Amazon ECS Sample App
Congratulations!
Your application is now running on a container in Amazon ECS.
' > /usr/local/apache2/htdocs/index.html && httpd-foreground\""
- ]
+ ],
+ "logConfiguration": {
+ "logDriver": "awslogs",
+ "options": {
+ "awslogs-group": "/ecs/fargate-sample",
+ "awslogs-region": "us-east-1",
+ "awslogs-stream-prefix": "ecs"
+ }
+ }
}
]
}
EOF
+# Validate JSON before using
+if ! jq empty task-definition.json 2>/dev/null; then
+ echo "ERROR: Invalid JSON in task definition"
+ rm -f task-definition.json
+ exit 1
+fi
+
TASK_DEF_OUTPUT=$(execute_command "aws ecs register-task-definition --cli-input-json file://task-definition.json" "Register task definition")
check_for_aws_errors "$TASK_DEF_OUTPUT" "Register task definition"
-# Clean up temporary file
-rm -f task-definition.json
+# Clean up temporary file securely
+shred -vfz -n 3 task-definition.json 2>/dev/null || rm -f task-definition.json
CREATED_RESOURCES+=("Task Definition: $TASK_FAMILY")
@@ -343,17 +401,30 @@ if [[ "$VPC_ID" == "None" || -z "$VPC_ID" ]]; then
echo "ERROR: No default VPC found. Please create a default VPC or specify a custom VPC."
exit 1
fi
+
+# Validate VPC ID format
+if [[ ! "$VPC_ID" =~ ^vpc-[a-z0-9]{8,17}$ ]]; then
+ echo "ERROR: Invalid VPC ID format: $VPC_ID"
+ exit 1
+fi
+
echo "Using default VPC: $VPC_ID"
# Create security group with restricted access
# Note: This allows HTTP access from anywhere for demo purposes
# In production, restrict source to specific IP ranges or security groups
-SECURITY_GROUP_OUTPUT=$(execute_command "aws ec2 create-security-group --group-name $SECURITY_GROUP_NAME --description 'Security group for ECS Fargate tutorial - HTTP access' --vpc-id $VPC_ID" "Create security group")
+SECURITY_GROUP_OUTPUT=$(execute_command "aws ec2 create-security-group --group-name '$SECURITY_GROUP_NAME' --description 'Security group for ECS Fargate tutorial - HTTP access' --vpc-id '$VPC_ID'" "Create security group")
check_for_aws_errors "$SECURITY_GROUP_OUTPUT" "Create security group"
-SECURITY_GROUP_ID=$(echo "$SECURITY_GROUP_OUTPUT" | grep -o '"GroupId": "[^"]*"' | cut -d'"' -f4)
-if [[ -z "$SECURITY_GROUP_ID" ]]; then
- SECURITY_GROUP_ID=$(aws ec2 describe-security-groups --group-names "$SECURITY_GROUP_NAME" --query "SecurityGroups[0].GroupId" --output text)
+SECURITY_GROUP_ID=$(echo "$SECURITY_GROUP_OUTPUT" | grep -o '"GroupId": "[^"]*"' | head -1 | cut -d'"' -f4)
+if [[ -z "$SECURITY_GROUP_ID" || "$SECURITY_GROUP_ID" == "None" ]]; then
+ SECURITY_GROUP_ID=$(aws ec2 describe-security-groups --group-names "$SECURITY_GROUP_NAME" --filters "Name=vpc-id,Values=$VPC_ID" --query "SecurityGroups[0].GroupId" --output text)
+fi
+
+# Validate security group ID format
+if [[ ! "$SECURITY_GROUP_ID" =~ ^sg-[a-z0-9]{8,17}$ ]]; then
+ echo "ERROR: Invalid security group ID format: $SECURITY_GROUP_ID"
+ exit 1
fi
echo "Created security group: $SECURITY_GROUP_ID"
@@ -362,7 +433,7 @@ CREATED_RESOURCES+=("Security Group: $SECURITY_GROUP_ID")
# Add HTTP inbound rule
# WARNING: This allows HTTP access from anywhere (0.0.0.0/0)
# In production environments, restrict this to specific IP ranges
-execute_command "aws ec2 authorize-security-group-ingress --group-id $SECURITY_GROUP_ID --protocol tcp --port 80 --cidr 0.0.0.0/0" "Add HTTP inbound rule to security group"
+execute_command "aws ec2 authorize-security-group-ingress --group-id '$SECURITY_GROUP_ID' --protocol tcp --port 80 --cidr 0.0.0.0/0" "Add HTTP inbound rule to security group"
# Get subnet IDs from default VPC
echo "Getting subnet IDs from default VPC..."
