AWS res documentation change
Summary
Multiple updates including secret format requirements, dependency version pinning, OS support expansion, and path corrections
Security assessment
Added documentation about secret format requirements (explicitly prohibiting NT-style usernames) and dependency version pinning to prevent unintended upgrades. These clarify security-related configurations but don't address a specific vulnerability.
Diff
diff --git a/res/archive/release-minus-4/ug/prerequisites.md b/res/archive/release-minus-4/ug/prerequisites.md index 494d38d31..91c05a0ae 100644 --- a//res/archive/release-minus-4/ug/prerequisites.md +++ b//res/archive/release-minus-4/ug/prerequisites.md @@ -76 +76 @@ We recommend using a custom domain for the product in order to have a user-frien -There is a process in the External Resources stack to create a certificate for a custom domain which you provide. You can skip the steps here if you have a domain and want to use the certificate generatation capabilities of the External Resources stack. +There is a process in the External Resources stack to create a certificate for a custom domain which you provide. You can skip the steps here if you have a domain and want to use the certificate generation capabilities of the External Resources stack. @@ -105 +105 @@ Or, follow these steps to register a domain using Amazon Route 53 and import a c -If you are deploying in the AWS GovCloud (US-West) Region and you are using a custom domain for Research and Engineering Studio, you will need to complete these prerequisite steps. +If you are deploying in an AWS GovCloud Region and you are using a custom domain for Research and Engineering Studio, you will need to complete these prerequisite steps. @@ -157 +157 @@ If you are deploying a demo environment and do not have these external resources -For demo deployments in the AWS GovCloud (US-West) Region, you will need to complete the prerequisite steps in Create domain (GovCloud only). +For demo deployments in the an AWS GovCloud Region, you will need to complete the prerequisite steps in Create domain (GovCloud only). @@ -192 +192,7 @@ When creating your Secret in the Secrets Manager, choose **Other type of secrets -If you choose Microsoft Active Directory (AD) as the identity source for RES, you have a Service Account in your AD that allows for programmatic access. You must pass a secret with the Service Account's credentials as part of your RES installation. The Service Account is responsible for the following functions: +If you choose Microsoft Active Directory (AD) as the identity source for RES, you have a Service Account in your AD that allows for programmatic access. You must pass a secret with the Service Account's credentials as part of your RES installation. The secret must have the format shown here. + + + +Also note that the `username` field doesn't support NT-style logon names of the format `DOMAIN\username`. + +The Service Account is responsible for the following functions: @@ -233 +239,5 @@ Deploying Research and Engineering Studio in an isolated VPC offers enhanced sec - 1. Download [ dependencies](https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/latest/res-installation-scripts.tar.gz). To deploy in an isolated VPC, the RES infrastructure requires the availability of dependencies without having public internet access. + 1. Download the dependencies at [ https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/latest/res-installation-scripts.tar.gz](https://research-engineering-studio-us-east-1.s3.amazonaws.com/releases/latest/res-installation-scripts.tar.gz). To deploy in an isolated VPC, the RES infrastructure requires the availability of dependencies without having public internet access. + +###### Important + +Replace `latest` in the download URI with with the exact version number (for example, `2025.06`) if your RES environment version is not the latest. @@ -272 +282 @@ Image operating system (OS) | Linux -Compatible OS Versions | Amazon Linux 2, RHEL8, RHEL9, or Windows 10 and 11 +Compatible OS Versions | Amazon Linux 2, Amazon Linux 2023, RHEL8, RHEL 9, or Windows 10 and 11 @@ -304,3 +313,0 @@ If you are setting up `http_proxy` and `https_proxy` environment variables, the - - AWSAccountID: - type: string - description: RES Environment AWS Account ID @@ -319,2 +326 @@ If you are setting up `http_proxy` and `https_proxy` environment variables, the - destination: '/root/bootstrap/res_dependencies/res_dependencies.tar.gz' - expectedBucketOwner: '{{ AWSAccountID }}' + destination: '/root/bootstrap/res-installation-scripts/res-installation-scripts.tar.gz' @@ -327,3 +333,3 @@ If you are setting up `http_proxy` and `https_proxy` environment variables, the - - 'cd /root/bootstrap/res_dependencies' - - 'tar -xf res_dependencies.tar.gz' - - 'cd all_dependencies' + - 'cd /root/bootstrap/res-installation-scripts' + - 'tar -xf res-installation-scripts.tar.gz' + - 'cd scripts/infrastructure-host' @@ -342 +348 @@ If you are setting up `http_proxy` and `https_proxy` environment variables, the - > " > /etc/environment + " > /etc/environment @@ -358 +364 @@ Section | Parameter | User entry -| **Image name** | Amazon Linux 2 x86, Red Hat Enterprise Linux 8 x86, or Red Hat Enterprise Linux 9 x86 +| **Image name** | Amazon Linux 2 x86, Amazon Linux 2023 x86, Red Hat Enterprise Linux 8 x86, or Red Hat Enterprise Linux 9 x86 @@ -361 +367 @@ Section | Parameter | User entry -**Working directory** | **Working directory path** | /root/bootstrap/res_dependencies +**Working directory** | **Working directory path** | /root/bootstrap/res-installation-scripts @@ -365 +371 @@ Section | Parameter | User entry - * Owned by you: Amazon EC2 component created previously. Put your AWS account ID and current AWS Region in the fields. + * Owned by you: Amazon EC2 component created previously. Put your current AWS Region in the field.