AWS cli high security documentation change
Summary
Added security warning section about risks of using untrusted templates with the package command, which may lead to arbitrary file uploads. Updated AWS CLI version references.
Security assessment
The change explicitly warns about security risks where malicious templates can cause arbitrary file reads/upload vulnerabilities. It documents a specific security vulnerability pattern (path traversal) and mitigation guidance.
Diff
diff --git a/cli/latest/reference/cloudformation/package.md b/cli/latest/reference/cloudformation/package.md index de3fa54f3..bd7a62841 100644 --- a//cli/latest/reference/cloudformation/package.md +++ b//cli/latest/reference/cloudformation/package.md @@ -15 +15 @@ - * [AWS CLI 2.34.61 Command Reference](../../index.html) » + * [AWS CLI 2.34.63 Command Reference](../../index.html) » @@ -94,0 +95,8 @@ Before the command uploads artifacts, it checks if the artifacts are already pre +### Warning + +**Security considerations** + +The `package` command treats the supplied CloudFormation template as trusted build input. The properties listed above (for example, `CodeUri`, `ContentUri`, `TemplateURL`, and the `Location` parameter for the `AWS::Include` transform) cause the CLI to read files from the local filesystem at the paths the template specifies and upload them to the S3 bucket you provide, using your own AWS credentials and operating-system identity. Paths in the template are not constrained to the template’s directory; relative paths that traverse above the template directory (for example, `CodeUri: ../src/my-function`) are supported by design to enable monorepo, shared-fragment, and nested-stack layouts. + +Do not run `aws cloudformation package` against templates from sources you do not trust. A malicious template author can cause arbitrary readable files on your machine, such as credentials or other sensitive files, to be uploaded to the configured S3 bucket. + @@ -292 +300 @@ Following command exports a template named `template.json` by uploading local ar - * [AWS CLI 2.34.61 Command Reference](../../index.html) » + * [AWS CLI 2.34.63 Command Reference](../../index.html) »