@@ -390,7 +461,7 @@ echo "STEP 5: CREATE ECS SERVICE"
echo "==========================================="
# Create the service with proper JSON formatting for network configuration
-SERVICE_CMD="aws ecs create-service --cluster $CLUSTER_NAME --service-name $SERVICE_NAME --task-definition $TASK_FAMILY --desired-count 1 --launch-type FARGATE --network-configuration '{\"awsvpcConfiguration\":{\"subnets\":[\"$(echo $SUBNET_IDS_COMMA | sed 's/,/","/g')\"],\"securityGroups\":[\"$SECURITY_GROUP_ID\"],\"assignPublicIp\":\"ENABLED\"}}'"
+SERVICE_CMD="aws ecs create-service --cluster '$CLUSTER_NAME' --service-name '$SERVICE_NAME' --task-definition '$TASK_FAMILY' --desired-count 1 --launch-type FARGATE --network-configuration '{\"awsvpcConfiguration\":{\"subnets\":[\"$(echo "$SUBNET_IDS_COMMA" | sed 's/,/","/g')\"],\"securityGroups\":[\"$SECURITY_GROUP_ID\"],\"assignPublicIp\":\"ENABLED\"}}'"
echo "Service creation command: $SERVICE_CMD"
@@ -406,10 +477,10 @@ echo "STEP 6: WAIT FOR SERVICE AND GET PUBLIC IP"
echo "==========================================="
echo "Waiting for service to stabilize (this may take a few minutes)..."
-execute_command "aws ecs wait services-stable --cluster $CLUSTER_NAME --services $SERVICE_NAME" "Wait for service to stabilize"
+execute_command "aws ecs wait services-stable --cluster '$CLUSTER_NAME' --services '$SERVICE_NAME'" "Wait for service to stabilize"
# Get task ARN
-TASK_ARN=$(aws ecs list-tasks --cluster $CLUSTER_NAME --service-name $SERVICE_NAME --query "taskArns[0]" --output text)
+TASK_ARN=$(aws ecs list-tasks --cluster "$CLUSTER_NAME" --service-name "$SERVICE_NAME" --query "taskArns[0]" --output text)
if [[ "$TASK_ARN" == "None" || -z "$TASK_ARN" ]]; then
echo "ERROR: No running tasks found for service"
exit 1
@@ -418,27 +489,39 @@ fi
echo "Task ARN: $TASK_ARN"
# Get network interface ID
-ENI_ID=$(aws ecs describe-tasks --cluster $CLUSTER_NAME --tasks $TASK_ARN --query "tasks[0].attachments[0].details[?name=='networkInterfaceId'].value" --output text)
+ENI_ID=$(aws ecs describe-tasks --cluster "$CLUSTER_NAME" --tasks "$TASK_ARN" --query "tasks[0].attachments[0].details[?name=='networkInterfaceId'].value" --output text)
if [[ "$ENI_ID" == "None" || -z "$ENI_ID" ]]; then
echo "ERROR: Could not retrieve network interface ID"
exit 1
fi
+# Validate ENI ID format
+if [[ ! "$ENI_ID" =~ ^eni-[a-z0-9]{8,17}$ ]]; then
+ echo "ERROR: Invalid network interface ID format: $ENI_ID"
+ exit 1
+fi
+
echo "Network Interface ID: $ENI_ID"
# Get public IP
-PUBLIC_IP=$(aws ec2 describe-network-interfaces --network-interface-ids $ENI_ID --query "NetworkInterfaces[0].Association.PublicIp" --output text)
+PUBLIC_IP=$(aws ec2 describe-network-interfaces --network-interface-ids "$ENI_ID" --query "NetworkInterfaces[0].Association.PublicIp" --output text)
if [[ "$PUBLIC_IP" == "None" || -z "$PUBLIC_IP" ]]; then
echo "WARNING: No public IP assigned to the task"
