AWS imagebuilder documentation change
Summary
Added documentation for schemaVersion support, disableLogging field for suppressing sensitive data logs, and naming rules/conventions for phases and steps.
Security assessment
The disableLogging feature addition explicitly addresses security by allowing suppression of logs for steps handling sensitive data, preventing potential exposure of credentials or secrets in logs. No evidence of fixing a specific vulnerability.
Diff
diff --git a/imagebuilder/latest/userguide/toe-use-documents.md b/imagebuilder/latest/userguide/toe-use-documents.md index 60436504e..b029a42e5 100644 --- a//imagebuilder/latest/userguide/toe-use-documents.md +++ b//imagebuilder/latest/userguide/toe-use-documents.md @@ -229,0 +230,4 @@ phases | A list of phases with their steps. | List | Yes +The `schemaVersion` field accepts `"1.0"` or `"1"` (which normalizes to `"1.0"`). AWSTOE does not support other schema versions. + +You can set the optional `disableLogging` field to `true` at the document, phase, or step level. This setting suppresses logging output for that scope. Use this setting for steps that handle sensitive data. + @@ -234 +238,8 @@ Field | Description | Type | Required -name | Name of the phase. | String | Yes +name | Name of the phase. Phase names must conform to the following rules: + + * Phase names must contain only letters, numbers, hyphens, and underscores. + * Phase names must be 3 to 128 characters long. + * Phase names must be unique within a document. + * When used with EC2 Image Builder, at least one phase must be named `build`, `validate`, or `test`. + +| String | Yes @@ -241 +252,7 @@ Field | Description | Type | Required | Default value -name | User-defined name for the step. | String | | +name | User-defined name for the step. Step names must conform to the following rules: + + * Step names must contain only letters, numbers, hyphens, and underscores. + * Step names must be 3 to 128 characters long. + * Step names must be unique within a phase. + +| String | |