AWS solutions documentation change
Summary
Updated security documentation with new deployment options (ALB+ECS Fargate, Headless), added third-party framework security details, revised AWS WAF guidance, and enhanced policy compliance information.
Security assessment
The changes expand security documentation without addressing specific vulnerabilities. Key updates include: new sections for deployment options (ALB+ECS/Headless security), third-party framework risks (especially JMeter vulnerabilities), policy references to DDoS testing restrictions, and AWS WAF implementation details. While security documentation is enhanced, no active security fixes or incident responses are evidenced.
Diff
diff --git a/solutions/latest/distributed-load-testing-on-aws/security-1.md b/solutions/latest/distributed-load-testing-on-aws/security-1.md index b3b559421..f719965ec 100644 --- a//solutions/latest/distributed-load-testing-on-aws/security-1.md +++ b//solutions/latest/distributed-load-testing-on-aws/security-1.md @@ -7 +7 @@ -IAM rolesAmazon CloudFrontAmazon API GatewayAWS Fargate security groupAmazon VPCNetwork stress testRestricting access to the public user interfaceMCP Server security (Optional) +IAM rolesAmazon CloudFrontAmazon API GatewayAWS Fargate security groupAmazon VPCNetwork stress testRestricting access to the public user interfaceMCP Server security (Optional)ALB + ECS Fargate hosted web console security (Optional)Headless (bring your own web server) security (Optional)Third-party testing frameworks @@ -11 +11 @@ IAM rolesAmazon CloudFrontAmazon API GatewayAWS Fargate security groupAmazon VPC -When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This [shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/) reduces your operational burden because AWS operates, manages, and controls the components including the host operating system, the virtualization layer, and the physical security of the facilities in which the services operate. For more information about AWS security, visit [AWS Cloud Security](http://aws.amazon.com/security/). +When you build systems on AWS infrastructure, security responsibilities are shared between you and AWS. This [shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/) reduces your operational burden because AWS operates, manages, and controls the components including the host operating system, the virtualization layer, and the physical security of the facilities in which the services operate. For more information about AWS security, visit [AWS Cloud Security](https://aws.amazon.com/security/). @@ -120 +120 @@ During deployment, the solution will create a security group within your VPC to -You are responsible for using this solution under the [Network Stress Test policy](https://aws.amazon.com/ec2/testing/). This policy covers situations such as when you are planning to run high-volume network tests directly from your Amazon EC2 instances to other locations such as other Amazon EC2 instances, AWS properties/services, or external endpoints. These tests are sometimes called stress tests, load tests, or gameday tests. Most customer testing will not fall under this policy; however, refer to this policy if you believe you will be generating traffic that sustains, in aggregate, for more than 1 minute, over 1 Gbps (1 billion bits per second) or over 1 Gpps (1 billion packets per second). +You are responsible for using this solution under the [Amazon EC2 Testing Policy](https://aws.amazon.com/ec2/testing/). The policy covers high-volume network tests run from Amazon EC2 instances to other Amazon EC2 instances, AWS services, or external endpoints. These tests are sometimes called stress tests, load tests, or gameday tests. Review the policy to understand the distinction between network stress tests and DDoS simulations (which are prohibited on EC2 and covered separately by the [DDoS Simulation Testing policy](https://aws.amazon.com/security/ddos-simulation-testing/)), and note that AWS may employ traffic engineering or shaping at high traffic volumes. Refer to the policy page for current thresholds and guidance before running high-volume tests. @@ -124 +124 @@ You are responsible for using this solution under the [Network Stress Test polic -To restrict access to the public-facing user interface beyond the authentication and authorization mechanisms provided by IAM and Amazon Cognito, use the [AWS WAF (web application firewall) Security Automations solution](https://aws.amazon.com/solutions/implementations/aws-waf-security-automations/). +The approach for restricting access to the web console depends on the deployment option you choose. @@ -126 +126,3 @@ To restrict access to the public-facing user interface beyond the authentication -This solution automatically deploys a set of AWS WAF rules that filter common web-based attacks. Users can select from preconfigured protective features that define the rules included in an AWS WAF web access control list (web ACL). +**Default (CloudFront + S3) deployment** — To restrict access to the public-facing user interface beyond the authentication and authorization mechanisms provided by IAM and Amazon Cognito, you can associate an AWS WAF web ACL with the CloudFront distribution. Consider using the [AWS WAF Security Automations solution](https://aws.amazon.com/solutions/implementations/aws-waf-security-automations/), which deploys a set of preconfigured AWS WAF rules that filter common web-based attacks. The default CloudFront + S3 template does not deploy WAF resources automatically. + +**ALB + ECS Fargate deployment** — The solution automatically deploys an AWS WAF web ACL in front of the ALB with managed rules that provide baseline protection against common web-based attacks. You can customize the WAF rules to meet your specific security requirements, including adding IP-based allow or block lists, geographic restrictions, rate limiting, or additional AWS managed rule groups. For instructions on modifying the WAF configuration, refer to the [WAF integration](./deploy-alb-ecs-fargate.html#alb-ecs-waf-integration) section in the deployment instructions. @@ -130 +132,60 @@ This solution automatically deploys a set of AWS WAF rules that