echo "The task may be in a private subnet or public IP assignment failed"
else
- echo ""
- echo "==========================================="
- echo "SUCCESS! APPLICATION IS RUNNING"
- echo "==========================================="
- echo "Your application is available at: http://$PUBLIC_IP"
- echo "You can test it by opening this URL in your browser"
- echo ""
+ # Validate IP format
+ if [[ ! "$PUBLIC_IP" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
+ echo "ERROR: Invalid IP address format: $PUBLIC_IP"
+ PUBLIC_IP=""
+ else
+ echo ""
+ echo "==========================================="
+ echo "SUCCESS! APPLICATION IS RUNNING"
+ echo "==========================================="
+ echo "Your application is available at: http://$PUBLIC_IP"
+ echo "You can test it by opening this URL in your browser"
+ echo ""
+ fi
fi
# Display service information
@@ -446,7 +529,7 @@ echo ""
echo "==========================================="
echo "SERVICE INFORMATION"
echo "==========================================="
-execute_command "aws ecs describe-services --cluster $CLUSTER_NAME --services $SERVICE_NAME" "Get service details"
+execute_command "aws ecs describe-services --cluster '$CLUSTER_NAME' --services '$SERVICE_NAME'" "Get service details"
echo ""
echo "==========================================="
@@ -463,4 +546,4 @@ if [[ -n "$PUBLIC_IP" && "$PUBLIC_IP" != "None" ]]; then
fi
echo ""
-echo "Script completed at $(date)"
+echo "Script completed at $(date)"
\ No newline at end of file
diff --git a/tuts/087-apigateway-lambda-integration/REVISION-HISTORY.md b/tuts/087-apigateway-lambda-integration/REVISION-HISTORY.md
index 7c03956f..91c2b86e 100644
--- a/tuts/087-apigateway-lambda-integration/REVISION-HISTORY.md
+++ b/tuts/087-apigateway-lambda-integration/REVISION-HISTORY.md
@@ -10,3 +10,7 @@
- Type: functional
- security notes
+
+### 2026-04-27 v-ni1 non-interactive
+- Type: functional
+- Made script fully non-interactive for automated testing
diff --git a/tuts/087-apigateway-lambda-integration/apigateway-lambda-integration.sh b/tuts/087-apigateway-lambda-integration/apigateway-lambda-integration.sh
old mode 100755
new mode 100644
index debd0b23..1c9f3f76
--- a/tuts/087-apigateway-lambda-integration/apigateway-lambda-integration.sh
+++ b/tuts/087-apigateway-lambda-integration/apigateway-lambda-integration.sh
@@ -1,5 +1,7 @@
#!/bin/bash
+set -euo pipefail
+
# Simple API Gateway Lambda Integration Script
# This script creates a REST API with Lambda proxy integration
@@ -12,59 +14,91 @@ API_NAME="LambdaProxyAPI-$(openssl rand -hex 4)"
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGION=$(aws configure get region || echo "us-east-1")
+# Validate inputs
+if [[ -z "$ACCOUNT_ID" ]] || [[ -z "$REGION" ]]; then
+ echo "Error: Failed to retrieve AWS account information" >&2
+ exit 1
+fi
+
echo "Creating Lambda function code..."
