AWS code-library documentation change
Summary
Replaced AWS IoT Device Defender tutorial with AWS Config setup tutorial. Updated steps, GitHub repository link, and completely replaced Bash script from IoT Device Defender operations to AWS Config setup procedures including S3 bucket creation, SNS topic setup, IAM role configuration, and AWS Config recorder/delivery channel management.
Security assessment
The changes involve a complete replacement of one tutorial (IoT Device Defender) with another (AWS Config). There is no evidence of addressing a specific security vulnerability or weakness. While AWS Config is a security service, the change replaces existing security documentation rather than adding new security content or addressing a disclosed vulnerability.
Diff
diff --git a/code-library/latest/ug/bash_2_sns_code_examples.md b/code-library/latest/ug/bash_2_sns_code_examples.md index 6f3d20b82..91efd42fa 100644 --- a//code-library/latest/ug/bash_2_sns_code_examples.md +++ b//code-library/latest/ug/bash_2_sns_code_examples.md @@ -274 +274 @@ The following code example shows how to: - * Create Required IAM Roles + * Create an Amazon S3 bucket @@ -276 +276 @@ The following code example shows how to: - * Enable IoT Device Defender Audit Checks + * Create an Amazon SNS topic @@ -278 +278 @@ The following code example shows how to: - * Run an On-Demand Audit + * Create an IAM role for Config @@ -280 +280 @@ The following code example shows how to: - * Create a Mitigation Action + * Set up the Config configuration recorder @@ -282 +282 @@ The following code example shows how to: - * Apply Mitigation Actions to Findings + * Set up the Config delivery channel @@ -284 +284 @@ The following code example shows how to: - * Set Up SNS Notifications (Optional) + * Start the configuration recorder @@ -286 +286 @@ The following code example shows how to: - * Enable IoT Logging + * Verify the Config setup @@ -296 +296 @@ The following code example shows how to: -There's more on GitHub. Find the complete example and learn how to set up and run in the [Sample developer tutorials](https://github.com/aws-samples/sample-developer-tutorials/tree/main/tuts/079-aws-iot-device-defender-gs) repository. +There's more on GitHub. Find the complete example and learn how to set up and run in the [Sample developer tutorials](https://github.com/aws-samples/sample-developer-tutorials/tree/main/tuts/053-aws-config-gs) repository. @@ -301,3 +301,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # AWS IoT Device Defender Getting Started Script - # This script demonstrates how to use AWS IoT Device Defender to enable audit checks, - # view audit results, create mitigation actions, and apply them to findings. + # AWS Config Setup Script (v2) + # This script sets up AWS Config with the AWS CLI @@ -305 +304,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - set -euo pipefail + # Error handling + set -e + LOGFILE="aws-config-setup-v2.log" + touch $LOGFILE + exec > >(tee -a $LOGFILE) + exec 2>&1 @@ -307,3 +311,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Set up logging - LOG_FILE="iot-device-defender-script-$(date +%Y%m%d%H%M%S).log" - exec > >(tee -a "$LOG_FILE") 2>&1 + # Function to handle errors + handle_error() { + echo "ERROR: An error occurred at line $1" + echo "Attempting to clean up resources..." + cleanup_resources + exit 1 + } @@ -311,5 +319,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "===================================================" - echo "AWS IoT Device Defender Getting Started Script" - echo "===================================================" - echo "Starting script execution at $(date)" - echo "" + # Set trap for error handling + trap 'handle_error $LINENO' ERR @@ -317,5 +322,9 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to check for errors in command output - check_error() { - if echo "$1" | grep -iE "An error occurred|Exception|Failed|usage: aws" > /dev/null; then - echo "ERROR: Command failed with the following output:" - echo "$1" + # Function to generate random identifier + generate_random_id() { + echo $(openssl rand -hex 6) + } + + # Function to check if command was successful + check_command() { + if echo "$1" | grep -i "error" > /dev/null; then + echo "ERROR: $1" @@ -327,6 +336,6 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to safely extract JSON values using jq - extract_json_value() { - local json="$1" - local key="$2" - echo "$json" | jq -r ".