr "$VPC1_CIDR" || check_error 1 "Invalid VPC1 CIDR"
+            CREATE_VPC2_ONLY=true
+        else
+            VPC1_ID=$(echo "$VPC1_INFO" | awk '{print $1}')
+            VPC1_CIDR=$(echo "$VPC1_INFO" | awk '{print $2}')
+            VPC2_ID=$(echo "$VPC2_INFO" | awk '{print $1}')
+            VPC2_CIDR=$(echo "$VPC2_INFO" | awk '{print $2}')
+            
+            # Sanitize extracted values
+            VPC1_ID=$(sanitize_var "$VPC1_ID") || check_error 1 "Invalid VPC1_ID format"
+            VPC1_CIDR=$(sanitize_var "$VPC1_CIDR") || check_error 1 "Invalid VPC1_CIDR format"
+            VPC2_ID=$(sanitize_var "$VPC2_ID") || check_error 1 "Invalid VPC2_ID format"
+            VPC2_CIDR=$(sanitize_var "$VPC2_CIDR") || check_error 1 "Invalid VPC2_CIDR format"
+            
+            validate_cidr "$VPC1_CIDR" || check_error 1 "Invalid VPC1 CIDR"
+            validate_cidr "$VPC2_CIDR" || check_error 1 "Invalid VPC2 CIDR"
+            CREATE_VPC2_ONLY=false
+        fi
@@ -226,21 +249,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    # Set up VPCs
-    if [ -n "$PREREQ_VPC_ID" ]; then
-        # Use prereq VPC as VPC1, create VPC2
-        VPC1_ID="$PREREQ_VPC_ID"
-        VPC1_CIDR="10.0.0.0/16"
-        echo "Using prereq stack VPC as VPC1: $VPC1_ID ($VPC1_CIDR)"
-    
-        echo "Creating VPC2..."
-        VPC2_ID=$(log_cmd "aws ec2 create-vpc --region '$AWS_REGION' --cidr-block 10.2.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC2-Peering-Demo}]' --query 'Vpc.VpcId' --output text")
-        check_error $? "Failed to create VPC2"
-        VPC2_ID=$(sanitize_var "$VPC2_ID") || check_error 1 "Invalid VPC2_ID returned"
-        VPC2_CIDR="10.2.0.0/16"
-        CREATED_RESOURCES+=("VPC2: $VPC2_ID")
-        CLEANUP_COMMANDS+=("aws ec2 delete-vpc --region '$AWS_REGION' --vpc-id '$VPC2_ID'")
-        echo "VPC2 created with ID: $VPC2_ID"
-    
-        echo "Waiting for VPC2 to be available..."
-        log_cmd "aws ec2 wait vpc-available --region '$AWS_REGION' --vpc-ids '$VPC2_ID'"
-        check_error $? "Timeout waiting for VPC2 to become available"
-    else
-        # Create both VPCs
+    # Create VPCs if needed
+    if [ "$CREATE_VPCS" = true ]; then
@@ -248 +252 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-        VPC1_ID=$(log_cmd "aws ec2 create-vpc --region '$AWS_REGION' --cidr-block 10.1.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC1-Peering-Demo}]' --query 'Vpc.VpcId' --output text")
+        VPC1_ID=$(log_cmd "aws ec2 create-vpc --region '$AWS_REGION' --cidr-block 10.1.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC1-Peering-Demo},{Key=project,Value=doc-smith},{Key=tutorial,Value=vpc-peering}]' --query 'Vpc.VpcId' --output text")
@@ -257 +261 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-        VPC2_ID=$(log_cmd "aws ec2 create-vpc --region '$AWS_REGION' --cidr-block 10.2.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC2-Peering-Demo}]' --query 'Vpc.VpcId' --output text")
+        VPC2_ID=$(log_cmd "aws ec2 create-vpc --region '$AWS_REGION' --cidr-block 10.2.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC2-Peering-Demo},{Key=project,Value=doc-smith},{Key=tutorial,Value=vpc-peering}]' --query 'Vpc.VpcId' --output text")
@@ -264,0 +269 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
+        # Wait for VPCs to be available
@@ -267,0 +273,15 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
+        
+    elif [ "$CREATE_VPC2_ONLY" = true ]; then
+        echo "Creating VPC2..."
+        VPC2_ID=$(log_cmd "aws ec2 create-vpc --region '$AWS_REGION' --cidr-block 10.2.0.0/16 --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=VPC2-Peering-Demo},{Key=project,Value=doc-smith},{Key=tutorial,Value=vpc-peering}]' --query 'Vpc.VpcId' --output text")
+        check_error $? "Failed to create VPC2"
+        VPC2_ID=$(sanitize_var "$VPC2_ID") || check_error 1 "Invalid VPC2_ID returned"
+        VPC2_CIDR="10.2.0.0/16"
+        CREATED_RESOURCES+=("VPC2: $VPC2_ID")
+        CLEANUP_COMMANDS+=("aws ec2 delete-vpc --region '$AWS_REGION' --vpc-id '$VPC2_ID'")
+        echo "VPC2 created with ID: $VPC2_ID"
+        
+        # Wait for VPC2 to be available
+        echo "Waiting for VPC2 to be available..."