-# Create Lambda function code
+# Create Lambda function code with input validation
cat > lambda_function.py << 'EOF'
import json
+import logging
+
+logger = logging.getLogger()
+logger.setLevel(logging.INFO)
def lambda_handler(event, context):
- print(event)
-
- greeter = 'World'
-
- try:
- if (event['queryStringParameters']) and (event['queryStringParameters']['greeter']) and (
- event['queryStringParameters']['greeter'] is not None):
- greeter = event['queryStringParameters']['greeter']
- except KeyError:
- print('No greeter')
-
- try:
- if (event['multiValueHeaders']) and (event['multiValueHeaders']['greeter']) and (
- event['multiValueHeaders']['greeter'] is not None):
- greeter = " and ".join(event['multiValueHeaders']['greeter'])
- except KeyError:
- print('No greeter')
-
try:
- if (event['headers']) and (event['headers']['greeter']) and (
- event['headers']['greeter'] is not None):
- greeter = event['headers']['greeter']
- except KeyError:
- print('No greeter')
-
- if (event['body']) and (event['body'] is not None):
- body = json.loads(event['body'])
- try:
- if (body['greeter']) and (body['greeter'] is not None):
- greeter = body['greeter']
- except KeyError:
- print('No greeter')
-
- res = {
- "statusCode": 200,
- "headers": {
- "Content-Type": "*/*"
- },
- "body": "Hello, " + greeter + "!"
- }
-
- return res
+ logger.info("Received event: %s", json.dumps(event))
+
+ greeter = 'World'
+
+ # Safely retrieve greeter from query string parameters
+ query_params = event.get('queryStringParameters') or {}
+ if isinstance(query_params, dict) and 'greeter' in query_params:
+ greeter_value = query_params.get('greeter')
+ if isinstance(greeter_value, str) and greeter_value:
+ greeter = greeter_value
+
+ # Safely retrieve greeter from multi-value headers
+ multi_headers = event.get('multiValueHeaders') or {}
+ if isinstance(multi_headers, dict) and 'greeter' in multi_headers:
+ greeter_list = multi_headers.get('greeter', [])
+ if isinstance(greeter_list, list) and greeter_list:
+ greeter = " and ".join(str(g) for g in greeter_list if g)
+
+ # Safely retrieve greeter from headers
+ headers = event.get('headers') or {}
+ if isinstance(headers, dict) and 'greeter' in headers:
+ greeter_value = headers.get('greeter')
+ if isinstance(greeter_value, str) and greeter_value:
+ greeter = greeter_value
+
+ # Safely retrieve greeter from body
+ body = event.get('body')
+ if body and isinstance(body, str):
+ try:
+ body_dict = json.loads(body)
+ if isinstance(body_dict, dict) and 'greeter' in body_dict:
+ greeter_value = body_dict.get('greeter')
+ if isinstance(greeter_value, str) and greeter_value:
+ greeter = greeter_value
+ except (json.JSONDecodeError, ValueError) as e:
+ logger.warning("Failed to parse body: %s", str(e))
+
+ # Sanitize greeter to prevent injection
+ greeter = greeter.replace('"', '\\"').replace("'", "\\'")
+
+ response = {
+ "statusCode": 200,
+ "headers": {
+ "Content-Type": "application/json"
+ },
+ "body": json.dumps({"message": f"Hello, {greeter}!"})
+ }
+
+ logger.info("Response: %s", json.dumps(response))
+ return response
+
+ except Exception as e:
+ logger.error("Unexpected error: %s", str(e), exc_info=True)
+ return {
+ "statusCode": 500,
+ "headers": {
+ "Content-Type": "application/json"
+ },
+ "body": json.dumps({"error": "Internal server error"})
+ }
EOF
# Create deployment package
-zip function.zip lambda_function.py
+zip -q function.zip lambda_function.py || {
+ echo "Error: Failed to create function.zip" >&2
+ exit 1
+}
echo "Creating IAM role..."
