AWS code-library documentation change
Summary
Replaced AWS Cloud Map tutorial with Amazon ECS Service Connect tutorial. The new example demonstrates creating an ECS cluster with Service Connect using default VPC, setting up IAM roles, security groups, and deploying an nginx service instead of the previous Cloud Map service discovery with Lambda and DynamoDB.
Security assessment
The changes involve a complete rewrite of the tutorial from Cloud Map service discovery to ECS Service Connect. While the new example includes security components like IAM roles and security groups, there's no evidence of addressing a specific security vulnerability or weakness. The changes appear to be a routine example update without security-focused documentation additions.
Diff
diff --git a/code-library/latest/ug/bash_2_servicediscovery_code_examples.md b/code-library/latest/ug/bash_2_servicediscovery_code_examples.md index 4b081af11..164b19baf 100644 --- a//code-library/latest/ug/bash_2_servicediscovery_code_examples.md +++ b//code-library/latest/ug/bash_2_servicediscovery_code_examples.md @@ -30 +30 @@ The following code example shows how to: - * Create an Cloud Map namespace + * Create the VPC infrastructure @@ -32 +32 @@ The following code example shows how to: - * Create a DynamoDB table + * Set up logging @@ -34 +34 @@ The following code example shows how to: - * Create an Cloud Map data service and register the DynamoDB table + * Create the ECS cluster @@ -36 +36 @@ The following code example shows how to: - * Create an IAM role for Lambda functions + * Configure IAM roles @@ -38 +38 @@ The following code example shows how to: - * Create the Lambda function to write data + * Create the service with Service Connect @@ -40 +40 @@ The following code example shows how to: - * Create an Cloud Map app service and register the Lambda write function + * Verify the deployment @@ -42 +42 @@ The following code example shows how to: - * Create the Lambda function to read data + * Clean up resources @@ -52 +52 @@ The following code example shows how to: -There's more on GitHub. Find the complete example and learn how to set up and run in the [Sample developer tutorials](https://github.com/aws-samples/sample-developer-tutorials/tree/main/tuts/004-cloudmap-custom-attributes) repository. +There's more on GitHub. Find the complete example and learn how to set up and run in the [Sample developer tutorials](https://github.com/aws-samples/sample-developer-tutorials/tree/main/tuts/085-amazon-ecs-service-connect) repository. @@ -57,2 +57,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # AWS Cloud Map Tutorial Script - # This script demonstrates how to use AWS Cloud Map for service discovery with custom attributes + # ECS Service Connect Tutorial Script v4 - Modified to use Default VPC + # This script creates an ECS cluster with Service Connect and deploys an nginx service + # Uses the default VPC to avoid VPC limits @@ -60 +61 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -euo pipefail + set -e # Exit on any error @@ -62,4 +63,12 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Set up logging - LOG_FILE="cloudmap-tutorial.log" - echo "AWS Cloud Map Tutorial Script" > "$LOG_FILE" - echo "Started at $(date)" >> "$LOG_FILE" + # Configuration + SCRIPT_NAME="ECS Service Connect Tutorial" + LOG_FILE="ecs-service-connect-tutorial-v4-default-vpc.log" + REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null)}} + if [ -z "$REGION" ]; then + echo "ERROR: No AWS region configured." + echo "Set one with: aws configure set region us-east-1" + exit 1 + fi + ENV_PREFIX="tutorial" + CLUSTER_NAME="${ENV_PREFIX}-cluster" + NAMESPACE_NAME="service-connect" @@ -67,2 +76,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Array to track created resources for cleanup - CREATED_RESOURCES=() + # Generate random suffix for unique resource names + RANDOM_SUFFIX=$(openssl rand -hex 6) @@ -70,4 +79,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to log commands and their output - log_cmd() { - echo "$ $1" | tee -a "$LOG_FILE" - eval "$1" | tee -a "$LOG_FILE" + # Arrays to track created resources for cleanup + declare -a CREATED_RESOURCES=() + + # Logging function + log() { + echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE" @@ -76 +87 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to handle errors + # Error handling function @@ -78,8 +89,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - local LINE=$1 - echo "An error occurred at line $LINE" | tee -a "$LOG_FILE" - echo "Resources created so far:" | tee -a "$LOG_FILE" - for resource in "${CREATED_RESOURCES[@]}"; do - echo "- $resource" | tee -a "$LOG_FILE" - done - echo "Attempting to clean up resources..." | tee -a "$LOG_FILE" - cleanup + log "ERROR: Script failed at line $1" + log "Attempting to clean up resources..." + cleanup_resources @@ -92,6 +98,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Helper