search

aws-solutions / aws-control-tower-customizations

The Customizations for AWS Control Tower solution combines AWS Control Tower and other highly-available, trusted AWS services to help customers more quickly set up a secure, multi-account AWS environment using AWS best practices.
https://docs.aws.amazon.com/controltower/latest/userguide/cfct-overview.html
Apache License 2.0
354 stars 205 forks source link

Sanitize quotes/double quotes in manifest resource_file field #170

Open riccardo94p opened 10 months ago

riccardo94p commented 10 months ago

Problem

If specifying the resource_file in the resource section of the manifest.yaml file with double quotes, the Build stage in the CodePipeline breaks. As per the AWS Documentation on the matter, this field is of type String therefore they should be allowed. Moreover, quotes are not explicitly prohibited.

More specifically, given a manifest.yaml as follows:

---
region: "eu-west-1"
version: 2021-03-15
resources:
  - name: "cfct-cloudformation-infra-customization"
    resource_file: "templates/infrastructure.template"
    deploy_method: stack_set
    deployment_targets:
      accounts:
        - 123456789101

The CodeBuild action fails with the following message:

ERROR: File "templates/infrastructure.template" does not exist
^^^ Caught an error: Setting exit status flag to 1 ^^^

Upon closer inspection, this happens in the run-validation.sh script when it checks each file in the manifest to make sure it exists (in version 2.6.0 it begins in line 90). Here, the double quotes are propagated into the file name resulting into a path such as: /current/path/custom-control-tower-configuration/"templates/infrastructure.template".

Suggested improvement

Add double quotes sanitization, such as: file_name="${file_name//\"/}" or add some error message explaining that double quotes are not allowed in the resource_file property in the manifest.

snebhu3 commented 10 months ago

@riccardo94p Thanks for reaching out. I have created an internal backlog to address this. As a workaround we recommend not using quotes for specifying file name.