@@ -84,38 +118,57 @@ cat > trust-policy.json << 'EOF'
}
EOF
-# Create IAM role
+# Create IAM role with error handling
aws iam create-role \
--role-name "$ROLE_NAME" \
- --assume-role-policy-document file://trust-policy.json
+ --assume-role-policy-document file://trust-policy.json \
+ --description "Temporary role for Lambda execution" || {
+ echo "Error: Failed to create IAM role" >&2
+ exit 1
+}
# Attach execution policy
aws iam attach-role-policy \
--role-name "$ROLE_NAME" \
- --policy-arn "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+ --policy-arn "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" || {
+ echo "Error: Failed to attach IAM policy" >&2
+ exit 1
+}
# Wait for role propagation
sleep 15
echo "Creating Lambda function..."
-# Create Lambda function
+# Create Lambda function with Python 3.11 (more recent runtime)
aws lambda create-function \
--function-name "$FUNCTION_NAME" \
- --runtime python3.9 \
+ --runtime python3.11 \
--role "arn:aws:iam::$ACCOUNT_ID:role/$ROLE_NAME" \
--handler lambda_function.lambda_handler \
- --zip-file fileb://function.zip
+ --zip-file fileb://function.zip \
+ --timeout 30 \
+ --memory-size 128 \
+ --environment "Variables={LOG_LEVEL=INFO}" || {
+ echo "Error: Failed to create Lambda function" >&2
+ exit 1
+}
echo "Creating API Gateway..."
-# Create REST API
-aws apigateway create-rest-api \
+# Create REST API with minimum logging
+API_RESPONSE=$(aws apigateway create-rest-api \
--name "$API_NAME" \
- --endpoint-configuration types=REGIONAL
+ --endpoint-configuration types=REGIONAL \
+ --description "API for Lambda proxy integration tutorial" \
+ --output json)
+
+API_ID=$(echo "$API_RESPONSE" | grep -o '"id": "[^"]*"' | head -1 | cut -d'"' -f4)
-# Get API ID
-API_ID=$(aws apigateway get-rest-apis --query "items[?name=='$API_NAME'].id" --output text)
+if [[ -z "$API_ID" ]]; then
+ echo "Error: Failed to create API Gateway" >&2
+ exit 1
+fi
# Get root resource ID
ROOT_RESOURCE_ID=$(aws apigateway get-resources --rest-api-id "$API_ID" --query 'items[?path==`/`].id' --output text)
@@ -124,17 +177,23 @@ ROOT_RESOURCE_ID=$(aws apigateway get-resources --rest-api-id "$API_ID" --query
aws apigateway create-resource \
--rest-api-id "$API_ID" \
--parent-id "$ROOT_RESOURCE_ID" \
- --path-part helloworld
+ --path-part helloworld || {
+ echo "Error: Failed to create resource" >&2
+ exit 1
+}
# Get resource ID
RESOURCE_ID=$(aws apigateway get-resources --rest-api-id "$API_ID" --query "items[?pathPart=='helloworld'].id" --output text)
-# Create ANY method
+# Create ANY method with no authorization (intentional for tutorial)
aws apigateway put-method \
--rest-api-id "$API_ID" \
--resource-id "$RESOURCE_ID" \
--http-method ANY \
- --authorization-type NONE
+ --authorization-type NONE || {
+ echo "Error: Failed to create method" >&2
+ exit 1
+}
# Set up Lambda proxy integration
LAMBDA_URI="arn:aws:apigateway:$REGION:lambda:path/2015-03-31/functions/arn:aws:lambda:$REGION:$ACCOUNT_ID:function:$FUNCTION_NAME/invocations"
@@ -145,22 +204,33 @@ aws apigateway put-integration \
--http-method ANY \
