AWS cli medium security documentation change

Service: cli · 2026-07-01 · Security-related medium

File: cli/latest/reference/imagebuilder/get-image-pipeline.md

Summary

Updated CloudWatch Logs documentation for image build logs and pipeline execution logs to specify naming requirements and permission requirements for custom log groups.

Security assessment

The change explicitly documents that non-standard log group names require an executionRole with CloudWatch Logs write permissions. This addresses potential security risks where misconfigured permissions could lead to log delivery failures or unauthorized access. Failure to set proper permissions could result in loss of audit trails.

Diff

diff --git a/cli/latest/reference/imagebuilder/get-image-pipeline.md b/cli/latest/reference/imagebuilder/get-image-pipeline.md
index 5aaf49e11..c515c009f 100644
--- a//cli/latest/reference/imagebuilder/get-image-pipeline.md
+++ b//cli/latest/reference/imagebuilder/get-image-pipeline.md
@@ -15 +15 @@
-  * [AWS CLI 2.35.11 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.13 Command Reference](../../index.html) »
@@ -673 +673 @@ imagePipeline -> (structure)
->>> The log group name that Image Builder uses for image creation. If not specified, the log group name defaults to `/aws/imagebuilder/image-name` .
+>>> Specifies the CloudWatch Logs log group name for image build logs. The log group name can contain alphanumeric characters, hyphens, underscores, forward slashes, and periods, up to 512 characters. Log group names not starting with `/aws/imagebuilder/` require an `executionRole` with CloudWatch Logs write permissions. If not specified, defaults to `/aws/imagebuilder/image-name` .
@@ -685 +685 @@ imagePipeline -> (structure)
->>> The log group name that Image Builder uses for the log output during creation of a new pipeline. If not specified, the pipeline log group name defaults to `/aws/imagebuilder/pipeline/pipeline-name` .
+>>> Specifies the CloudWatch Logs log group name for pipeline execution logs. The log group name can contain alphanumeric characters, hyphens, underscores, forward slashes, and periods, up to 512 characters. Log group names not starting with `/aws/imagebuilder/` require an `executionRole` with CloudWatch Logs write permissions. If not specified, defaults to `/aws/imagebuilder/pipeline/pipeline-name` .
@@ -729 +729 @@ imagePipeline -> (structure)
-  * [AWS CLI 2.35.11 Command Reference](../../index.html) »
+  * [AWS CLI 2.35.13 Command Reference](../../index.html) »