${key} // empty" 2>/dev/null || echo "" - } + # Function to clean up resources + cleanup_resources() { + if [ -n "$CONFIG_RECORDER_NAME" ]; then + echo "Stopping configuration recorder..." + aws configservice stop-configuration-recorder --configuration-recorder-name "$CONFIG_RECORDER_NAME" 2>/dev/null || true + fi @@ -334,5 +343,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to validate JSON - validate_json() { - local json="$1" - echo "$json" | jq empty 2>/dev/null - } + # Check if we created a new delivery channel before trying to delete it + if [ -n "$DELIVERY_CHANNEL_NAME" ] && [ "$CREATED_NEW_DELIVERY_CHANNEL" = "true" ]; then + echo "Deleting delivery channel..." + aws configservice delete-delivery-channel --delivery-channel-name "$DELIVERY_CHANNEL_NAME" 2>/dev/null || true + fi @@ -340,5 +349,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to check AWS CLI availability - check_aws_cli() { - if ! command -v aws &> /dev/null; then - echo "ERROR: AWS CLI is not installed or not in PATH" - return 1 + if [ -n "$CONFIG_RECORDER_NAME" ] && [ "$CREATED_NEW_CONFIG_RECORDER" = "true" ]; then + echo "Deleting configuration recorder..." + aws configservice delete-configuration-recorder --configuration-recorder-name "$CONFIG_RECORDER_NAME" 2>/dev/null || true @@ -346,3 +353,5 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - if ! command -v jq &> /dev/null; then - echo "ERROR: jq is not installed or not in PATH" - return 1 + + if [ -n "$ROLE_NAME" ]; then + if [ -n "$POLICY_NAME" ]; then + echo "Detaching custom policy from role..." + aws iam delete-role-policy --role-name "$ROLE_NAME" --policy-name "$POLICY_NAME" 2>/dev/null || true @@ -350,2 +358,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - return 0 - } @@ -353,7 +360,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to get AWS account ID - get_account_id() { - local account_id - account_id=$(aws sts get-caller-identity --query 'Account' --output text 2>/dev/null) || true - if [ -z "$account_id" ]; then - echo "ERROR: Could not retrieve AWS account ID" - return 1 + if [ -n "$MANAGED_POLICY_ARN" ]; then + echo "Detaching managed policy from role..." + aws iam detach-role-policy --role-name "$ROLE_NAME" --policy-arn "$MANAGED_POLICY_ARN" 2>/dev/null || true @@ -361,3 +363,0 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "$account_id" - return 0 - } @@ -365,7 +365,3 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Function to create IAM roles with retry logic - create_iam_role() { - local ROLE_NAME=$1 - local TRUST_POLICY=$2 - local MANAGED_POLICY=$3 - local RETRY_COUNT=0 - local MAX_RETRIES=3 + echo "Deleting IAM role..." + aws iam delete-role --role-name "$ROLE_NAME" 2>/dev/null || true + fi @@ -373 +369,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Creating IAM role: $ROLE_NAME" + if [ -n "$SNS_TOPIC_ARN" ]; then + echo "Deleting SNS topic..." + aws sns delete-topic --topic-arn "$SNS_TOPIC_ARN" 2>/dev/null || true + fi @@ -375,4 +374,7 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Validate trust policy JSON - if ! validate_json "$TRUST_POLICY"; then - echo "ERROR: Invalid trust policy JSON for role $ROLE_NAME" - return 1 + if [ -n "$S3_BUCKET_NAME" ]; then + echo "Emptying S3 bucket..." + aws s3 rm "s3://$S3_BUCKET_NAME" --recursive 2>/dev/null || true + + echo "Deleting S3 bucket..." + if [ "$BUCKET_IS_SHARED" = "false" ]; then + aws s3api delete-bucket --bucket "$S3_BUCKET_NAME" 2>/dev/null || true @@ -379,0 +382,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + fi + } @@ -381,7 +385,13 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - # Check if role already exists - if aws iam get-role --role-name "$ROLE_NAME" >/dev/null 2>&1; then - echo "Role $ROLE_NAME already exists, skipping creation" - ROLE_ARN=$(aws iam get-role --role-name "$ROLE_NAME" --query 'Role.Arn' --output text 2>/dev/null) || true - if [ -z "$ROLE_ARN" ]; then - echo "ERROR: Could not retrieve ARN for existing role $ROLE_NAME" - return 1 + # Function to display created resources + display_resources() { + echo "" + echo "===========================================" + echo "CREATED RESOURCES" + echo "===========================================" + echo "S3 Bucket: $S3_BUCKET_NAME" + echo "SNS Topic ARN: $SNS_TOPIC_ARN" + echo "IAM Role: $ROLE_NAME" + if [ "$CREATED_NEW_CONFIG_RECORDER" = "true" ]; then + echo "Configuration Recorder: $CONFIG_RECORDER_NAME (newly created)" + else + echo "Configuration Recorder: $CONFIG_RECORDER_NAME (existing)" @@ -389,2 +399,4 @@ There's more on GitHub. Find the complete example and learn how to set up and ru - echo "Role ARN: $ROLE_ARN" - return 0 + if [ "$CREATED_NEW_DELIVERY_CHANNEL" = "true" ]; then + echo "Delivery Channel: $DELIVERY_CHANNEL_NAME (newly created)" + else + echo "Delivery Channel: $DELIVERY_CHANNEL_NAME (existing)" @@ -391,0 +404,2 @@ There's more on GitHub. Find the complete example and learn how to set up and ru + echo "===========================================" + } @@ -393,5 +407,8 @@ There's more on GitHub. Find the complete example and learn how to set up and ru