AWS cli medium security documentation change
Summary
Clarified validation requirements for imageBuildVersionArn and added context about workflow step state requirements for actions.
Security assessment
Added strict validation that imageBuildVersionARN must match the executing image to prevent workflow manipulation. This addresses potential security risks where incorrect ARNs could lead to unintended actions on wrong resources.
Diff
diff --git a/cli/latest/reference/imagebuilder/send-workflow-step-action.md b/cli/latest/reference/imagebuilder/send-workflow-step-action.md index 2f6017f6c..9c00509c8 100644 --- a//cli/latest/reference/imagebuilder/send-workflow-step-action.md +++ b//cli/latest/reference/imagebuilder/send-workflow-step-action.md @@ -15 +15 @@ - * [AWS CLI 2.35.11 Command Reference](../../index.html) » + * [AWS CLI 2.35.13 Command Reference](../../index.html) » @@ -109 +109 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/imageb -> The Amazon Resource Name (ARN) of the image build version to send action for. +> The Amazon Resource Name (ARN) of the image build version associated with the workflow step execution. This value must match the image that owns the waiting step. If the ARN does not correspond to the image running the workflow, then the request fails with a validation error. @@ -119 +119 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/imageb -> The action for the image creation process to take while a workflow `WaitForAction` step waits for an asynchronous action to complete. +> The action to perform on the paused workflow step. The workflow step must be in a waiting state to accept an action. The request fails if the step has already timed out or been actioned. @@ -130 +130 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/imageb -> The reason why this action is sent. +> The reason for the action. This value is stored with the step execution record and is accessible in subsequent workflow steps via step output references. @@ -304 +304 @@ clientToken -> (string) - * [AWS CLI 2.35.11 Command Reference](../../index.html) » + * [AWS CLI 2.35.13 Command Reference](../../index.html) »