AWS code-library documentation change
Summary
Replaced Textract tutorial with SageMaker Feature Store tutorial, including IAM role creation and resource cleanup.
Security assessment
The change adds IAM role creation and policy management for SageMaker, which are security-related features. No specific vulnerability is addressed.
Diff
diff --git a/code-library/latest/ug/bash_2_s3_code_examples.md b/code-library/latest/ug/bash_2_s3_code_examples.md index f87e399cb..f3d588eef 100644 --- a//code-library/latest/ug/bash_2_s3_code_examples.md +++ b//code-library/latest/ug/bash_2_s3_code_examples.md @@ -1050,7 +1050 @@ The following code example shows how to: - * Create an S3 bucket for query results - - * Create a database - - * Create a table - - * Run a query + * Create an EC2 key pair @@ -1058 +1052 @@ The following code example shows how to: - * Create and use named queries + * Set up storage and prepare your application @@ -1070 +1064 @@ The following code example shows how to: -There's more on GitHub. Find the complete example and learn how to set up and run in the [Sample developer tutorials](https://github.com/aws-samples/sample-developer-tutorials/tree/main/tuts/061-amazon-athena-gs) repository. +There's more on GitHub. Find the complete example and learn how to set up and run in the [Sample developer tutorials](https://github.com/aws-samples/sample-developer-tutorials/tree/main/tuts/037-emr-gs) repository. @@ -1075,3 +1069,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Amazon Athena Getting Started Script - # This script demonstrates how to use Amazon Athena with AWS CLI - # It creates a database, table, runs queries, and manages named queries + # EMR Getting Started Tutorial Script + # This script automates the steps in the Amazon EMR Getting Started tutorial @@ -1081,8 +1074,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Security: Validate AWS credentials are configured - if ! aws sts get-caller-identity &>/dev/null; then - echo "ERROR: AWS credentials not configured or invalid" - exit 1 - fi - - # Security: Restrict umask to prevent world-readable files - umask 0077 + # Security: Set strict mode and trap errors + trap 'handle_error "Script interrupted or command failed"' ERR @@ -1090,2 +1077,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Set up logging with restricted permissions - LOG_FILE="athena-tutorial.log" + # Set up logging with secure permissions + LOG_FILE="emr-tutorial.log" @@ -1096 +1083 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Starting Amazon Athena Getting Started Tutorial..." + echo "Starting Amazon EMR Getting Started Tutorial Script" @@ -1102,13 +1089,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Resources created:" - if [ -n "${NAMED_QUERY_ID:-}" ]; then - echo "- Named Query: $NAMED_QUERY_ID" - fi - if [ -n "${DATABASE_NAME:-}" ]; then - echo "- Database: $DATABASE_NAME" - if [ -n "${TABLE_NAME:-}" ]; then - echo "- Table: $TABLE_NAME in $DATABASE_NAME" - fi - fi - if [ -n "${S3_BUCKET:-}" ]; then - echo "- S3 Bucket: $S3_BUCKET" - fi + echo "Resources created so far:" + if [ -n "${BUCKET_NAME:-}" ]; then echo "- S3 Bucket: $BUCKET_NAME"; fi + if [ -n "${CLUSTER_ID:-}" ]; then echo "- EMR Cluster: $CLUSTER_ID"; fi @@ -1116 +1093,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Exiting..." + echo "Attempting to clean up resources..." + cleanup @@ -1120,5 +1098,16 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Security: Validate bucket name format - validate_bucket_name() { - local bucket_name="$1" - if [[ ! "$bucket_name" =~ ^[a-z0-9][a-z0-9.-]*[a-z0-9]$ ]] || [ ${#bucket_name} -lt 3 ] || [ ${#bucket_name} -gt 63 ]; then - return 1 + # Function to clean up resources + cleanup() { + echo "" + echo "===========================================" + echo "CLEANUP IN PROGRESS" + echo "===========================================" + echo "Starting cleanup process..." + + # Terminate EMR cluster if it exists + if [ -n "${CLUSTER_ID:-}" ]; then + echo "Terminating EMR cluster: $CLUSTER_ID" + aws emr terminate-clusters --cluster-ids "$CLUSTER_ID" 2>/dev/null || true + + echo "Waiting for cluster to terminate..." + aws emr wait cluster-terminated --cluster-id "$CLUSTER_ID" 2>/dev/null || true + echo "Cluster terminated successfully." @@ -1126,2 +1114,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - return 0 - } @@ -1129,5 +1116,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Security: Validate database and table names - validate_identifier() { - local identifier="$1" - if [[ ! "$identifier" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then - return 1 + # Delete S3 bucket and contents if it exists and is not shared + if [ -n "${BUCKET_NAME:-}" ] && [ "${BUCKET_IS_SHARED:-false}" != "true" ]; then + echo "Deleting S3 bucket contents: $BUCKET_NAME" + aws s3 rm "s3://$BUCKET_NAME" --recursive 2>/dev/null || true + + echo "Deleting S3 bucket: $BUCKET_NAME" + aws s3 rb "s3://$BUCKET_NAME" 2>/dev/null || true @@ -1135 +1124,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - return 0 + + # Remove temporary key pair file if created by this script + if [ -f "${KEY_NAME_FILE:-}" ]; then + rm -f "$KEY_NAME_FILE" + echo "Removed temporary key pair file." + fi + + echo "Cleanup completed." @@ -1138,5 +1134,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Security: Safely generate random identifier - if ! command -v openssl &>/dev/null; then - RANDOM_ID=$(head -c 6 /dev/urandom | od -An -tx1 | tr -d ' ') - else - RANDOM_ID=$(openssl rand -hex 6) + # Validate AWS CLI is installed and configured + if ! command -v aws &> /dev/null; then + handle_error "AWS CLI is not installed" @@ -1145,3 +1139,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Security: Validate random ID format - if [[ ! "$RANDOM_ID" =~ ^[a-f0-9]{12}$ ]]; then - handle_error "Failed to generate valid random ID" + # Test AWS credentials + if ! aws sts get-caller-identity > /dev/null 2>&1; then + handle_error "AWS credentials are not configured or invalid" @@ -1150,4 +1144,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Check for shared prereq bucket with proper error handling - PREREQ_BUCKET="" - if aws cloudformation describe-stacks --stack-name tutorial-prereqs-bucket \ - --query 'Stacks[0].Outputs[?OutputKey==`BucketName`].OutputValue' --output text 2>/dev/null | grep -qv "^$"; then + # Generate a random identifier for S3 bucket + RANDOM_ID=$(openssl rand -hex 6) + + # Check for shared prereq bucket @@ -1155,2 +1149 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - --query 'Stacks[0].Outputs[?OutputKey==`BucketName`].OutputValue' --output text 2>/dev/null) - fi + --query 'Stacks[0].Outputs[?OutputKey==`BucketName`].OutputValue' --output text 2>/dev/null || true) @@ -1159 +1152 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - S3_BUCKET="$PREREQ_BUCKET" + BUCKET_NAME="$PREREQ_BUCKET" @@ -1161 +1154 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Using shared bucket: $S3_BUCKET" + echo "Using shared bucket: $BUCKET_NAME" @@ -1164,23 +1157 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - S3_BUCKET="athena-${RANDOM_ID}" - fi - - if ! validate_bucket_name "$S3_BUCKET"; then - handle_error "Invalid S3 bucket name: $S3_BUCKET" - fi - - DATABASE_NAME="mydatabase" - TABLE_NAME="cloudfront_logs" - - if ! validate_identifier "$DATABASE_NAME"; then - handle_error "Invalid database name: $DATABASE_NAME" - fi - - if ! validate_identifier "$TABLE_NAME"; then - handle_error "Invalid table name: $TABLE_NAME" - fi - - # Get the current AWS region with validation - AWS_REGION=$(aws configure get region 2>/dev/null || echo "") - if [ -z "$AWS_REGION" ]; then - AWS_REGION="us-east-1" - echo "No AWS region found in configuration, defaulting to $AWS_REGION" + BUCKET_NAME="emr-${RANDOM_ID}" @@ -1187,0 +1159 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + echo "Using bucket name: $BUCKET_NAME" @@ -1189,4 +1161,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Security: Validate region format - expanded regex for newer regions - if [[ ! "$AWS_REGION" =~ ^[a-z]{2}-[a-z]+-[0-9]{1}$ ]] && [[ ! "$AWS_REGION" =~ ^[a-z]+-[a-z]+-[0-9]{1}$ ]]; then - echo "WARNING: Region format may be invalid: $AWS_REGION" - fi + # Create S3 bucket with security best practices + echo "Creating S3 bucket: $BUCKET_NAME" + aws s3 mb "s3://$BUCKET_NAME" --region "${AWS_REGION:-us-east-1}" || handle_error "Failed to create S3 bucket" @@ -1194 +1165,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Using AWS Region: $AWS_REGION" + # Tag the bucket + aws s3api put-bucket-tagging --bucket "$BUCKET_NAME" \ + --tagging 'TagSet=[{Key=project,Value=doc-smith},{Key=tutorial,Value=emr-gs}]' @@ -1196,7 +1169,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Create S3 bucket for Athena query results - echo "Creating S3 bucket for Athena query results: $S3_BUCKET" - if [ "$BUCKET_IS_SHARED" = false ]; then - CREATE_BUCKET_RESULT=$(aws s3 mb "s3://$S3_BUCKET" --region "$AWS_REGION" 2>&1) - if echo "$CREATE_BUCKET_RESULT" | grep -qi "error\|failed"; then - handle_error "Failed to create S3 bucket: $CREATE_BUCKET_RESULT" - fi + # Enable bucket versioning for safety + aws s3api put-bucket-versioning --bucket "$BUCKET_NAME" --versioning-configuration Status=Enabled || true @@ -1204,3 +1172,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - aws s3api put-bucket-tagging \