+        log_cmd "aws ec2 wait vpc-available --region '$AWS_REGION' --vpc-ids '$VPC2_ID'"
+        check_error $? "Timeout waiting for VPC2 to become available"
@@ -280,3 +300,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    # Use .100.0/24 to avoid overlap with prereq stack subnets (.1-.4)
-    VPC1_SUBNET_CIDR=$(echo "$VPC1_CIDR" | sed 's/0\.0\/16/100.0\/24/')
-    VPC2_SUBNET_CIDR=$(echo "$VPC2_CIDR" | sed 's/0\.0\/16/100.0\/24/')
+    VPC1_SUBNET_CIDR=$(echo "$VPC1_CIDR" | sed 's/0\.0\/16/1.0\/24/')
+    VPC2_SUBNET_CIDR=$(echo "$VPC2_CIDR" | sed 's/0\.0\/16/1.0\/24/')
@@ -293 +312 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    SUBNET1_ID=$(log_cmd "aws ec2 create-subnet --region '$AWS_REGION' --vpc-id '$VPC1_ID' --cidr-block '$VPC1_SUBNET_CIDR' --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=VPC1-Peering-Subnet}]' --query 'Subnet.SubnetId' --output text")
+    SUBNET1_ID=$(log_cmd "aws ec2 create-subnet --region '$AWS_REGION' --vpc-id '$VPC1_ID' --cidr-block '$VPC1_SUBNET_CIDR' --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=VPC1-Peering-Subnet},{Key=project,Value=doc-smith},{Key=tutorial,Value=vpc-peering}]' --query 'Subnet.SubnetId' --output text")
@@ -301 +320 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    SUBNET2_ID=$(log_cmd "aws ec2 create-subnet --region '$AWS_REGION' --vpc-id '$VPC2_ID' --cidr-block '$VPC2_SUBNET_CIDR' --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=VPC2-Peering-Subnet}]' --query 'Subnet.SubnetId' --output text")
+    SUBNET2_ID=$(log_cmd "aws ec2 create-subnet --region '$AWS_REGION' --vpc-id '$VPC2_ID' --cidr-block '$VPC2_SUBNET_CIDR' --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=VPC2-Peering-Subnet},{Key=project,Value=doc-smith},{Key=tutorial,Value=vpc-peering}]' --query 'Subnet.SubnetId' --output text")
@@ -310 +329 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    PEERING_ID=$(log_cmd "aws ec2 create-vpc-peering-connection --region '$AWS_REGION' --vpc-id '$VPC1_ID' --peer-vpc-id '$VPC2_ID' --tag-specifications 'ResourceType=vpc-peering-connection,Tags=[{Key=Name,Value=VPC1-VPC2-Peering}]' --query 'VpcPeeringConnection.VpcPeeringConnectionId' --output text")
+    PEERING_ID=$(log_cmd "aws ec2 create-vpc-peering-connection --region '$AWS_REGION' --vpc-id '$VPC1_ID' --peer-vpc-id '$VPC2_ID' --tag-specifications 'ResourceType=vpc-peering-connection,Tags=[{Key=Name,Value=VPC1-VPC2-Peering},{Key=project,Value=doc-smith},{Key=tutorial,Value=vpc-peering}]' --query 'VpcPeeringConnection.VpcPeeringConnectionId' --output text")
@@ -330 +349 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    RTB1_ID=$(log_cmd "aws ec2 create-route-table --region '$AWS_REGION' --vpc-id '$VPC1_ID' --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=VPC1-RouteTable}]' --query 'RouteTable.RouteTableId' --output text")
+    RTB1_ID=$(log_cmd "aws ec2 create-route-table --region '$AWS_REGION' --vpc-id '$VPC1_ID' --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=VPC1-RouteTable},{Key=project,Value=doc-smith},{Key=tutorial,Value=vpc-peering}]' --query 'RouteTable.RouteTableId' --output text")
@@ -354 +373 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    RTB2_ID=$(log_cmd "aws ec2 create-route-table --region '$AWS_REGION' --vpc-id '$VPC2_ID' --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=VPC2-RouteTable}]' --query 'RouteTable.RouteTableId' --output text")
+    RTB2_ID=$(log_cmd "aws ec2 create-route-table --region '$AWS_REGION' --vpc-id '$VPC2_ID' --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=VPC2-RouteTable},{Key=project,Value=doc-smith},{Key=tutorial,Value=vpc-peering}]' --query 'RouteTable.RouteTableId' --output text")
@@ -400 +419 @@ There's more on GitHub. Find the complete example and learn how to set up and ru
-    for resource in "${CREATED_RESOURCES[@]+"${CREATED_RESOURCES[@]}"}"; do
+    for resource in "${CREATED_RESOURCES[@]}"; do