AWS marketplace: Restructure container version steps; add limits and secrets guidance
Summary
Editorial rewrite of the AWS Marketplace container product version guide: notes converted to inline prose, step order fixed, a new 'Limits for container product versions' table added (repositories, delivery options, images, override parameters), Helm field descriptions corrected, and required override parameters for paid products clarified. Security-adjacent content retained/rewritten includes masking secrets with 'Hide passwords and secrets' (NoEcho), the ${AWSMP_LICENSE_SECRET} and ${AWSMP_SERVICE_ACCOUNT} override parameters, and automatic container image scanning; the note listing Amazon ECR API operations (DescribeImages, GetAuthorizationToken, ListImages) was removed.
Security assessment
The change is primarily a documentation restructure, but it preserves and rewords security-relevant guidance: masking sensitive values via 'Hide passwords and secrets' (CloudFormation NoEcho), required override parameters for license secrets (${AWSMP_LICENSE_SECRET}) and service accounts (${AWSMP_SERVICE_ACCOUNT}), and automatic scanning of container images for security issues. No specific vulnerability, CVE, or incident is referenced, so it is hardening/best-practice documentation rather than a fix.
Evidence
+ 10. Choose **Hide passwords and secrets** to mask sensitive information in consoles, command line tools, and APIs. For more information, see the `NoEcho` parameter documentation in [Parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html) in the _AWS CloudFormation User Guide_.
Diff
diff --git a/marketplace/latest/userguide/container-add-version.md b/marketplace/latest/userguide/container-add-version.md index ec77333..d90ac71 100644 --- a//marketplace/latest/userguide/container-add-version.md +++ b//marketplace/latest/userguide/container-add-version.md @@ -7 +7 @@ -Step 1: Add repositoriesStep 2: Upload container images and artifacts to repositoriesStep 3: Add a new version to your container productStep 4: Update version informationRestrict a version of your Amazon EKS add-on +Step 1: Add repositoriesStep 2: Upload container images and artifacts to repositoriesStep 3: Add a new version to your container productStep 4: Update version informationRestrict a version of your Amazon EKS add-onLimits for container product versions @@ -13,3 +13 @@ As an AWS Marketplace seller, you can add new versions of your container product -###### Note - -You can't add a version to your product until you have created the product ID and the pricing for your product. For more information about those steps, see [Step 1: Create the product ID and product code for your container product](./container-product-getting-started.html#create-initial-container-product). +Before you add a version, create the product ID and the pricing for your product. For more information, see [Step 1: Create the product ID and product code for your container product](./container-product-getting-started.html#create-initial-container-product). For the limits that apply to repositories, images, and delivery options, see Limits for container product versions. @@ -28,0 +27 @@ You can't add a version to your product until you have created the product ID an + * Limits for container product versions @@ -32,3 +30,0 @@ You can't add a version to your product until you have created the product ID an -## Step 1: Add repositories - -Your container images and other artifacts for your product are stored in repositories in AWS Marketplace. Typically, you create one repository for each artifact needed, but the repository can store multiple versions of the artifact (with different tags). @@ -36 +32 @@ Your container images and other artifacts for your product are stored in reposit -###### Note +## Step 1: Add repositories @@ -38 +34 @@ Your container images and other artifacts for your product are stored in reposit -All images in your product deployment must use images from the AWS Marketplace repositories. +Your container images and other artifacts for your product are stored in repositories in AWS Marketplace. Typically, you create one repository for each artifact needed, but the repository can store multiple versions of the artifact (with different tags). All images in your product deployment must come from your AWS Marketplace repositories. @@ -50 +46 @@ The following procedure describes how to add any needed repositories in AWS Mark - 4. Enter the name for the repository that you want to create. If you want to create more than one new repository: + 4. Enter a name for the repository. Repository names must be unique across all products in your seller account. To create more than one repository, choose **Add new repository** for each additional repository. @@ -52,5 +48 @@ The following procedure describes how to add any needed repositories in AWS Mark - * Choose **Add new repository** for each additional repository. - - * Give it a unique name. The unique name you choose must be across all products in your seller account. - -###### Note + 5. Select **Submit**. @@ -58 +49,0 @@ The following procedure describes how to add any needed repositories in AWS Mark -The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazonaws.com/<sellerName>/<repositoryName>`. When you add items to the repository (in the following procedure), they will get a tag and have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazonaws.com/<sellerName>/<repositoryName>:<tag>`. @@ -60 +50,0 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo - * The `repositoryID` is an internal ID for AWS Marketplace. @@ -62 +51,0 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo - * The `sellerName` is based on the name you created for your seller account. When your seller display name generates an invalid `sellerName` for repository prefix, AWS Marketplace automatically substitutes a UUID (Universally Unique Identifier) in