--type AWS_PROXY \
--integration-http-method POST \
- --uri "$LAMBDA_URI"
+ --uri "$LAMBDA_URI" || {
+ echo "Error: Failed to create integration" >&2
+ exit 1
+}
# Grant API Gateway permission to invoke Lambda
+STATEMENT_ID="apigateway-invoke-$(openssl rand -hex 4)"
SOURCE_ARN="arn:aws:execute-api:$REGION:$ACCOUNT_ID:$API_ID/*/*"
aws lambda add-permission \
--function-name "$FUNCTION_NAME" \
- --statement-id "apigateway-invoke-$(openssl rand -hex 4)" \
+ --statement-id "$STATEMENT_ID" \
--action lambda:InvokeFunction \
--principal apigateway.amazonaws.com \
- --source-arn "$SOURCE_ARN"
+ --source-arn "$SOURCE_ARN" || {
+ echo "Error: Failed to add Lambda permission" >&2
+ exit 1
+}
# Deploy API
aws apigateway create-deployment \
--rest-api-id "$API_ID" \
- --stage-name test
+ --stage-name test \
+ --description "Test deployment" || {
+ echo "Error: Failed to deploy API" >&2
+ exit 1
+}
echo "Testing API..."
@@ -169,23 +239,27 @@ INVOKE_URL="https://$API_ID.execute-api.$REGION.amazonaws.com/test/helloworld"
echo "API URL: $INVOKE_URL"
-# Test with query parameter
+# Test with query parameter (with proper URL encoding)
echo "Testing with query parameter:"
-curl -X GET "$INVOKE_URL?greeter=John"
+curl -s -X GET "$INVOKE_URL?greeter=John" | jq . 2>/dev/null || curl -s -X GET "$INVOKE_URL?greeter=John"
echo ""
# Test with header
echo "Testing with header:"
-curl -X GET "$INVOKE_URL" \
+curl -s -X GET "$INVOKE_URL" \
+ -H 'content-type: application/json' \
+ -H 'greeter: John' | jq . 2>/dev/null || curl -s -X GET "$INVOKE_URL" \
-H 'content-type: application/json' \
-H 'greeter: John'
echo ""
# Test with body
echo "Testing with POST body:"
-curl -X POST "$INVOKE_URL" \
+curl -s -X POST "$INVOKE_URL" \
+ -H 'content-type: application/json' \
+ -d '{"greeter": "John"}' | jq . 2>/dev/null || curl -s -X POST "$INVOKE_URL" \
-H 'content-type: application/json' \
- -d '{ "greeter": "John" }'
+ -d '{"greeter": "John"}'
echo ""
echo "Tutorial completed! API is available at: $INVOKE_URL"
@@ -194,19 +268,19 @@ echo "Tutorial completed! API is available at: $INVOKE_URL"
echo "Cleaning up resources..."
# Delete API
-aws apigateway delete-rest-api --rest-api-id "$API_ID"
+aws apigateway delete-rest-api --rest-api-id "$API_ID" || echo "Warning: Failed to delete API" >&2
# Delete Lambda function
-aws lambda delete-function --function-name "$FUNCTION_NAME"
+aws lambda delete-function --function-name "$FUNCTION_NAME" || echo "Warning: Failed to delete Lambda function" >&2
# Detach policy and delete role
aws iam detach-role-policy \
--role-name "$ROLE_NAME" \
- --policy-arn "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+ --policy-arn "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" || echo "Warning: Failed to detach policy" >&2
-aws iam delete-role --role-name "$ROLE_NAME"
+aws iam delete-role --role-name "$ROLE_NAME" || echo "Warning: Failed to delete role" >&2
-# Clean up local files
+# Clean up local files securely
rm -f lambda_function.py function.zip trust-policy.json
-echo "Cleanup completed!"
+echo "Cleanup completed!"
\ No newline at end of file