function to wait for Cloud Map operations to complete - wait_for_operation() { - local OPERATION_ID=$1 - local TIMEOUT=300 # 5 minutes timeout - local START_TIME - START_TIME=$(date +%s) + # Function to add resource to tracking array + track_resource() { + CREATED_RESOURCES+=("$1") + log "Tracking resource: $1" + } @@ -99,3 +104,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - while true; do - local STATUS - STATUS=$(aws servicediscovery get-operation --operation-id "$OPERATION_ID" --query 'Operation.Status' --output text 2>/dev/null || echo "UNKNOWN") + # Function to check if command output contains actual errors + check_for_errors() { + local output="$1" + local command_name="$2" @@ -103,5 +109,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [ "$STATUS" == "SUCCESS" ]; then - echo "Operation completed successfully" | tee -a "$LOG_FILE" - break - elif [ "$STATUS" == "FAIL" ]; then - echo "Operation failed" | tee -a "$LOG_FILE" + # Check for specific AWS CLI error patterns, not just any occurrence of "error" + if echo "$output" | grep -qi "An error occurred\|InvalidParameterException\|AccessDenied\|ValidationException\|ResourceNotFoundException"; then + log "ERROR in $command_name: $output" @@ -109,0 +114,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + return 0 + } @@ -111,6 +117,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - local CURRENT_TIME - CURRENT_TIME=$(date +%s) - if [ $((CURRENT_TIME - START_TIME)) -gt $TIMEOUT ]; then - echo "Operation timed out" | tee -a "$LOG_FILE" - return 1 - fi + # Function to get AWS account ID + get_account_id() { + ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text) + log "Using AWS Account ID: $ACCOUNT_ID" + } @@ -118,2 +123,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - sleep 5 - done + # Function to wait for resources to be ready + wait_for_resource() { + local resource_type="$1" + local resource_id="$2" @@ -120,0 +128,9 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + case "$resource_type" in + "cluster") + log "Waiting for cluster $resource_id to be active..." + local attempt=1 + local max_attempts=30 + while [ $attempt -le $max_attempts ]; do + local status=$(aws ecs describe-clusters --clusters "$resource_id" --query 'clusters[0].status' --output text) + if [ "$status" = "ACTIVE" ]; then + log "Cluster is now active" @@ -121,0 +138,17 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + fi + log "Cluster status: $status (attempt $attempt/$max_attempts)" + sleep 10 + ((attempt++)) + done + log "ERROR: Cluster did not become active within expected time" + return 1 + ;; + "service") + log "Waiting for service $resource_id to be stable..." + aws ecs wait services-stable --cluster "$CLUSTER_NAME" --services "$resource_id" + ;; + "nat-gateway") + log "Waiting for NAT Gateway $resource_id to be available..." + aws ec2 wait nat-gateway-available --nat-gateway-ids "$resource_id" + ;; + esac @@ -124,8 +157,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to clean up resources - cleanup() { - echo "Cleaning up resources..." | tee -a "$LOG_FILE" - - # Reverse the order of created resources for proper deletion - for ((i=${#CREATED_RESOURCES[@]}-1; i>=0; i--)); do - resource="${CREATED_RESOURCES[$i]}" - echo "Deleting $resource..." | tee -a "$LOG_FILE" + # Function to use default VPC infrastructure + setup_default_vpc_infrastructure() { + log "Using default VPC infrastructure..." @@ -133,4 +161,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if [[ $resource == "instance:"* ]]; then - # Extract service ID and instance ID - SERVICE_ID=$(echo "$resource" | cut -d':' -f2) - INSTANCE_ID=$(echo "$resource" | cut -d':' -f3) + # Get default VPC + VPC_ID=$(aws ec2 describe-vpcs --filters "Name=isDefault,Values=true" --query 'Vpcs[0].VpcId' --output text) + if [[ "$VPC_ID" == "None" || -z "$VPC_ID" ]]; then + log "ERROR: No default VPC found. Please create a default VPC first." + exit 1 + fi + log "Using default VPC: $VPC_ID" @@ -138,4 +169,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Check if instance exists before trying to deregister - INSTANCE_EXISTS=$(aws servicediscovery list-instances --service-id "$SERVICE_ID" --query "Instances[?Id=='$INSTANCE_ID'].Id" --output text 2>/dev/null || echo "") - if [[ -n "$INSTANCE_EXISTS" ]]; then - OPERATION_ID=$(aws servicediscovery deregister-instance --service-id "$SERVICE_ID" --instance-id "$INSTANCE_ID" --query 'OperationId' --output text) + # Get default subnets + SUBNETS=$(aws ec2 describe-subnets --filters "Name=vpc-id,Values=$VPC_ID" "Name=default-for-az,Values=true" --query 'Subnets[].SubnetId' --output text) + SUBNET_ARRAY=($SUBNETS) @@ -143,5 +173,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Wait for deregistration to complete - echo "Waiting for instance deregistration to complete..." | tee -a "$LOG_FILE" - wait_for_operation "$OPERATION_ID" || true