place of the seller name. To change the UUID prefix in your repository name, contact the AWS Marketplace operations team. @@ -64 +53 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo - * The `respositoryName` is defined in this step. +A new request is created and shown on the **Requests** tab. When it's completed, within minutes, you can start adding container images and other artifacts to the repositories you have created. A product can have up to 70 repositories. @@ -66 +55 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo - * The `tag` is set when you upload an artifact to the repository. +Each repository has a URI in this format: `<registryID>.dkr.ecr.us-east-1.amazonaws.com/<sellerName>/<repositoryName>`. When you push an artifact, its tag is added to the end: `<registryID>.dkr.ecr.us-east-1.amazonaws.com/<sellerName>/<repositoryName>:<tag>`. @@ -68 +57 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo - 5. Select **Submit**. + * `registryID` is the ID of the AWS account that hosts AWS Marketplace repositories. @@ -69,0 +59 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo + * `sellerName` is a prefix that AWS Marketplace generates from your seller display name. It doesn't change after it's created. If your display name doesn't produce a prefix, AWS Marketplace uses a UUID (universally unique identifier) instead. To change the prefix, contact the AWS Marketplace operations team. @@ -70,0 +61 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo + * `repositoryName` is the name that you enter in this procedure. @@ -71,0 +63 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo + * `tag` is the tag that you set when you push an artifact to the repository. @@ -73 +64,0 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo -###### Note @@ -75 +65,0 @@ The repository will have this structure: `<repositoryID>.dkr.ecr.us-east-1.amazo -You can have up to 70 repositories per product. @@ -77 +66,0 @@ You can have up to 70 repositories per product. -A new request is created and shown on the **Requests** tab. When it's completed, within minutes, you can start adding container images and other artifacts to the repositories you have created. @@ -99,15 +88 @@ For general information about how to push container images and other artifacts t -###### Note - -You can use the following Amazon Elastic Container Registry (Amazon ECR) API operations when calling `docker pull` or `docker push`: - - * `DescribeImages` – Use this to review the metadata about the images in a repository. - - * `GetAuthorizationToken` – Use to authenticate before uploading artifacts to the repository, then use `docker pull` or `docker push` commands. - - * `ListImages` – Use to view a list of images you pushed. - - 8. Use the commands listed to push any needed artifacts from your local repository to the AWS Marketplace repository for your product. - -###### Note - -The `tag` that you provide in the `push` commands is used to differentiate the version of the artifact that you are uploading to the repository. Use a tag that makes sense for the version the artifacts are a part of. + 8. Use the commands listed to push any needed artifacts from your local repository to the AWS Marketplace repository for your product. The tag that you provide in the `push` command identifies the version of the artifact. Use a tag that matches the product version that the artifact belongs to. @@ -115 +90 @@ The `tag` that you provide in the `push` commands is used to differentiate the v - 9. Repeat for each container image or artifact you need in your version. + 9. Repeat for each container image or artifact that your version needs. Each delivery option can include up to 50 container images or artifacts. For all limits, see Limits for container product versions. @@ -117 +91,0 @@ The `tag` that you provide in the `push` commands is used to differentiate the v -###### Note @@ -119 +92,0 @@ The `tag` that you provide in the `push` commands is used to differentiate the v -Your version can include up to 50 container images or artifacts in each delivery option. Refer to the following procedure for more information about delivery options. @@ -122,7 +95 @@ Your version can include up to 50 container images or artifacts in each delivery - - -After you upload your artifacts, you're ready to create the version of your product. - -###### Note - -Your container images are scanned automatically to see if they meet the [Container-based product requirements for AWS Marketplace](./container-product-policies.html). For more information, see [Container product scans for security issues](./container-product-getting-started.html#container-security). +After you upload your artifacts, you're ready to create the version of your product. AWS Marketplace scans your container images automatically to check that they meet the [Container-based product requirements for AWS Marketplace](./container-product-policies.html). For more information, see [Container product scans for security issues](./container-product-getting-started.html#container-security). @@ -145,4 +111,0 @@ Each version of your container product would need a delivery option. Delivery op -###### Note - -If you receive any errors when adding a new version to your container, see the [Add a new version Asynchronous Errors table](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/container-products.html#container-add-version) in the _AWS Marketplace Catalog API Reference_. - @@ -159,5 +122 @@ If you receive any errors when adding a new version to your container, see the [ - 5. After entering the version details, the next step is to add delivery options. Delivery options are sets of instructions and information that buyers can use to launch the software from your product version. Delivery options are known as _fulfillment options_ to buyers. - -###### Note - -Your product can support multiple platforms with different container images (for example, Kubernetes and Ubuntu deployments). You can create one delivery option for each way that customers can set up your product, up to four delivery options per version of the product. + 5. After entering the version details, the next step is to add delivery options. Delivery options are sets of instructions and information that buyers can use to launch the software from your product version. Delivery options are known as _fulfillment options_ to buyers. Create one delivery option for each way that buyers can set up your product, for example Kubernetes and Ubuntu deployments that use different container images. Each request can include up to four delivery options. @@ -201 +160 @@ Your product can support multiple platforms with different container images (for - 6. _Optional -_ In **Helm release name** , enter the name of the Kubernetes namespace where the Helm chart will be installed. + 6. _Optional -_ In **Helm release name** , enter the name for the Helm release that the `helm install` command uses. @@ -203 +162 @@ Your product can support multiple platforms with different container images (for - 7. _Optional -_ In **Helm installation namespace** , enter the name for the Helm release that will be used by the `helm install` command. + 7. In **Helm installation namespace** , enter the name of the Kubernetes namespace where the Helm chart is installed. This field is required for paid products and optional for free products. @@ -207 +166 @@ Your product can support multiple platforms with different container images (for - 9. In **Override parameters** , enter parameters that will be used in the Helm CLI commands that launch the software. These parameters allow buyers to override the provided default values. There is a limit of 15 parameters when using the AWS Marketplace Management Console, but there is no limit when using the AWS Marketplace Catalog API. For more information, see [Adding a new version to a container-based product](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/container-products.html#container-add-version). + 9. In **Override parameters** , enter parameters that will be used in the Helm CLI commands that launch the software. These parameters allow buyers to override the provided default values. You can enter up to 15 parameters. For more information, see [Adding a new version to a container-based product](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/container-products.html#container-add-version). @@ -209 +168 @@ Your product can support multiple platforms with different container images (for -###### Note +Paid products must include these override parameters: @@ -211 +170 @@ Your product can support multiple platforms with different container images (for -Some **Override parameters** are required. Amazon EKS Anywhere products require an **Override parameter** for license secret with a `DefaultValue` of `"${AWSMP_LICENSE_SECRET}"`. For paid products, you must provide one **Override parameter** for service account configuration with the `DefaultValue` of `"${AWSMP_SERVICE_ACCOUNT}"`. + * If the delivery option supports Amazon EKS Anywhere, include exactly one override parameter with a `DefaultValue` of `"${AWSMP_LICENSE_SECRET}"`. The product must also use contract pricing. @@ -213,3 +172 @@ Some **Override parameters** are required. Amazon EKS Anywhere products require - 10. Choose **Hide passwords and secrets** to mask sensitive information in consoles, command line tools, and APIs. For more information, see the `NoEcho` parameter documentation in [Parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html) in the _AWS CloudFormation User Guide_. - - 3. To add an **Amazon EKS console add-on** delivery option, make sure that artifacts conform to [Requirements for Amazon EKS add-on products](./container-product-policies.html#publishing-eks-add-on), and then perform the following steps: + * If you leave **Kubernetes service account name** empty, include exactly one override parameter with a `DefaultValue` of `"${AWSMP_SERVICE_ACCOUNT}"`. @@ -217 +174 @@ Some **Override parameters** are required. Amazon EKS Anywhere products require -###### Note + 10. Choose **Hide passwords and secrets** to mask sensitive information in consoles, command line tools, and APIs. For more information, see the `NoEcho` parameter documentation in [Parameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html) in the _AWS CloudFormation User Guide_. @@ -219 +176 @@ Some **Override parameters** are required. Amazon EKS Anywhere products require -Only one Amazon EKS add-on delivery option is supported per version. You aren't able to add a new version until the current version you're working with is published on the Amazon EKS console. + 3. To add an **Amazon EKS console add-on** delivery option, make sure that artifacts conform to [Requirements for Amazon EKS add-on products](./container-product-policies.html#publishing-eks-add-on), and then perform the following steps. Each request can include only one Amazon EKS add-on delivery option. @@ -249,0 +207,2 @@ Only one Amazon EKS add-on delivery option is supported per version. You aren't +If your request fails, see the [Add a new version Asynchronous Errors table](https://docs.aws.amazon.com/marketplace-catalog/latest/api-reference/container-products.html#container-add-version) in the _AWS Marketplace Catalog API Reference_. + @@ -320,0 +280,13 @@ To restrict a version of your container product published as an add-on, contact +## Limits for container product versions + +The following limits apply to each container product. + +Resource | Limit +---|--- +Repositories per product | 70 +Delivery options per request | 4 +Amazon EKS add-on delivery options per request | 1 +Container images or artifacts per delivery option | 50 +Container images per delivery option that supports Amazon Bedrock AgentCore | 1 +Override parameters per Helm chart delivery option | 15 +