AWS imagebuilder high security documentation change

Service: imagebuilder · 2026-07-07 · Security-related high

File: imagebuilder/latest/userguide/toe-component-manager.md

Summary

Added --blocked-action-modules parameter, clarified document formatting requirements, added JSON output examples for run/validate commands

Security assessment

The --blocked-action-modules parameter explicitly blocks execution of specified modules, providing security control against potentially harmful actions. This directly addresses security by allowing explicit denylisting of modules.

Diff

diff --git a/imagebuilder/latest/userguide/toe-component-manager.md b/imagebuilder/latest/userguide/toe-component-manager.md
index 62dfa248b..b68b2a645 100644
--- a//imagebuilder/latest/userguide/toe-component-manager.md
+++ b//imagebuilder/latest/userguide/toe-component-manager.md
@@ -127 +127,2 @@ You must specify exactly one of the following parameters, never both:
-          [--phases <phase name>] [--state-directory <directory path>] [--version <?>] 
+          [--phases <phase name>] [--blocked-action-modules <module,module,...>]
+          [--state-directory <directory path>] [--version <?>]
@@ -190 +191 @@ Short form: -d ``./doc-1.yaml``,``./doc-n``
-The component documents _(conditional)_. This parameter contains a comma-separated list of file locations for the YAML component documents to run. If you specify YAML documents for the **run** command using the `--documents` parameter, you must not specify the `--config` parameter.
+The component documents _(conditional)_. This parameter contains a comma-separated list of file locations for the YAML component documents to run. If you specify YAML documents for the **run** command using the `--documents` parameter, you must not specify the `--config` parameter. Do not include spaces between items in the list.
@@ -203,4 +203,0 @@ Valid locations include:
-###### Note
-
-There are no spaces between items in the list, only commas.
-
@@ -262,0 +260,7 @@ The file path where state tracking files are stored.
+**\--blocked-action-modules**
+    
+
+Short form: N/A
+
+A comma-separated list of action modules that cannot run in the component document. If a document contains a blocked action module, validation fails before execution begins.
+
@@ -285,0 +290,27 @@ Enables verbose logging to the console.
+#### Output
+
+The **run** command produces a JSON execution summary. The following example shows output from a successful execution.
+    
+    
+    {
+        "executionId": "12345678-abcd-efgh-1234-example12345",
+        "status": "success",
+        "failedStepCount": 0,
+        "executedStepCount": 3,
+        "ignoredFailedStepCount": 0,
+        "skippedStepCount": 0,
+        "failureMessage": "",
+        "logUrl": "s3://my-bucket/my-prefix/12345678-abcd-efgh-1234-example12345"
+    }
+
+The `status` field reports the overall execution result:
+
+  * `success` – All phases and steps completed successfully.
+
+  * `failed` – One or more steps failed because the `onFailure` action is `Abort`.
+
+  * `timedOut` – One or more steps exceeded their `timeoutSeconds` value.
+
+
+
+
@@ -293 +324,2 @@ When you run this command, it validates the YAML document syntax for each of the
-    awstoe validate [--document-s3-bucket-owner <owner>] 
+    awstoe validate [--blocked-action-modules <module,module,...>]
+          [--document-s3-bucket-owner <owner>]
@@ -299,0 +332,7 @@ When you run this command, it validates the YAML document syntax for each of the
+**\--blocked-action-modules**
+    
+
+Short form: N/A
+
+A comma-separated list of action modules that cannot run in the component document. If a document contains a blocked action module, validation fails.
+
@@ -312 +351 @@ Short form: -d ``./doc-1.yaml``,``./doc-n``
-The component documents _(required)_. This parameter contains a comma-separated list of file locations for the YAML component documents to run. Valid locations include:
+The component documents _(required)_. This parameter contains a comma-separated list of file locations for the YAML component documents to run, with no spaces between items. Valid locations include:
@@ -323,4 +361,0 @@ The component documents _(required)_. This parameter contains a comma-separated
-###### Note
-
-There are no spaces between items in the list, only commas.
-
@@ -342,0 +378,18 @@ Enables verbose logging to the console.
+#### Output
+
+The **validate** command produces a JSON validation result. The following example shows output from a successful validation.
+    
+    
+    {
+        "validationStatus": "success",
+        "message": "Validation successful."
+    }
+
+The following example shows output when validation fails.
+    
+    
+    {
+        "validationStatus": "failed",
+        "message": "Document has 0 phases. Phases list must not be empty."
+    }
+