AWS cli medium security documentation change
Summary
Enhanced logging configuration documentation with execution role requirements and naming constraints
Security assessment
Added explicit requirement for executionRole with CloudWatch Logs write permissions when using custom log group names. Clarifies security boundary by specifying that service-managed logs use service-linked role, while custom logs require explicit permissions. Prevents misconfiguration that could lead to logging failures or unauthorized access.
Diff
diff --git a/cli/latest/reference/imagebuilder/create-image-pipeline.md b/cli/latest/reference/imagebuilder/create-image-pipeline.md index 9a19147f4..4721a397b 100644 --- a//cli/latest/reference/imagebuilder/create-image-pipeline.md +++ b//cli/latest/reference/imagebuilder/create-image-pipeline.md @@ -15 +15 @@ - * [AWS CLI 2.35.11 Command Reference](../../index.html) » + * [AWS CLI 2.35.13 Command Reference](../../index.html) » @@ -573 +573 @@ JSON Syntax: -> Define logging configuration for the image build process. +> Specifies the logging configuration for the image pipeline. Use this to define custom CloudWatch Logs log groups for your pipeline execution logs and image build logs. The service manages log groups with names starting with `/aws/imagebuilder/` using the service-linked role. For custom log group names outside of this prefix, you must also provide an `executionRole` . @@ -577 +577 @@ JSON Syntax: ->> The log group name that Image Builder uses for image creation. If not specified, the log group name defaults to `/aws/imagebuilder/image-name` . +>> Specifies the CloudWatch Logs log group name for image build logs. The log group name can contain alphanumeric characters, hyphens, underscores, forward slashes, and periods, up to 512 characters. Log group names not starting with `/aws/imagebuilder/` require an `executionRole` with CloudWatch Logs write permissions. If not specified, defaults to `/aws/imagebuilder/image-name` . @@ -589 +589 @@ JSON Syntax: ->> The log group name that Image Builder uses for the log output during creation of a new pipeline. If not specified, the pipeline log group name defaults to `/aws/imagebuilder/pipeline/pipeline-name` . +>> Specifies the CloudWatch Logs log group name for pipeline execution logs. The log group name can contain alphanumeric characters, hyphens, underscores, forward slashes, and periods, up to 512 characters. Log group names not starting with `/aws/imagebuilder/` require an `executionRole` with CloudWatch Logs write permissions. If not specified, defaults to `/aws/imagebuilder/pipeline/pipeline-name` . @@ -819 +819 @@ imagePipelineArn -> (string) - * [AWS CLI 2.35.11 Command Reference](../../index.html) » + * [AWS CLI 2.35.13 Command Reference](../../index.html) »