filter common we -If you deploy the optional MCP Server integration, the solution uses AWS AgentCore Gateway to provide secure access to load testing data for AI agents. AgentCore Gateway validates Amazon Cognito authentication tokens for each request, ensuring that only authorized users can access the MCP Server. The MCP Server Lambda function implements read-only access patterns, preventing AI agents from modifying test configurations or results. All MCP Server interactions use the same permission boundaries and access controls as the web console. +If you deploy the optional MCP Server integration, the solution uses Amazon Bedrock AgentCore Gateway to provide secure access to load testing data for AI agents. AgentCore Gateway validates Amazon Cognito authentication tokens for each request, ensuring that only authorized users can access the MCP Server. The MCP Server Lambda function implements read-only access patterns, preventing AI agents from modifying test configurations or results. All MCP Server interactions use the same permission boundaries and access controls as the web console. + +## ALB + ECS Fargate hosted web console security (Optional) + +If you choose the ALB + ECS Fargate deployment option, the following security considerations apply: + + * **VPC Block Public Access compatibility** — The ALB + ECS Fargate option is designed for environments where VPC Block Public Access (BPA) policies block traffic from public CloudFront distributions. The ALB can be deployed as an internal load balancer within your VPC, accessible only through your corporate network, VPN, or AWS PrivateLink, meeting zero public internet exposure requirements. + + * **ACM certificate management** — The ALB uses an ACM certificate for HTTPS termination. You are responsible for ensuring the certificate remains valid and is renewed before expiration. ACM automatically renews certificates that it manages, but imported certificates must be renewed manually. For more information, refer to [Managed certificate renewal](https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html) in the AWS Certificate Manager User Guide. + + * **AWS WAF protection** — WAF is deployed by default with the ALB + ECS Fargate template. For details, refer to Restricting access to the public user interface. + + + + +## Headless (bring your own web server) security (Optional) + +If you choose the headless deployment option and host the web console on your own web server, you are responsible for the following security considerations: + + * **HTTPS configuration** — We strongly recommend configuring HTTPS on your web server. + + * **Access controls** — You are responsible for implementing access controls, firewall rules, and network security on your web server. + + * **Security hardening** — Apply your organization’s security hardening standards to the web server, including patching, monitoring, and intrusion detection. + + + + +## Third-party testing frameworks + +Distributed Load Testing on AWS bundles three third-party testing frameworks — Apache JMeter, Grafana K6, and Locust. Under the [AWS shared responsibility model](https://aws.amazon.com/compliance/shared-responsibility-model/), you are responsible for evaluating whether these frameworks and their bundled versions meet your organization’s security requirements before running load tests. The solution distributes each framework without modification and verifies the bundled binaries using SHA512 checksums at build time and runtime. + +For details on when each framework is installed and how it’s provisioned, see [Testing framework provisioning](./back-end.html#framework-provisioning). + +### Apache JMeter + +The bundled version of Apache JMeter has known security vulnerabilities that cannot be fully patched externally without breaking compatibility with the Taurus test automation framework and the JMeter plugin ecosystem that the solution depends on. Before running load tests, review the [Apache JMeter security advisories](https://jmeter.apache.org/security.html) and evaluate if they may cause security vulnerabilities for you. + +###### Note + +Apache JMeter also runs under the hood for the **Single HTTP Endpoint** test type. When you configure a URL, method, headers, and body payload in the web console, the solution generates a JMeter test plan and executes it with the bundled JMeter binary. The JMeter security considerations described in this section therefore apply to Single HTTP Endpoint tests as well. + +If you need a patched version of JMeter, you have two options. Both options require a test archive and are available only for the **JMeter** test type: + + * **Supply a patched JMeter binary** — Include a patched JMeter binary in your test archive. The solution uses your binary in place of the bundled version. + + * **Override individual plugin JARs** — Use the plugin override mechanism to replace specific vulnerable plugin JARs with patched versions. For more information, refer to [JMeter tests](./design-considerations.html#jmeter-script-support). + + + + +The **Single HTTP Endpoint** test type does not accept a test archive and therefore cannot override the bundled JMeter binary or plugins. If you need to run HTTP endpoint tests with a patched JMeter, use the **JMeter** test type and supply a JMeter script (.jmx) or a .zip archive that includes your patched JMeter binary or plugin JARs. + +### Grafana K6 + +K6 is released under the [AGPL-3.0 license](https://github.com/grafana/k6/blob/master/LICENSE.md). The web console displays a license acknowledgment message when you create a new K6 test. No known security vulnerabilities were identified in the bundled version of K6 at the time of this solution’s release. The solution does not monitor K6 for new vulnerabilities on an ongoing basis; you are responsible for evaluating K6 against your security requirements throughout its use. + +### Locust + +No known security vulnerabilities were identified in the bundled version of Locust at the time of this solution’s release. The solution does not monitor Locust for new vulnerabilities on an ongoing basis; you are responsible for evaluating Locust against your security requirements throughout its use.